السلام عليكم
ComboFix 09-03-31.01 - Administrator 2009-03-31 21:52:16.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1215.962 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\kakle.dll
c:\windows\system32\pthreadGC2.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))
.
2009-03-31 21:49 . 2009-03-31 21:49 <DIR> d-------- c:\documents and settings\Administrator\Application Data\URSoft
2009-03-31 19:50 . 2009-03-31 19:50 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Avant Profiles
2009-03-31 19:49 . 2009-03-31 19:49 <DIR> d-------- c:\documents and settings\Administrator
2009-03-31 18:10 . 2009-03-31 18:10 <DIR> d-------- c:\program files\SRS Labs
2009-03-30 01:01 . 2009-03-30 01:01 <DIR> d-------- c:\windows\Logs
2009-03-30 01:01 . 2009-03-31 18:10 <DIR> d-------- c:\windows\LastGood
2009-03-30 00:46 . 2009-03-30 00:46 <DIR> d-------- c:\program files\AxBx
2009-03-29 23:09 . 2009-03-30 00:22 <DIR> d-------- c:\program files\Karaoke5
2009-03-29 22:08 . 2009-03-29 22:11 737,280 --a------ c:\windows\iun6002.exe
2009-03-29 22:07 . 2009-03-29 22:11 <DIR> d-------- c:\program files\الموسوعة الطبية
2009-03-29 21:40 . 2009-03-29 21:42 <DIR> d-------- c:\program files\SpeedBit Video Accelerator
2009-03-29 21:40 . 2009-03-29 21:40 172,032 --a------ c:\windows\system32\AniGIF.ocx
2009-03-29 21:29 . 2009-03-29 21:29 <DIR> d-------- c:\program files\SeePassword
2009-03-29 21:27 . 2009-03-31 18:31 <DIR> d-------- c:\program files\PowerArchiver
2009-03-29 21:27 . 2009-03-29 21:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\ConeXware
2009-03-29 21:18 . 2009-03-29 21:18 <DIR> d-------- c:\program files\KP Software
2009-03-29 21:18 . 2002-04-29 23:45 323,584 --a------ c:\windows\system32\AudioControl.ocx
2009-03-29 21:18 . 2000-08-04 12:04 24,576 --a------ c:\windows\system32\JKTryIcn.ocx
2009-03-29 21:13 . 2009-03-29 21:13 <DIR> d-------- c:\program files\WinWatermark 2.2
2009-03-29 21:11 . 2009-03-29 21:11 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Thinstall
2009-03-29 21:06 . 2009-03-29 22:09 1,905 --a------ c:\windows\diagwrn.xml
2009-03-29 21:06 . 2009-03-29 22:09 1,905 --a------ c:\windows\diagerr.xml
2009-03-29 19:46 . 2009-03-29 19:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\FLEXnet
2009-03-29 18:33 . 2009-03-29 18:34 6,940,211 --a------ C:\صالح الحوالي.mp3
2009-03-29 18:05 . 2009-03-29 18:05 <DIR> d-------- c:\windows\system32\RMBin
2009-03-29 18:05 . 2009-03-29 18:05 <DIR> d-------- c:\program files\Ozone
2009-03-29 01:40 . 2009-03-29 01:40 252 --a------ C:\q91499w.exe
2009-03-28 22:26 . 2003-06-18 17:31 17,920 --a------ c:\windows\system32\mdimon.dll
2009-03-28 22:26 . 2009-03-28 22:26 373 --a------ c:\windows\ODBC.INI
2009-03-28 22:24 . 2009-03-28 22:25 <DIR> d-------- c:\windows\SHELLNEW
2009-03-28 22:21 . 2009-03-28 22:21 <DIR> d-------- c:\program files\Microsoft.NET
2009-03-28 02:01 . 2009-03-28 02:01 <DIR> d--h----- c:\windows\$hf_mig$
2009-03-28 01:12 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-03-28 01:12 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-03-27 17:05 . 2009-03-27 17:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-03-27 16:55 . 2009-03-27 16:55 <DIR> d--h----- c:\windows\PIF
2009-03-27 14:44 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2009-03-27 14:43 . 2009-03-27 14:43 <DIR> d-------- c:\windows\system32\ar-SA
2009-03-27 14:42 . 2009-03-27 14:42 <DIR> d-------- c:\windows\system32\XPSViewer
2009-03-27 14:42 . 2009-03-27 14:42 <DIR> d-------- c:\program files\Reference Assemblies
2009-03-27 14:42 . 2009-03-27 14:42 <DIR> d-------- c:\program files\MSBuild
2009-03-27 14:42 . 2009-03-27 14:42 222 --a------ c:\windows\system32\spupdsvc.inf
