ComboFix 09-04-04.01 - Free User 04/09/2009 22:18:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.895.535 [GMT 3:00]
Running from: c:\documents and settings\Free User\Desktop\المكتبه\برامج\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-03-09 to 2009-04-09 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-09 19:24 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-09 19:21 622,624 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-09 19:21 4,256 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-09 19:21 25,088 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-09 19:21 2,938,912 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-09 19:20 --------- d-----w c:\documents and settings\Free User\Application Data\Free Download Manager
2009-04-08 20:29 --------- d-----w c:\documents and settings\Free User\Application Data\Hold Hope Bore
2009-04-08 16:21 --------- d-----w c:\program files\SUPERAntiSpyware
2009-04-08 08:17 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-04-08 07:30 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-08 07:30 --------- d-----w c:\documents and settings\Free User\Application Data\SUPERAntiSpyware.com
2009-04-07 07:31 --------- d-----w c:\program files\MessengerDiscovery
2009-04-05 14:51 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-30 01:01 --------- d-----w c:\program files\Messenger Plus! Live
2009-03-30 01:01 --------- d-----w c:\program files\Hold Hope Bore
2009-03-30 01:01 --------- d-----w c:\program files\Circle Developement
2009-03-17 00:00 --------- d-----w c:\program files\MSXML 4.0
2009-03-16 00:39 --------- d-----w c:\program files\Common Files\Adobe
2009-03-16 00:38 --------- d-----w c:\documents and settings\Free User\Application Data\Leadertech
2009-03-16 00:12 --------- d-----w c:\documents and settings\Free User\Application Data\AdobeAUM
2009-03-16 00:10 --------- d-----w c:\documents and settings\Free User\Application Data\Nokia Multimedia Player
2009-03-15 23:47 --------- d-----w c:\documents and settings\Free User\Application Data\Datalayer
2009-03-15 23:46 --------- d-----w c:\documents and settings\Free User\Application Data\Nokia
2009-03-15 23:33 --------- d-----w c:\program files\Nokia
2009-03-15 23:30 --------- d-----w c:\documents and settings\Free User\Application Data\PC Suite
2009-03-15 23:30 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-03-15 23:29 --------- d-----w c:\program files\Common Files\PCSuite
2009-03-15 23:29 --------- d-----w c:\program files\Common Files\Nokia
2009-03-15 10:49 --------- d-----w c:\documents and settings\All Users\Application Data\Okay meta anti lite
2009-03-14 12:31 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-03-14 12:31 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-14 12:31 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-03-13 20:57 --------- d-----w c:\program files\Microsoft
2009-03-13 20:56 --------- d-----w c:\program files\Windows Live
2009-03-06 15:15 --------- d-----w c:\documents and settings\Free User\Application Data\HiYo
2009-02-14 06:24 --------- d-----w c:\program files\YourSoft
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [04/14/2008 03:12 AM 15360]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [05/20/2008 06:27 PM 2474031]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [02/06/2009 06:53 PM 3885408]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [06/27/2006 04:21 PM 1449984]
"Managerstore"="c:\docume~1\FREEUS~1\APPLIC~1\HOLDHO~1\Multi Mpeg.exe" [03/30/2009 04:01 AM 638976]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [04/08/2009 07:21 PM 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [03/14/2009 03:31 PM 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [10/03/2008 06:06 PM 185896]
"PCSuiteTrayApplication"="c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [06/15/2006 12:36 PM 229376]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [02/16/2007 11:54 AM 282624]
"AGRSMMSG"="AGRSMMSG.exe" [06/29/2006 08:32 AM 89541 c:\windows\AGRSMMSG.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [04/14/2008 03:12 AM 110592 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 03:12 AM 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [05/13/2008 09:13 AM 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
12/22/2008 11:05 AM 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 03/14/2007 08:05 PM 257088 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\MessengerDiscovery\\MessengerDiscovery.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-22 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2002-12-31 14336]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2008-10-03 57024]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2008-10-13 194304]
.
Contents of the 'Scheduled Tasks' folder
2009-04-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [01/10/2007 04:42 PM]
2009-04-09 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [03/10/2009 10:18 PM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free Download Manager تحميل الفيديو بواسطة -
files\Free Download Manager\dlfvideo.htm
IE: تحميل المحددة بفري داونلود مانيجر -
files\Free Download Manager\dlselected.htm
IE: تنزيل الكل بفري داونلود مانيجر -
files\Free Download Manager\dlall.htm
IE: تنزيل بفري داونلود مانيجر -
files\Free Download Manager\dllink.htm
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\Free User\Application Data\Mozilla\Firefox\Profiles\ds6xlb3y.default\
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-09 22:24:33
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(896)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\documents and settings\Free User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\PCSuite\Services\ServiceLayer.exe
c:\program files\Internet Explorer\iexplore.exe
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\MessengerDiscovery\MessengerDiscovery.exe
.
**************************************************************************
.
Completion time: 04/09/2009 22:27:44 - machine was rebooted [Free User]
ComboFix-quarantined-files.txt 2009-04-09 19:27:41
Pre-Run: 32,062,521,344 bytes free
Post-Run: 31,909,298,176 bytes free
159 --- E O F --- 2009-04-01 00:00:36
