ComboFix 08-08-09.03 - user 08/10/2008 8:43:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.563 [GMT 3:00]
Running from: C:\Documents and Settings\user\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2008-07-10 to 2008-08-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 05:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-10 05:47 --------- d-----w C:\Documents and Settings\user\Application Data\DMCache
2008-08-10 05:45 376,864 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-10 05:45 3,416 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-10 05:45 14,028 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-10 05:45 1,523,232 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-10 05:32 --------- d-----w C:\Documents and Settings\user\Application Data\CyberScrub
2008-08-10 05:32 --------- d-----w C:\Documents and Settings\user\Application Data\cleaner
2008-08-10 03:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-10 02:15 --------- d-----w C:\Documents and Settings\user\Application Data\ACD Systems
2008-08-09 21:24 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-09 20:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-08-09 16:40 --------- d-----w C:\Program Files\Opera
2008-08-09 00:54 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-08 18:39 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-08 18:39 --------- d-----w C:\Program Files\UltraISO
2008-08-08 18:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-08 18:10 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-08 17:43 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-08-07 17:55 --------- d-----w C:\Documents and Settings\user\Application Data\IDM
2008-08-07 17:54 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-07 17:53 --------- d-----w C:\Program Files\Internet Download Manager
2008-08-07 17:29 --------- d-----w C:\Program Files\LtUcx
2008-08-07 12:01 --------- d-----w C:\Program Files\Common Files\EZB Systems
2008-08-06 23:31 --------- d-----w C:\Program Files\Hotspot Shield
2008-08-06 23:27 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-08-06 23:27 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-08-06 23:27 --------- d-----w C:\Program Files\Common Files\xing shared
2008-08-06 23:27 --------- d-----w C:\Program Files\Common Files\Real
2008-08-06 22:54 --------- d-----w C:\Documents and Settings\user\Application Data\Media Player Classic
2008-08-06 21:00 --------- d-----w C:\Documents and Settings\user\Application Data\Skype
2008-08-06 19:01 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-06 00:10 --------- d-----w C:\Program Files\CyberLink
2008-08-05 23:30 --------- d-----w C:\Program Files\TechSmith
2008-08-05 23:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith
2008-08-05 22:08 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-08-05 22:07 --------- d-----w C:\Documents and Settings\user\Application Data\URSoft
2008-08-05 18:38 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-05 18:32 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-05 18:32 --------- d-----w C:\Program Files\Circle Developement
2008-08-05 18:29 --------- d-----w C:\Program Files\Windows Live
2008-08-05 18:27 --------- d-----w C:\Program Files\Paltalk Messenger
2008-08-05 17:12 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-08-05 17:11 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-05 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-05 15:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-08-05 15:30 --------- d-----w C:\Program Files\Webteh
2008-08-05 15:30 --------- d-----w C:\Documents and Settings\user\Application Data\BSplayer Pro
2008-08-05 15:29 --------- d-----w C:\Program Files\Ringz Studio
2008-08-05 15:28 --------- d-----w C:\Program Files\Skype
2008-08-05 15:28 --------- d-----w C:\Program Files\Common Files\Skype
2008-08-05 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-08-05 15:26 --------- d-----w C:\Program Files\Real
2008-08-05 15:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-05 15:07 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-08-05 15:07 172,032 ------w C:\WINDOWS\Setup1.exe
2008-08-05 15:05 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-08-05 15:05 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-08-05 15:05 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-08-05 15:05 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-08-05 15:05 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-08-05 15:05 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-08-05 15:05 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-08-05 15:05 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-08-05 15:03 10,368 ----a-w C:\WINDOWS\system32\drivers\pfc.sys
2008-08-05 15:03 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-08-05 15:03 --------- d-----w C:\Program Files\ACD Systems
2008-08-05 15:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-08-05 15:00 155,995 ----a-w C:\WINDOWS\java\Packages\K7RXV7PZ.ZIP
2008-08-05 14:56 --------- d-----w C:\Program Files\TOSHIBA
2008-08-05 14:46 --------- d-----w C:\Program Files\Synaptics
2008-08-05 14:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-05 13:46 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-05 13:46 --------- d-----w C:\Program Files\Microsoft Works
2008-08-05 08:56 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-29 17:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-29 17:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-07-21 15:34 121,872 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 271,616 ------w C:\WINDOWS\system32\drivers\bthport.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [11/07/2007 03:34 PM 3739672]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/30/2008 02:16 PM 2610608]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 07:24 PM 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [02/26/2007 10:34 AM 131072]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [02/26/2007 10:34 AM 155648]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [02/26/2007 10:33 AM 131072]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [07/25/2007 06:19 PM 888832]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [03/24/2005 03:52 PM 94770]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [08/07/2008 02:26 AM 185896]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [07/29/2008 08:20 PM 206088]
"RTHDCPL"="RTHDCPL.EXE" [08/10/2007 03:21 PM 16384000 C:\WINDOWS\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.vp31"= vp31vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{464b0ff3-62f8-11dd-a410-ca984a259f87}]
\Shell\AutoRun\command - H:\pa39xth.cmd
\Shell\explore\Command - H:\pa39xth.cmd
\Shell\open\Command - H:\pa39xth.cmd
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R0 -: HKLM-Main,Start Page = about:blank
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 -: {DE60714F-AC17-427e-861A-FD60CBDF119A} -
O16 -: Microsoft XML Parser for Java -
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413} - hxxp://209.11.244.13/talk.cab
C:\WINDOWS\Downloaded Program Files\talk.inf
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\mfc42.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\Downloaded Program Files\imcv1.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-10 08:48:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 9\TscHelp.exe
C:\Program Files\TechSmith\SnagIt 9\SnagPriv.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
C:\Program Files\TechSmith\SnagIt 9\SnagItEditor.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe
.
**************************************************************************
.
Completion time: 08/10/2008 8:51:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-10 05:51:19
Pre-Run: 53,160,009,728 bytes free
Post-Run: 53,085,294,592 bytes free
206 --- E O F --- 2008-08-08 19:25:01