2009-03-27 14:41 . 2008-07-06 15:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-03-27 14:41 . 2008-07-06 15:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-03-27 14:41 . 2008-07-06 13:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-03-27 14:41 . 2008-07-06 15:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-03-27 14:41 . 2008-07-06 15:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-03-27 14:41 . 2008-07-06 15:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-03-27 14:41 . 2008-07-06 15:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-03-27 14:39 . 2007-11-30 14:18 26,488 --a------ c:\windows\system32\spupdsvc.exe
2009-03-27 14:20 . 2009-03-27 14:20 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-03-25 03:15 . 2006-03-03 21:03 282,680 --a------ c:\windows\system32\HPZidr12.dll
2009-03-25 03:15 . 2006-03-03 21:02 204,800 --a------ c:\windows\system32\HPZipr12.dll
2009-03-25 03:15 . 2006-03-03 21:02 94,208 --a------ c:\windows\system32\HPZipt12.dll
2009-03-25 03:15 . 2006-03-03 21:03 69,632 --a------ c:\windows\system32\HPZipm12.exe
2009-03-25 03:15 . 2006-03-03 21:03 65,536 --a------ c:\windows\system32\HPZinw12.exe
2009-03-25 03:15 . 2006-03-03 21:02 57,344 --a------ c:\windows\system32\HPZisn12.dll
2009-03-25 03:14 . 2009-03-25 03:14 <DIR> d---s---- c:\documents and settings\agmdi\UserData
2009-03-25 02:54 . 2009-03-25 02:54 <DIR> d-------- c:\program files\CONEXANT
2009-03-25 02:54 . 2001-08-17 13:57 16,128 --a------ c:\windows\system32\drivers\MODEMCSA.sys
2009-03-25 02:54 . 2001-08-17 13:57 16,128 --a--c--- c:\windows\system32\dllcache\modemcsa.sys
2009-03-25 02:52 . 2006-06-03 21:29 48,640 --a------ c:\windows\system32\hpzll4pi.dll
2009-03-25 02:49 . 2009-03-25 00:49 123,101 --------- c:\windows\HPHins12.dat.temp
2009-03-25 02:49 . 2006-07-17 22:39 14,916 --------- c:\windows\hphmdl12.dat.temp
2009-03-25 02:43 . 2009-03-25 02:57 <DIR> d-------- c:\program files\Your Uninstaller 2008
2009-03-25 02:43 . 2009-03-31 21:49 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-03-25 02:43 . 2009-03-25 02:43 <DIR> d-------- c:\documents and settings\agmdi\Application Data\URSoft
2009-03-25 00:49 . 2009-03-25 00:49 <DIR> d-------- c:\program files\HP
2009-03-25 00:49 . 2009-03-25 02:51 123,135 --a------ c:\windows\HPHins12.dat
2009-03-25 00:49 . 2006-07-17 22:39 14,916 --------- c:\windows\hphmdl12.dat
2009-03-25 00:48 . 2006-05-16 23:25 77,824 --a------ c:\windows\system32\hpzids01.dll
2009-03-25 00:44 . 2006-06-22 06:03 56 --a------ C:\ut9x.bat
2009-03-25 00:44 . 2006-06-20 00:08 54 --a------ C:\ut.bat
2009-03-25 00:23 . 2009-03-25 00:23 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Media Player Classic
2009-03-25 00:23 . 2008-10-16 14:12 561,688 --a------ c:\windows\system32\wuapi.dll
2009-03-25 00:23 . 2008-10-16 14:12 323,608 --a------ c:\windows\system32\wucltui.dll
2009-03-25 00:23 . 2008-10-16 14:12 213,528 --a------ c:\windows\system32\wuaucpl.cpl
2009-03-25 00:23 . 2008-10-16 14:13 202,776 --a------ c:\windows\system32\wuweb.dll
2009-03-25 00:23 . 2004-08-03 14:03 186,136 --a------ c:\windows\system32\wuaueng1.dll
2009-03-25 00:23 . 2004-08-03 14:01 167,704 --a------ c:\windows\system32\wuauclt1.exe
2009-03-25 00:23 . 2008-10-16 14:08 34,328 --a------ c:\windows\system32\wups.dll
2009-03-21 03:13 . 2009-03-21 03:13 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Apple Computer
2009-03-21 03:09 . 2009-03-21 03:09 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Teleca
2009-03-21 02:58 . 2009-03-21 02:58 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Sony Ericsson
2009-03-21 02:45 . 2009-03-31 18:39 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Software Informer
2009-03-21 02:45 . 2009-03-21 02:45 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Avant Profiles
2009-03-21 02:44 . 2009-03-31 19:47 <DIR> d-------- c:\documents and settings\agmdi\Application Data\Free Download Manager
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-31 16:04 75,264 ----a-w c:\windows\system32\ws2_32.dll
2009-03-29 17:06 --------- d-----w c:\program files\Common Files\Adobe
2009-03-29 15:06 98,304 ----a-w c:\windows\system32\viscomtran.dll
