Microsoft Windows XP Home Edition 5.1.2600.3.1256.1.1025.18.456 [GMT 3:00]
Running from: C:\Documents and Settings\Owner\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\i.txt
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\svch0st.exe
C:\WINDOWS\system32\vb6lib.dll
C:\WINDOWS\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-27 to 2008-07-27 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 16:15 2,103,840 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-27 16:15 18,564 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-27 15:23 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-07-27 14:52 294,944 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-27 14:52 2,088 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-27 12:14 --------- d-----w C:\Program Files\Ad-aware 4.0
2008-07-27 11:56 --------- d-----w C:\Program Files\IconChanger
2008-07-27 09:32 --------- d-----w C:\Program Files\Abadisoft
2008-07-27 09:31 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-07-27 08:55 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-27 08:55 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-27 08:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
2008-07-27 08:39 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-27 08:37 --------- d-----w C:\Program Files\Avira
2008-07-27 08:35 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-07-27 08:33 --------- d-----w C:\Program Files\SweetIM
2008-07-27 08:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2008-07-27 08:28 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-27 08:28 --------- d-----w C:\Program Files\CEDP Stealer 6.0 for Messenger
2008-07-27 07:35 --------- d-----w C:\Program Files\Microsoft Windows OneCare Live
2008-07-26 21:11 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SweetIM
2008-07-26 19:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\Hewlett-Packard
2008-07-26 19:22 82,380 ----a-w C:\WINDOWS\system32\drivers\AFS2K.SYS
2008-07-26 19:22 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-26 19:17 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-07-26 15:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\Desktopicon
2008-07-26 12:01 --------- d-----w C:\Program Files\Hotspot Shield
2008-07-26 10:39 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-07-26 08:23 --------- d-----w C:\Program Files\Total Video Converter
2008-07-26 08:21 --------- d-----w C:\Program Files\Xilisoft
2008-07-26 08:21 --------- d-----w C:\Program Files\QuickTime
2008-07-25 14:34 --------- d-----w C:\Program Files\Macromedia
2008-07-25 14:31 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-07-24 20:41 --------- d-----w C:\Program Files\Unlocker
2008-07-24 20:35 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-07-24 20:35 --------- d-----w C:\Program Files\Nokia
2008-07-24 20:35 --------- d-----w C:\Program Files\DIFX
2008-07-24 20:35 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-07-24 20:35 --------- d-----w C:\Program Files\Common Files\Nokia
2008-07-24 20:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-24 20:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations
2008-07-24 19:05 --------- d-----w C:\Documents and Settings\Owner\Application Data\Thinstall
2008-07-24 17:24 --------- d-----w C:\Program Files\LaCie
2008-07-24 17:24 --------- d-----w C:\Documents and Settings\Owner\Application Data\LaCie
2008-07-24 08:27 --------- d-----w C:\Program Files\Windows Live
2008-07-23 21:44 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-07-23 21:28 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Memo save stupid creative
2008-07-23 20:40 --------- d-----w C:\Program Files\PremierOpinion
2008-07-23 08:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-07-21 21:50 --------- d-----w C:\Program Files\FormatFactory
2008-07-20 18:28 203,776 ----a-w C:\WINDOWS\system32\clrviddc.dll
2008-07-20 18:26 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-07-20 18:26 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-07-20 18:26 --------- d-----w C:\Program Files\Common Files\Real
2008-07-19 20:52 --------- d-----w C:\Program Files\Real_SC
2008-07-19 19:58 344,064 ----a-w C:\WINDOWS\system32\dkll.dll
2008-07-19 19:58 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-07-19 19:58 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-07-19 19:58 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-07-19 19:54 --------- d-----w C:\Program Files\Duplicate File Remover
2008-07-19 17:43 --------- d-----w C:\Program Files\Ozone
2008-07-17 12:04 --------- d-----w C:\Program Files\InCode Solutions
