MAAX
تفضل هذا هو التقرير بالبرنامج الذى قلت لى ان احمله ComboFix
ComboFix 08-08-07.04 - Administrator 2008-08-08 13:10:17.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.246 [GMT 3:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-07-08 to 2008-08-08 )))))))))))))))))))))))))))))))
.
2008-08-08 02:00 . 2008-08-08 02:00 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-08-08 02:00 . 2008-08-08 02:00 <DIR> d-------- C:\WINDOWS\srchasst
2008-08-08 01:59 . 2008-08-08 01:59 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-08-08 01:14 . 2008-08-08 01:14 <DIR> d--hs---- C:\FOUND.053
2008-08-07 22:30 . 2008-08-07 22:31 <DIR> d-------- C:\Program Files\History Sweeper
2008-08-07 20:28 . 2008-08-07 20:28 <DIR> d--hs---- C:\FOUND.052
2008-08-03 11:53 . 2008-08-03 11:53 <DIR> d-------- C:\Program Files\IMMonitor
2008-08-03 08:18 . 2008-08-03 08:18 <DIR> d--hs---- C:\FOUND.051
2008-07-28 03:18 . 2008-07-28 03:18 <DIR> d-------- C:\Program Files\The KMPlayer
2008-07-27 08:59 . 2008-07-28 16:34 286,720 --------- C:\WINDOWS\Setup1.exe
2008-07-27 08:59 . 2008-07-28 16:34 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-07-27 08:57 . 2008-07-27 08:57 <DIR> d--hs---- C:\FOUND.050
2008-07-26 14:26 . 2008-07-26 14:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2008-07-26 14:12 . 2008-07-26 14:12 <DIR> d-------- C:\Program Files\OpenOffice.org 2.4
2008-07-26 14:10 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-26 14:04 . 2008-07-26 14:04 <DIR> d-------- C:\Program Files\Java
2008-07-26 14:04 . 2008-07-26 14:04 <DIR> d-------- C:\Program Files\Common Files\Java
2008-07-26 02:16 . 2008-07-26 02:25 704 --a------ C:\Outbreaker.dat
2008-07-24 12:04 . 2008-07-24 12:04 <DIR> d--hs---- C:\FOUND.049
2008-07-24 11:57 . 2008-07-24 11:57 <DIR> d--hs---- C:\FOUND.048
2008-07-24 11:52 . 2008-07-24 11:52 <DIR> d--hs---- C:\FOUND.047
2008-07-23 12:02 . 2008-07-23 12:02 <DIR> d--hs---- C:\FOUND.046
2008-07-22 11:34 . 2008-07-22 11:34 227,900 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-07-22 10:48 . 2008-07-22 10:48 <DIR> d--hs---- C:\FOUND.045
2008-07-18 11:02 . 2008-07-18 11:02 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AlMAdinahMushaf
2008-07-18 11:00 . 2008-07-18 11:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-07-18 10:59 . 2005-02-17 01:15 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl
2008-07-18 10:58 . 2008-07-18 10:58 <DIR> d-------- C:\Program Files\ê¥ه ںéê§ïë، ںéë يï،
2008-07-18 10:58 . 2008-07-18 10:58 56 --a------ C:\WINDOWS\Mushaf.ini
2008-07-18 03:04 . 2008-07-18 03:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Uniblue
2008-07-16 13:28 . 2008-07-16 13:28 <DIR> d-------- C:\Documents and Settings\Administrator\dwhelper
2008-07-16 13:02 . 2008-07-16 13:02 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Hide IP NG
2008-07-16 03:43 . 2008-07-16 03:43 <DIR> d-------- C:\Program Files\InstallPlay89
2008-07-14 14:26 . 2008-07-14 14:26 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-07-14 14:20 . 2008-07-14 14:20 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-07-14 14:03 . 2008-07-14 14:03 <DIR> d-------- C:\Program Files\NOS
2008-07-14 14:03 . 2008-07-14 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-07-14 13:37 . 2008-07-09 17:34 206,256 --a------ C:\WINDOWS\system32\idmmbc.dll
2008-07-12 17:24 . 2008-07-12 17:24 <DIR> d-------- C:\Program Files\netcut
2008-07-12 17:17 . 2008-07-12 17:17 <DIR> d-------- C:\Program Files\WinPcap
2008-07-12 15:02 . 2008-07-12 15:02 <DIR> d-------- C:\Program Files\OpenOfficePortable
2008-07-11 01:10 . 2008-07-11 01:10 <DIR> d-------- C:\Documents and Settings\Administrator\temp
2008-07-10 18:17 . 2008-07-10 18:17 <DIR> d-------- C:\Program Files\GISolution
2008-07-10 15:36 . 2008-07-10 22:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-10 15:36 . 2008-07-10 15:36 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-09 19:28 . 2008-07-09 19:28 <DIR> d-------- C:\Program Files\Apple Software Update
2008-07-09 19:28 . 2008-07-09 19:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-07-09 18:01 . 2008-06-20 20:36 245,248 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-07-09 18:01 . 2008-06-20 13:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-07-08 07:44 . 2008-07-08 07:44 <DIR> d-------- C:\Program Files\uTorrent
2008-07-08 07:44 . 2008-07-08 07:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-07-08 07:39 . 2008-07-08 07:39 <DIR> d-------- C:\Program Files\Gabest
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-08 10:15 3,540 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-08 10:15 21,360 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-08 10:15 2,193,440 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-08 10:15 106,528 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-07 17:18 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-07 17:18 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-18 07:58 --------- d-----w C:\Program Files\مصحف المدينة النبوية
