ComboFix 08-06-20.4 - mohamed salem 2008-06-21 22:25:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.136 [GMT 3:00]
Running from: C:\Documents and Settings\mohaed salem\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\15e122.exe
C:\WINDOWS\system32\15e9cd.exe
C:\WINDOWS\system32\15f2b6.exe
C:\WINDOWS\system32\15fb80.exe
C:\WINDOWS\system32\1f9f85.exe
C:\WINDOWS\system32\1fba60.exe
C:\WINDOWS\system32\1fd1ff.exe
C:\WINDOWS\system32\1fe289.exe
C:\WINDOWS\system32\350e65.exe
C:\WINDOWS\system32\3532b6.exe
C:\WINDOWS\system32\356c54.exe
C:\WINDOWS\system32\359be0.exe
C:\WINDOWS\system32\4ab85b.exe
C:\WINDOWS\system32\4aca5c.exe
C:\WINDOWS\system32\4ad7e9.exe
C:\WINDOWS\system32\4ae5f3.exe
C:\WINDOWS\system32\502bed.exe
C:\WINDOWS\system32\503543.exe
C:\WINDOWS\system32\503dfe.exe
C:\WINDOWS\system32\5046a8.exe
C:\WINDOWS\system32\5fed01.exe
C:\WINDOWS\system32\600992.exe
C:\WINDOWS\system32\60347a.exe
C:\WINDOWS\system32\605456.exe
C:\WINDOWS\system32\a7c72.exe
C:\WINDOWS\system32\a85b9.exe
C:\WINDOWS\system32\a8ee1.exe
C:\WINDOWS\system32\a97ab.exe
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\svch0st.exe
C:\WINDOWS\system32\winitn.dll
C:\WINDOWS\system32\wmdrtc32.dl_
C:\WINDOWS\system32\wmdrtc32.dll
D:\Autorun.inf . . . . failed to delete
E:\Autorun.inf . . . . failed to delete
F:\Autorun.inf . . . . failed to delete
G:\Autorun.inf . . . . failed to delete
H:\Autorun.inf . . . . failed to delete
I:\Autorun.inf . . . . failed to delete
.
((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
.
2008-06-21 21:57 . 2008-06-21 21:57 11,776 --a------ C:\WINDOWS\system32\15d943.exe
2008-06-21 21:57 . 2008-06-21 21:57 8,192 --a------ C:\WINDOWS\system32\15d088.exe
2008-06-21 19:42 . 2008-06-21 19:42 11,776 --a------ C:\WINDOWS\system32\5fd0af.exe
2008-06-21 19:42 . 2008-06-21 19:42 8,192 --a------ C:\WINDOWS\system32\5fc313.exe
2008-06-21 19:19 . 2008-06-21 19:19 11,776 --a------ C:\WINDOWS\system32\4aa1e5.exe
2008-06-21 19:19 . 2008-06-21 19:19 8,192 --a------ C:\WINDOWS\system32\4a8f57.exe
2008-06-21 18:55 . 2008-06-21 18:55 11,776 --a------ C:\WINDOWS\system32\34d748.exe
2008-06-21 18:55 . 2008-06-21 18:55 8,192 --a------ C:\WINDOWS\system32\34bde4.exe
2008-06-21 18:32 . 2008-06-21 18:32 11,776 --a------ C:\WINDOWS\system32\1f7f0c.exe
2008-06-21 18:32 . 2008-06-21 18:32 8,192 --a------ C:\WINDOWS\system32\1f6d59.exe
2008-06-21 18:14 . 2008-06-21 18:24 <DIR> d-------- C:\Program Files\McAfee
2008-06-21 18:09 . 2008-06-21 18:09 11,776 --a------ C:\WINDOWS\system32\a6cd2.exe
2008-06-21 18:09 . 2008-06-21 18:09 8,192 --a------ C:\WINDOWS\system32\a638b.exe
2008-06-21 17:35 . 2008-06-21 21:49 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-06-21 17:34 . 2008-06-21 17:34 <DIR> d-------- C:\KAV
2008-06-21 17:10 . 2002-01-10 03:01 110,592 --a------ C:\WINDOWS\system32\tsccvid.dll
2008-06-21 17:10 . 2008-06-21 17:10 4 --a------ C:\timeStmp.tmp
2008-06-21 16:52 . 2007-12-13 13:28 24,592 --a------ C:\WINDOWS\system32\drivers\klim5.sys
2008-06-21 15:43 . 2008-06-21 15:43 <DIR> d-------- C:\Program Files\Alwil Software