2008-07-17 11:43 --------- d-----w C:\Program Files\ActiveX
2008-07-16 20:04 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-07-15 04:33 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-10 20:04 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-07-10 20:04 --------- d-----w C:\Program Files\ACD Systems
2008-07-10 20:04 --------- d-----w C:\Documents and Settings\Owner\Application Data\ACD Systems
2008-07-10 20:04 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\ACD Systems
2008-07-10 17:25 --------- d-----w C:\Program Files\Common Files\Nero
2008-07-10 17:23 --------- d-----w C:\Program Files\Nero
2008-07-10 17:23 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-07-10 09:14 --------- d-----w C:\Documents and Settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-07-10 08:45 --------- d-----w C:\Program Files\GetData
2008-07-10 08:37 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-07-10 07:47 --------- d-----w C:\Program Files\AskTBar
2008-07-09 21:35 --------- d-----w C:\Program Files\MSXML 4.0
2008-07-09 20:51 --------- d-----w C:\Program Files\Sun
2008-07-09 20:50 --------- d-----w C:\Program Files\Java
2008-07-09 20:50 --------- d-----w C:\Program Files\Common Files\Java
2008-07-09 20:17 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-07-09 20:16 --------- d-----w C:\Documents and Settings\Owner\Application Data\URSoft
2008-07-09 17:41 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-09 11:36 --------- d-----w C:\Documents and Settings\Owner\Application Data\Nero
2008-07-08 20:52 --------- d-----w C:\Program Files\AM-DeadLink
2008-07-08 19:55 --------- d-----w C:\Documents and Settings\Owner\Application Data\aignes
2008-07-08 14:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\OfficeUpdate12
2008-07-08 12:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Office Genuine Advantage
2008-07-08 11:48 --------- d-----w C:\Program Files\MSBuild
2008-07-08 11:48 --------- d-----w C:\Program Files\Microsoft Works
2008-07-08 00:55 306,432 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-08 00:55 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-07-08 00:55 --------- d-----w C:\Documents and Settings\Owner\Application Data\TuneUp Software
2008-07-08 00:54 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\TuneUp Software
2008-07-07 23:05 --------- d-----w C:\Program Files\Driver-Soft
2008-07-07 22:47 --------- d-----w C:\Documents and Settings\Administrator\Application Data\TuneUp Software
2008-06-20 17:47 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [07/26/2008 02:31 PM 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM 144784]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [04/25/2008 06:21 PM 201992]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/20/2008 09:26 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [04/14/2008 06:59 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 04/14/2008 06:59 PM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
"LaCie Backup"=C:\Program Files\LaCie\Backup Software\\LaCieBackup.exe /background
"Adaware Bootup"=C:\Program Files\Ad-aware 4.0\Ad-aware.exe /Auto /Log C:\Program Files\Ad-aware 4.0\
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMan"=SOUNDMAN.EXE
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"DrvIcon"=C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.922\VistaDriveIcon\DrvIcon.exe
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users.WINDOWS\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [04/14/2008 07:00 PM]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [03/25/2008 08:07 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [01/24/2008 12:25 AM]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [07/08/2008 03:55 AM]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-07-25 C:\WINDOWS\Tasks\1-Click Maintenance.job - C:\Program Files\TuneUp Utilities 2008\OneClick.exe [12/21/2007 03:17 PM]
2008-07-26 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1217100308.job - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [04/06/2003 12:52 AM]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-ThePrivacyGuard - D:\Program Files\The Privacy Guard\ThePrivacyGuard.exe
.
------- Supplementary Scan -------
.
O8 -: ت&صدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-27 20:21:08
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 07/27/2008 20:23:52
ComboFix-quarantined-files.txt 2008-07-27 17:22:50
Pre-Run: 26,161,127,424 bytes free
Post-Run: 26,304,737,280 bytes free
204 --- E O F --- 2008-07-26 07:25:40