2009-03-29 15:05 344,064 ----a-w c:\windows\system32\dkll.dll
2009-03-29 15:05 196,608 ----a-w c:\windows\system32\maag.dll
2009-03-29 15:05 1,986,560 ----a-w c:\windows\system32\akll.dll
2009-03-29 15:05 1,212,416 ----a-w c:\windows\system32\ckll.dll
2009-03-27 20:49 --------- d-----w c:\program files\Avant Browser
2009-03-21 01:03 --------- d-----w c:\program files\Standalone Flash Player
2009-03-21 00:59 --------- d-----w c:\program files\Extension Changer
2009-03-21 00:25 --------- d-----w c:\program files\Sony Ericsson
2009-03-21 00:25 --------- d-----w c:\program files\Sony
2009-03-21 00:12 --------- d-----w c:\program files\QuickTime
2009-03-21 00:11 --------- d-----w c:\program files\Apple Software Update
2009-03-21 00:11 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-21 00:11 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-03-20 23:58 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-20 23:58 --------- d-----w c:\program files\Intuwave
2009-03-20 23:57 --------- d-----w c:\program files\Symbian
2009-03-20 23:57 --------- d-----w c:\program files\MSXML 6.0
2009-03-20 23:57 --------- d-----w c:\program files\Common Files\Teleca Shared
2009-03-20 23:57 --------- d-----w c:\program files\Common Files\Sony Ericsson Shared
2009-03-20 23:57 --------- d-----w c:\documents and settings\All Users\Application Data\Teleca
2009-03-20 23:57 --------- d-----w c:\documents and settings\All Users\Application Data\Sony Ericsson
2009-03-20 23:45 --------- d-----w c:\program files\Free Download Manager
2009-03-20 23:44 --------- d-----w c:\program files\Software Informer
2009-03-20 23:44 --------- d-----w c:\documents and settings\All Users\Application Data\FreeDownloadManager.ORG
2009-03-20 23:43 --------- d-----w c:\program files\K-Lite Codec Pack
2009-03-20 23:28 --------- d-----w c:\program files\Avira
2009-03-20 23:28 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-03-20 23:22 --------- d-----w c:\program files\Realtek Sound Manager
2009-03-20 23:22 --------- d-----w c:\program files\AvRack
2009-03-20 23:21 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-20 23:18 --------- d-----w c:\program files\VIA
2009-03-20 22:57 --------- d-----w c:\program files\microsoft frontpage
2009-02-24 23:26 2,255,360 ----a-w c:\windows\system32\x264vfw.dll
2009-02-19 11:41 --------- d-----w c:\program files\Text to PDF Converter
2009-02-18 15:59 --------- d-----w c:\program files\Flash Memory Toolkit
2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-07 18:08 795,648 ----a-w c:\windows\system32\xvidcore.dll
2008-12-07 18:08 130,048 ----a-w c:\windows\system32\xvidvfw.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-08-28 13312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2005-04-26 589824]
"PC Suite for Smartphones"="c:\program files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-12-25 548864]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SeePassword"="c:\program files\SeePassword\SeePassword.exe" [2005-06-25 1347584]
"SpeedBitVideoAccelerator"="c:\program files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2009-03-29 2729584]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-05-17 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-08-28 13312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [2009-03-21 22336]
R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [2009-03-21 45376]
S2 sbbotdi;sbbotdi;c:\progra~1\SPEEDB~1\sbbotdi.sys [2009-03-29 35584]
S2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - MDMXSDK
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-31 21:53:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(528)
c:\windows\System32\ODBC32.dll
c:\windows\System32\ac3acm.acm
c:\windows\System32\lameACM.acm
- - - - - - - > 'lsass.exe'(584)
c:\windows\System32\dssenh.dll
.
Completion time: 2009-03-31 21:54:52
ComboFix-quarantined-files.txt 2009-03-31 18:54:51
Pre-Run: 30,109,470,720 bytes free
Post-Run: 31,295,201,280 bytes free
221
...