2008-06-21 14:41 . 2008-06-21 14:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-21 14:32 . 2008-06-21 14:33 <DIR> d-------- C:\WINDOWS\35C03C043F1F42C2A989A757EE691F65.TMP
2008-06-21 14:23 . 2008-06-21 14:23 11,776 --a------ C:\WINDOWS\system32\50244b.exe
2008-06-21 14:23 . 2008-06-21 14:23 8,192 --a------ C:\WINDOWS\system32\501caa.exe
2008-06-21 14:23 . 2008-06-21 22:30 5,477 --a------ C:\WINDOWS\system32\drivers\kntsjn.sys
2008-06-21 14:22 . 2006-10-26 23:07 38,400 ---hs---- C:\WINDOWS\system32\spoclv.exe
2008-06-21 10:10 . 2008-06-21 12:46 <DIR> d-------- C:\Program Files\vghd
2008-06-16 20:11 . 2008-05-01 01:32 107,596 --a------ C:\toolkit_widget.gif
2008-06-14 18:01 . 2008-06-14 18:01 <DIR> d-------- C:\Program Files\Aurora Media Workshop
2008-06-14 17:01 . 2008-06-14 17:01 <DIR> d-------- C:\Program Files\Boilsoft Video Joiner
2008-06-07 13:13 . 2008-06-07 13:13 <DIR> d-------- C:\Program Files\Ligos
2008-06-07 13:10 . 1998-10-29 19:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-06-06 21:49 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-06-06 21:49 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys
2008-06-06 21:49 . 2008-06-06 21:49 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-06-06 21:49 . 2008-06-06 21:49 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-06-06 21:44 . 2008-06-06 21:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nokia
2008-06-06 21:43 . 2008-06-06 21:43 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-06-06 21:43 . 2007-11-29 10:33 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-06-06 21:43 . 2008-02-01 15:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys
2008-06-06 21:43 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-06 21:43 . 2007-11-29 10:39 19,328 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-06-06 21:43 . 2007-11-29 10:39 16,896 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-06-06 21:43 . 2008-02-01 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys
2008-06-06 21:43 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-06-06 21:43 . 2007-11-29 10:39 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-06-05 18:33 . 2008-06-05 18:33 <DIR> d-------- C:\Documents and Settings\mohaed salem\Application Data\Alien Skin
2008-06-05 18:24 . 2008-06-05 18:24 <DIR> d-------- C:\Program Files\Alien Skin
2008-06-05 18:24 . 2008-06-05 18:24 <DIR> d-------- C:\Alien Skin
2008-06-04 20:41 . 2008-06-04 20:45 <DIR> d--h----- C:\msdownld.tmp
2008-06-04 20:37 . 2008-06-05 01:16 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-06-04 20:37 . 2008-06-04 20:37 <DIR> d-------- C:\WINDOWS\Logs
2008-05-30 10:27 . 2008-06-21 21:55 <DIR> d-------- C:\Program Files\Symantec
2008-05-30 10:25 . 2008-06-21 14:12 <DIR> d-------- C:\Program Files\Symantec AntiVirus
2008-05-27 15:58 . 2008-05-27 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2008-05-27 13:20 . 2008-05-30 18:02 <DIR> d-------- C:\Documents and Settings\mohaed salem\Application Data\GameHouse
2008-05-27 13:13 . 2008-05-27 13:13 <DIR> d-------- C:\Program Files\GameHouse
2008-05-27 12:20 . 2008-05-30 18:48 <DIR> d-------- C:\Program Files\AroundTheWorldIn80Days_at
2008-05-27 11:58 . 2008-05-27 11:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Fugazo