2008-07-08 03:48 6,572 ----a-w C:\WINDOWS\system32\drivers\CDSpace.cfg
2008-07-07 01:52 --------- d-----w C:\Documents and Settings\Administrator\Application Data\4shared Uploader
2008-07-07 01:23 --------- d-----w C:\Program Files\SWiSH Max2
2008-07-02 11:52 --------- d-----w C:\Program Files\Winamp
2008-06-30 20:22 --------- d-----w C:\Program Files\Symantec
2008-06-30 19:06 --------- d-----w C:\Program Files\Common Files\TechSmith Shared
2008-06-29 15:20 --------- d-----w C:\Program Files\BuddyCheck
2008-06-29 15:20 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nuotex
2008-06-28 11:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith
2008-06-28 10:19 --------- d-----w C:\Program Files\TechSmith
2008-06-28 10:15 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-26 07:29 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-26 07:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-26 00:11 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IDM
2008-06-26 00:10 --------- d-----w C:\Program Files\Internet Download Manager
2008-06-25 21:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-25 21:20 --------- d-----w C:\Program Files\Yahoo!
2008-06-20 17:36 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:36 147,968 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-01-30 14:45 88 --sh--r C:\Documents and Settings\All Users\Application Data\BEE09C576C.sys
2008-01-29 16:47 88 --sh--r C:\Documents and Settings\All Users\Application Data\876FABD3F4.sys
2006-09-16 13:20 3,808 ----a-w C:\Program Files\SETUP.LST
2006-09-16 13:20 1,880,140 ----a-w C:\Program Files\Anti NetCut.CAB
1998-06-17 21:00 140,800 ----a-w C:\Program Files\setup.exe
.
((((((((((((((((((((((((((((( snapshot@2008-08-08_ 2.08.42.69 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-12 22:12:26 14,048 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\spmsg.dll
+ 2005-10-12 23:12:26 14,048 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\spmsg.dll
- 2005-10-12 22:12:26 213,216 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\spuninst.exe
+ 2005-10-12 23:12:26 213,216 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\spuninst.exe
- 2005-10-12 22:12:26 22,752 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\spcustom.dll
+ 2005-10-12 23:12:26 22,752 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\spcustom.dll
- 2005-10-12 22:12:28 716,000 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe
+ 2005-10-12 23:12:28 716,000 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe
- 2005-10-12 22:12:34 371,424 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\updspapi.dll
+ 2005-10-12 23:12:34 371,424 ------w C:\WINDOWS\$hf_mig$\KB938127-IE7\update\updspapi.dll
+ 2005-10-12 22:12:26 22,752 ------w C:\WINDOWS\ie7updates\KB938127-IE7\spcustom.dll
+ 2005-10-12 22:12:26 14,048 ------w C:\WINDOWS\ie7updates\KB938127-IE7\spmsg.dll
+ 2005-10-12 22:12:26 213,216 ------w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst.exe
+ 2005-10-12 23:12:26 213,216 ------w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
+ 2005-10-12 23:12:34 371,424 ------w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
+ 2005-10-12 22:12:28 716,000 ------w C:\WINDOWS\ie7updates\KB938127-IE7\update.exe
+ 2005-10-12 22:12:34 371,424 ------w C:\WINDOWS\ie7updates\KB938127-IE7\updspapi.dll
+ 2007-08-13 15:54:10 765,952 ------w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
- 2007-08-13 15:54:10 765,952 ----a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2007-07-12 23:31:54 765,952 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B0DEDE96-B31B-4814-A31E-4006FC9FB4F0}"= "C:\WINDOWS\system32\PointsBar.dll" [2002-01-04 01:03 94208]
[HKEY_CLASSES_ROOT\clsid\{b0dede96-b31b-4814-a31e-4006fc9fb4f0}]
[HKEY_CLASSES_ROOT\PointsBar.Bar.1]
[HKEY_CLASSES_ROOT\TypeLib\{9935D505-1886-49FC-A92C-CD3C87000FEC}]
[HKEY_CLASSES_ROOT\PointsBar.Bar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B0DEDE96-B31B-4814-A31E-4006FC9FB4F0}"= "C:\WINDOWS\system32\PointsBar.dll" [2002-01-04 01:03 94208]
[HKEY_CLASSES_ROOT\clsid\{b0dede96-b31b-4814-a31e-4006fc9fb4f0}]
[HKEY_CLASSES_ROOT\PointsBar.Bar.1]
[HKEY_CLASSES_ROOT\TypeLib\{9935D505-1886-49FC-A92C-CD3C87000FEC}]
[HKEY_CLASSES_ROOT\PointsBar.Bar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run_CF]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-10-27 07:51 3810544]
"Sweeper.exe"="C:\Program Files\History Sweeper\sweeper.exe" [2008-04-20 17:16 176128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-09 12:02 4136960]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 01:15 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 01:15 81920]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2006-09-09 08:37 184320]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21 201992]
"nwiz"="nwiz.exe" [2004-07-09 12:02 880640 C:\WINDOWS\system32\nwiz.exe]
"anvshell"="anvshell.exe" [2004-06-24 15:28 393216 C:\WINDOWS\anvshell.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run_CF]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-09 12:02 4136960]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21 201992]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 01:15 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 01:15 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-13 11:57 185896]
"nwiz"="nwiz.exe" [2004-07-09 12:02 880640 C:\WINDOWS\system32\nwiz.exe]
"anvshell"="anvshell.exe" [2004-06-24 15:28 393216 C:\WINDOWS\anvshell.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"= 0 (0x0)
"NoBandCustomize"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"Btn_Back"= 0 (0x0)
"Btn_Forward"= 0 (0x0)
"Btn_Stop"= 0 (0x0)
"Btn_"= 0 (0x0)
"Btn_Home"= 0 (0x0)
"Btn_Search"= 0 (0x0)
"Btn_History"= 0 (0x0)
"Btn_Favorites"= 0 (0x0)
"Btn_Media"= 0 (0x0)
"Btn_Folders"= 0 (0x0)
"Btn_Fullscreen"= 0 (0x0)
"Btn_Tools"= 0 (0x0)
"Btn_MailNews"= 0 (0x0)
"Btn_Size"= 0 (0x0)
"Btn_Print"= 0 (0x0)
"Btn_Edit"= 0 (0x0)
"Btn_Discussions"= 0 (0x0)
"Btn_Cut"= 0 (0x0)
"Btn_Copy"= 0 (0x0)
"Btn_Paste"= 0 (0x0)
"Btn_Encoding"= 0 (0x0)
"Btn_PrintPreview"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoLogoff"= 0 (0x0)
"EnforceShellExtensionSecurity"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
2006-07-22 23:49 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"MSVideo"= CSvidcap.dll
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
backup=C:\WINDOWS\pss\Microsoft Office Groove.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk
backup=C:\WINDOWS\pss\OpenOffice.org 2.4.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LCDPlayer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LCDPlayer.lnk
backup=C:\WINDOWS\pss\LCDPlayer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 02:38 34672 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor]
--a------ 2004-08-18 15:08 970752 C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 2007-06-28 12:51 218376 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-03 23:56 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 2008-07-16 12:42 2607616 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2001-12-10 15:07 1462544 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-12-14 03:42 144784 C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sweeper.exe]
--a------ 2008-04-20 17:16 176128 C:\Program Files\History Sweeper\sweeper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-01-13 11:57 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
--a------ 2008-07-08 07:44 219952 C:\Program Files\uTorrent\uTorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-10-27 07:51 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16426:TCP"= 16426:TCP:BitComet 16426 TCP
"16426:UDP"= 16426:UDP:BitComet 16426 UDP
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29]
R1 ANVIOCTL;ANVIOCTL;C:\WINDOWS\system32\DRIVERS\anvioctl.sys [2004-07-08 15:44]
R1 LIKECDN2;LIKECDN2;C:\WINDOWS\system32\DRIVERS\LIKECDN2.sys [2002-02-15 13:33]
R1 XSPACEWG;XSPACEWG;C:\WINDOWS\system32\drivers\XSpaceWg.sys [2001-12-11 10:46]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 22:31]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07]
R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D.sys [2004-04-19 19:25]
S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-06-26 10:25]
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-09 05:26]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 23:22]
S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\system32\DRIVERS\NtApm.sys [2001-08-17 13:47]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3b0bc840-f031-11dc-a310-000000000000}]
\Shell\Auto\command - J:\boot.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe
.
s of the 'Scheduled Tasks' folder
2008-08-05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\cvll0bhb.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-08 13:18:37
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\ASUSKBSERVICE.EXE
C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
C:\WINDOWS\SYSTEM32\CRYPSERV.EXE
C:\WINDOWS\SYSTEM32\NVSVC32.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
.
**************************************************************************
.
Completion time: 2008-08-08 13:26:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-08 10:26:10
ComboFix2.txt 2008-08-07 23:10:22
Pre-Run: 1,595,703,296 bytes free
Post-Run: 1,584,201,728 bytes free
316 --- E O F --- 2008-08-07 23:29:45