2008-05-27 11:54 . 2008-06-05 18:12 <DIR> d-------- C:\Program Files\CookingAcademy_at
2008-05-24 14:46 . 2008-05-24 14:46 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-05-24 14:40 . 2008-05-30 11:48 11 --a------ C:\WINDOWS\primopdf.ini
2008-05-24 12:18 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-24 12:16 . 2008-05-24 12:16 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-05-24 12:14 . 2008-06-18 19:05 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-24 12:14 . 2008-05-24 12:14 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-24 12:11 . 2008-05-24 12:11 <DIR> dr-h----- C:\MSOCache
2008-05-24 11:24 . 2008-05-24 11:50 <DIR> d-------- C:\Program Files\ResumeBuilder4
2008-05-24 11:23 . 2008-06-14 12:50 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-05-23 21:57 . 2008-05-23 22:04 <DIR> d-------- C:\Program Files\JanesHotel_at
2008-05-23 21:19 . 2008-05-23 21:19 <DIR> d-------- C:\Documents and Settings\mohaed salem\Application Data\Friday's games
2008-05-23 18:58 . 2008-05-23 18:58 <DIR> d-------- C:\Program Files\ReflexiveArcade
2008-05-23 17:29 . 2008-05-23 17:29 <DIR> d-------- C:\Program Files\bfgclient
2008-05-23 17:27 . 2008-05-23 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BigFishGamesCache
2008-05-23 16:21 . 2008-05-23 16:21 <DIR> d-------- C:\Documents and Settings\mohaed salem\Application Data\Jane s Hotel
2008-05-21 19:16 . 2008-05-30 11:35 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-05-21 19:16 . 2008-05-23 17:27 <DIR> d-------- C:\Documents and Settings\mohaed salem\Application Data\IDM
2008-05-21 19:04 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-21 19:24 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\DMCache
2008-06-21 19:15 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-21 18:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-21 18:47 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-21 16:22 --------- d-----w C:\Program Files\Video Convert Master
2008-06-21 12:20 --------- d-----w C:\Documents and Settings\Administrator\Application Data\cleaner
2008-06-18 16:05 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-13 14:40 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\PC Suite
2008-06-12 17:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-07 07:35 --------- d-----w C:\Program Files\The KMPlayer
2008-06-06 18:49 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Nokia
2008-06-06 18:43 --------- d-----w C:\Program Files\Nokia
2008-06-06 18:37 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-06 18:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-05-24 05:22 --------- d-----w C:\Program Files\Absolute MP3 Splitter
2008-05-23 14:29 0 ----a-w C:\Program Files\temp01
2008-05-17 20:07 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-05-17 20:07 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\SUPERAntiSpyware.com
2008-05-17 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-17 19:10 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-05-17 18:53 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\URSoft
2008-05-17 18:48 --------- d-----w C:\Program Files\Yahoo!
2008-05-17 08:52 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Axialis
2008-05-17 08:14 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-05-17 08:05 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-15 19:42 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\SystemRequirementsLab
2008-05-15 16:10 --------- d-----w C:\Program Files\Network Associates
2008-05-15 16:10 --------- d-----w C:\Program Files\Common Files\Network Associates
2008-05-11 21:19 --------- d-----w C:\Program Files\MSN Messenger
2008-05-11 21:18 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-11 20:59 --------- d-----w C:\Program Files\Windows Live
2008-05-11 20:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-10 11:43 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-10 11:37 --------- d-----w C:\Program Files\DAEMON Tools
2008-05-10 05:51 --------- d-----w C:\Program Files\Common Files\Cisco Systems
2008-05-10 05:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8(2)
2008-05-10 05:30 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-05-09 08:06 --------- d-----w C:\Program Files\Opera 9
2008-05-08 19:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-05-05 21:36 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\uTorrent
2008-05-05 20:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Drivers Headquarters
2008-05-03 06:55 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Talkback
2008-05-03 06:33 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Netscape
2008-05-03 06:24 155,995 ----a-w C:\WINDOWS\java\Packages\M4V3B7HR.ZIP
2008-05-03 06:21 --------- d-----w C:\Program Files\Java
2008-05-03 06:20 --------- d-----w C:\Program Files\Common Files\Java
2008-05-01 13:57 --------- d-----w C:\Program Files\Easiestutils
2008-05-01 11:24 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\AdobeUM
2008-05-01 06:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-04-29 04:02 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Webroot
2008-04-28 20:25 --------- d-----w C:\Program Files\MSXML 4.0
2008-04-28 19:39 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-04-28 19:39 47,360 ----a-w C:\Documents and Settings\mohaed salem\Application Data\pcouffin.sys
2008-04-28 19:39 110,592 ----a-w C:\Documents and Settings\mohaed salem\Application Data\ezpinst.exe
2008-04-28 19:39 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Vso
2008-04-28 05:48 --------- d-----w C:\Program Files\Arial Audio Converter
2008-04-28 01:02 --------- d-----w C:\Program Files\Winamp
2008-04-23 19:30 --------- d-----w C:\Documents and Settings\Administrator\Application Data\CyberScrub
2008-04-23 19:25 2,442 ----a-w C:\WINDOWS\system32\tmp.reg
2008-04-22 19:19 --------- d-----w C:\Program Files\HighCriteria
2008-04-22 00:05 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\gtopala
2008-04-21 21:20 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Nokia Multimedia Player
2008-04-21 21:09 --------- d-----w C:\Program Files\Samy_Soft
2008-04-21 17:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-04-21 16:55 --------- d-----w C:\Documents and Settings\mohaed salem\Application Data\Windows Search
2006-10-26 20:07 38,400 --sh--w C:\WINDOWS\system32\spoclv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2007-12-11 11:54 805888]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:56 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 11:17 1269760]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"= DrvTrNTm.dll
"wave"= DrvTrNTm.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Thomson SpeedTouch\\ST330\\service\\st330service.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\WINDOWS\\system32\\spoclv.exe"=
"C:\\WINDOWS\\system32\\501caa.exe"=
"C:\\WINDOWS\\system32\\50244b.exe"=
"C:\\WINDOWS\\system32\\a638b.exe"=
"C:\\WINDOWS\\system32\\a6cd2.exe"=
"C:\\WINDOWS\\system32\\1f6d59.exe"=
"C:\\WINDOWS\\system32\\34bde4.exe"=
"C:\\WINDOWS\\system32\\4a8f57.exe"=
"C:\\WINDOWS\\system32\\5fc313.exe"=
"C:\\WINDOWS\\system32\\15d088.exe"=
"C:\\WINDOWS\\system32\\15d943.exe"=
R2 dd_680;Provisioning Service Transaction;C:\WINDOWS\system32\spoclv.exe [2006-10-26 23:07]
R2 NdisFileServices32;NdisFileServices32;C:\WINDOWS\system32\drivers\kntsjn.sys [2008-06-21 22:34]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
R3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys [2008-04-09 23:14]
R3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys [2008-04-09 23:14]
R3 STETH;SpeedTouch Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\steth.sys [2008-04-09 23:14]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17]
S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-06-21 22:30:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\st330service]
"ImagePath"="C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2008-06-21 22:35:02 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-21 19:34:57
Pre-Run: 7,774,814,208 bytes free
Post-Run: 8,258,547,712 bytes free
264
Logfile of HijackThis v1.99.1
Scan saved at 10:37:02 PM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\spoclv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\mohaed salem\Desktop\HijackThis.exe
C:\Program Files\Opera 9\Opera.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll (file missing)
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{29ECD6CD-1BB7-4909-9C23-0C6FB840AB14}: NameServer = 163.121.128.134 163.121.128.135
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Provisioning Service Transaction (dd_680) - Unknown owner - C:\WINDOWS\system32\spoclv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe
