ابو ريما هاك تقرير الكومبوفيكس
ComboFix 09-04-12.03 - user 04/13/2009 0:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.967.1033.18.502.163 [GMT 3:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090412-0] *On-access scanning disabled* (Updated)
FW: Outpost Firewall Pro *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows.0\system\oeminfo.ini
c:\windows.0\system32\spdwnwxp.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ISODRIVE
-------\Service_ISODrive
((((((((((((((((((((((((( Files Created from 2009-03-12 to 2009-04-12 )))))))))))))))))))))))))))))))
.
2009-04-12 21:48 . 2006-03-02 20:42 73728 ----a-w C:\pv.exe
2009-04-12 21:23 . 2009-04-12 21:30 -------- d-----w c:\program files\Driver Wizard
2009-04-12 21:23 . 2003-09-08 11:08 53760 ----a-w c:\windows.0\uninst62.exe
2009-04-12 20:12 . 2009-04-12 20:12 211 ----a-w C:\boot.ini.backup
2009-04-11 23:00 . 2009-04-11 20:45 -------- d-----w c:\windows.0\repair
2009-04-11 21:33 . 2008-10-24 11:21 455296 -c----w c:\windows.0\system32\dllcache\mrxsmb.sys
2009-04-11 21:32 . 2008-09-04 17:15 1106944 -c----w c:\windows.0\system32\dllcache\msxml3.dll
2009-04-11 21:31 . 2008-08-14 10:09 2145280 -c----w c:\windows.0\system32\dllcache\ntkrnlmp.exe
2009-04-11 21:31 . 2008-08-14 10:11 2189184 -c----w c:\windows.0\system32\dllcache\ntoskrnl.exe
2009-04-11 21:31 . 2008-08-14 09:33 2023936 -c----w c:\windows.0\system32\dllcache\ntkrpamp.exe
2009-04-11 21:31 . 2008-08-14 09:33 2066048 -c----w c:\windows.0\system32\dllcache\ntkrnlpa.exe
2009-04-11 21:25 . 2008-06-13 11:05 272128 -c----w c:\windows.0\system32\dllcache\bthport.sys
2009-04-11 21:17 . 2008-10-16 11:09 43544 ----a-w c:\windows.0\system32\wups2.dll
2009-04-11 20:53 . 2008-02-15 09:49 159744 ----a-w c:\windows.0\system32\igfxres.dll
2009-04-11 20:44 . 2008-04-14 19:00 28288 -c--a-w c:\windows.0\system32\dllcache\xjis.nls
2009-04-11 20:42 . 2008-04-14 19:00 14848 -c--a-w c:\windows.0\system32\dllcache\register.exe
2009-04-11 20:41 . 2008-04-14 05:42 7680 -c--a-w c:\windows.0\system32\dllcache\migregdb.exe
2009-04-11 20:40 . 2003-03-24 13:52 94208 -c--a-w c:\windows.0\system32\dllcache\fpencode.dll
2009-04-11 20:39 . 2008-04-14 05:41 108544 -c--a-w c:\windows.0\system32\dllcache\appconf.dll
2009-04-11 20:38 . 2009-04-11 20:38 -------- d-----w c:\program files\Alky for Applications
2009-04-11 20:35 . 2009-04-11 20:35 488 ---ha-r c:\windows.0\system32\logonui.exe.manifest
2009-04-11 20:35 . 2009-04-11 20:35 749 ---ha-r c:\windows.0\WindowsShell.Manifest
2009-04-11 20:35 . 2009-04-11 20:35 749 ---ha-r c:\windows.0\system32\wuaucpl.cpl.manifest
2009-04-11 20:35 . 2009-04-11 20:35 749 ---ha-r c:\windows.0\system32\sapi.cpl.manifest
2009-04-11 20:35 . 2009-04-11 20:35 749 ---ha-r c:\windows.0\system32\nwc.cpl.manifest
2009-04-11 20:35 . 2009-04-11 20:35 749 ---ha-r c:\windows.0\system32\ncpa.cpl.manifest
2009-04-11 20:32 . 2009-04-11 20:32 -------- d-----w c:\program files\Microsoft PowerToys
2009-04-11 20:32 . 2009-04-11 20:32 -------- d-----w c:\program files\HashTab Shell Extension
2009-04-11 20:30 . 2007-09-15 07:51 356864 ----a-w c:\windows.0\system32\MruGadget.msi
2009-04-11 20:29 . 2009-04-11 20:29 -------- d-----w c:\program files\VistaExperience.org
2009-04-11 20:27 . 2009-04-11 20:32 -------- d-----w c:\program files\Windows Sidebar
2009-04-11 20:27 . 2008-10-13 15:43 3932214 ----a-w c:\windows.0\system32\Startup.bmp
2009-04-11 20:27 . 2008-03-04 19:59 1634304 ----a-w c:\windows.0\system32\Windows XP.scr
2009-04-11 20:27 . 2007-09-30 19:05 849413 ----a-w c:\windows.0\system32\Windows Vista.scr
2009-04-11 20:14 . 2009-04-11 20:14 4452 ----a-w c:\windows.0\system32\pid.PNF
2009-04-11 20:14 . 2009-04-11 21:59 1374 ----a-w c:\windows.0\imsins.BAK
2009-04-11 20:12 . 2008-06-03 14:35 34816 ----a-w c:\windows.0\system32\irclass.dll
2009-04-11 20:12 . 2008-04-14 19:00 24661 -c--a-w c:\windows.0\system32\dllcache\spxcoins.dll
2009-04-11 20:12 . 2008-04-14 19:00 24661 ----a-w c:\windows.0\system32\spxcoins.dll
2009-04-11 20:10 . 2009-04-11 20:37 2682939 ----a-w c:\windows.0\setupapi.log.0.old
2009-04-11 19:54 . 2008-06-18 02:03 938496 -c--a-w c:\windows.0\system32\dllcache\WMNetmgr.dll
2009-04-11 19:53 . 2008-04-14 00:08 724480 -c--a-w c:\windows.0\system32\dllcache\sprb041f.dll
2009-04-11 19:52 . 2008-04-14 19:00 15360 -c--a-w c:\windows.0\system32\dllcache\pentnt.exe
2009-04-11 19:50 . 2008-10-20 13:59 6167040 ----a-w c:\windows.0\system32\logonui.exe
2009-04-11 19:49 . 2008-06-03 14:35 81408 ----a-w c:\windows.0\system32\fsusd.dll
2009-04-11 19:48 . 2008-04-14 05:41 57344 -c--a-w c:\windows.0\system32\dllcache\dpwsockx.dll
2009-04-11 19:47 . 2008-04-14 19:00 66082 -c--a-w c:\windows.0\system32\dllcache\c_28593.nls
2009-04-11 14:42 . 2009-04-11 14:47 70055 ----a-w c:\windows.0\setupapi.old
2009-04-10 19:41 . 2009-04-10 19:46 -------- d-----w c:\documents and settings\user\Application Data\WeatherWatcher
2009-04-10 19:40 . 2004-05-26 22:32 102400 ----a-w c:\windows.0\system32\unzip32.dll
2009-04-10 19:40 . 2009-04-10 19:41 -------- d-----w c:\program files\Weather Watcher
2009-04-10 03:32 . 2009-04-10 03:32 -------- d-----w c:\program files\PicPick
2009-04-10 03:16 . 2009-04-10 03:16 -------- d-----w c:\program files\Update Notifier
2009-04-10 03:16 . 2009-04-10 03:28 -------- d-----w c:\documents and settings\user\Application Data\cspa
2009-04-09 21:34 . 2009-04-11 11:07 -------- d-----w c:\program files\Traduce Gratis
2009-04-09 21:34 . 2009-04-09 21:34 -------- d-----w c:\program files\Conduit
2009-04-09 21:33 . 2009-04-12 21:47 -------- d-----w c:\program files\TraductorGlobal
2009-04-07 20:28 . 2007-06-12 01:04 2267368 ----a-w c:\windows.0\system32\Flash9d.ocx
2009-04-07 20:28 . 2003-09-23 05:00 608448 -c--a-w c:\windows.0\system32\COMCTL32.OCX
2009-04-07 20:28 . 2009-04-07 22:39 -------- d-----w c:\program files\GVR
2009-04-05 22:09 . 2009-04-05 22:09 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-04 18:49 . 2009-04-04 18:49 -------- d-----w c:\program files\Microsoft Virtual PC
2009-04-03 22:59 . 2009-03-26 15:35 210352 ----a-w c:\windows.0\system32\idmmbc.dll
2009-04-03 22:56 . 2009-04-04 16:20 -------- d-----w c:\documents and settings\user\Application Data\IDM
2009-04-03 22:54 . 2009-04-11 10:49 -------- d-----w c:\program files\Internet Download Manager
2009-04-03 22:54 . 2008-09-28 19:00 439440 ----a-w c:\program files\un_Internet Download Manager_16575.exe
2009-03-27 15:49 . 2009-03-27 16:36 32000 ----a-w c:\windows.0\system32\drivers\stppp.sys
2009-03-27 15:49 . 2009-03-27 15:49 40320 ----a-w c:\windows.0\system32\drivers\steth.sys
2009-03-27 15:49 . 2009-03-27 15:49 12672 ----a-w c:\windows.0\system32\drivers\stbus.sys
2009-03-27 15:49 . 2009-03-27 15:49 30464 ----a-w c:\windows.0\system32\drivers\st330.sys
2009-03-27 15:49 . 2009-03-27 15:49 16128 ----a-w c:\windows.0\system32\drivers\lpwdm.sys
2009-03-27 15:49 . 2009-03-27 15:49 -------- d-----w c:\program files\Thomson SpeedTouch
2009-03-26 18:28 . 2009-03-26 18:28 -------- d-----w c:\program files\Appwalk.com Technologies Canada
2009-03-26 16:38 . 2009-03-26 16:39 -------- d-----w c:\program files\Ela-Salaty
2009-03-26 16:38 . 2009-03-26 16:38 -------- d-----w c:\windows.0\Ela-Salaty
2009-03-25 19:12 . 2009-03-25 19:12 -------- d-----w c:\program files\VPN SIPLink
2009-03-25 11:21 . 2009-03-25 11:21 15 ----a-w c:\windows.0\AlBohyra
2009-03-25 11:21 . 2009-03-25 11:21 2144 ----a-w c:\windows.0\ST5UNST.000
2009-03-22 21:53 . 2009-03-29 20:25 -------- dc-h--w c:\documents and settings\All Users.WINDOWS.0\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-03-22 21:13 . 2008-04-14 00:12 53760 ----a-w c:\windows.0\system32\vfwwdm32.dll
2009-03-22 21:13 . 2008-04-14 00:12 43008 ----a-w c:\windows.0\system32\ksxbar.ax
2009-03-22 21:13 . 2008-04-14 00:12 91136 ----a-w c:\windows.0\system32\kswdmcap.ax
2009-03-22 21:13 . 2008-04-14 00:12 61952 ----a-w c:\windows.0\system32\kstvtune.ax
2009-03-22 20:58 . 2004-08-09 14:43 94208 ----a-w c:\windows.0\amcap.exe
2009-03-20 15:52 . 2009-02-13 08:31 55640 ----a-w c:\windows.0\system32\drivers\avgntflt.sys
2009-03-19 22:40 . 2009-03-19 22:40 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\AntiVir PersonalEdition Classic
2009-03-19 19:26 . 2009-03-19 19:42 -------- d-----w c:\documents and settings\user\Application Data\ICQ
2009-03-19 18:02 . 2009-03-19 18:10 -------- d-----w c:\documents and settings\user\Application Data\ooVoo Details
2009-03-19 18:01 . 2009-03-19 18:01 -------- d-----w c:\program files\ooVoo
2009-03-17 17:34 . 2009-03-17 17:35 -------- d-----w c:\program files\iTunes
2009-03-17 17:34 . 2009-03-17 17:35 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-16 21:53 . 2009-03-16 21:53 56 ---ha-w c:\windows.0\system32\ezsidmv.dat
2009-03-16 21:53 . 2009-03-20 18:10 -------- d-----w c:\documents and settings\user\Application Data\skypePM
2009-03-16 21:50 . 2009-03-20 20:39 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\Skype
2009-03-15 21:40 . 2009-03-15 21:42 -------- d-----w c:\program files\Adverts
2009-03-15 21:40 . 2009-04-07 20:25 -------- d-----w c:\program files\MessengerPlus! 3
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 22:09 . 2009-01-10 19:56 1878304 --sha-w c:\windows.0\system32\drivers\fidbox2.dat
2009-04-12 22:09 . 2008-12-06 19:01 -------- d-----w c:\documents and settings\user\Application Data\DMCache
2009-04-12 22:08 . 2009-01-10 19:56 64825632 --sha-w c:\windows.0\system32\drivers\fidbox.dat
2009-04-12 22:04 . 2009-01-10 19:56 182240 --sha-w c:\windows.0\system32\drivers\fidbox2.idx
2009-04-12 22:04 . 2009-01-10 19:56 875396 --sha-w c:\windows.0\system32\drivers\fidbox.idx
2009-04-11 20:33 . 2008-12-05 19:09 22720 -c--a-w c:\windows.0\system32\emptyregdb.dat
2009-04-11 20:32 . 2008-05-22 16:07 -------- d-----w c:\program files\Unlocker
2009-04-11 20:26 . 2008-11-16 21:34 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-11 11:24 . 2008-07-30 20:35 -------- d-----w c:\program files\Common Files\delet
2009-04-11 11:07 . 2008-12-09 18:08 -------- d-----w c:\documents and settings\user\Application Data\cleaner
2009-04-11 10:52 . 2007-12-02 19:04 -------- d-----w c:\program files\Common Files\Real
2009-04-11 10:52 . 2007-12-09 20:27 -------- d-----w c:\program files\Google
2009-04-11 10:50 . 2009-01-25 18:57 -------- d-----w c:\documents and settings\user\Application Data\AvaFind Data
2009-04-11 10:49 . 2008-05-19 14:45 -------- d-----w c:\program files\Windows Live
2009-04-09 21:26 . 2008-05-16 07:43 -------- d-----w c:\program files\MSECache
2009-04-09 14:32 . 2008-12-11 11:33 -------- d---a-w c:\documents and settings\All Users.WINDOWS.0\Application Data\TEMP
2009-04-09 12:33 . 2009-01-06 20:07 -------- d-----w c:\program files\Windows Live Safety Center
2009-04-07 20:25 . 2009-03-10 17:03 -------- d-----w c:\program files\Typing Assistant (English) 4.3
2009-04-07 20:25 . 2009-01-10 18:19 -------- d-----w c:\program files\Foxit PDF Tools
2009-04-07 02:27 . 2008-12-18 21:40 -------- d-----w c:\program files\Circle Developement
2009-04-05 20:34 . 2008-12-19 05:25 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\Messenger Plus!
2009-04-05 10:29 . 2009-02-02 03:52 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-03 22:54 . 2009-04-03 22:54 6282 ----a-w c:\program files\un_Internet Download Manager_16575.txt
2009-03-29 20:26 . 2008-11-10 19:33 -------- d-----w c:\program files\Uniblue
2009-03-29 20:25 . 2009-01-07 21:38 -------- d-----w c:\documents and settings\user\Application Data\Uniblue
2009-03-29 20:25 . 2008-11-10 19:33 -------- d-----w c:\documents and settings\salem\Application Data\Uniblue
2009-03-27 16:37 . 2009-03-27 15:47 186756 ----a-w C:\stInstall.log
2009-03-27 16:37 . 2009-03-27 15:49 15526 ----a-w C:\st330AdaptorMgr.log
2009-03-25 20:06 . 2007-12-02 19:15 -------- d-----w c:\program files\Messenger Plus! Live
2009-03-22 19:19 . 2009-02-13 15:30 -------- d-----w c:\program files\AlbaniV2
2009-03-20 19:01 . 2007-12-03 13:39 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-20 18:57 . 2008-10-04 20:37 -------- d-----w c:\documents and settings\salem\Application Data\Orbit
2009-03-20 18:56 . 2008-12-21 03:18 -------- d-----w c:\documents and settings\user\Application Data\Orbit
2009-03-19 23:16 . 2009-03-06 20:19 -------- d-----w c:\program files\Passware
2009-03-18 22:43 . 2008-12-13 22:00 -------- d-----w c:\documents and settings\user\Application Data\Apple Computer
2009-03-17 17:34 . 2008-11-17 23:13 -------- d-----w c:\program files\iPod
2009-03-17 16:07 . 2008-11-17 23:10 -------- d-----w c:\program files\Bonjour
2009-03-16 21:50 . 2007-12-09 20:26 -------- d-----w c:\program files\Common Files\Skype
2009-03-12 22:50 . 2007-12-22 20:08 -------- d-----w c:\program files\Avant Browser
2009-03-11 19:13 . 2009-03-11 19:12 81920 ----a-w c:\windows.0\system32\W32N50.DLL
2009-03-11 19:13 . 2009-03-11 19:12 17134 ----a-w c:\windows.0\system32\PCANDIS5.SYS
2009-03-05 21:27 . 2009-03-05 21:27 -------- d-----w c:\program files\Muslim Bag
2009-02-28 14:03 . 2009-02-28 14:03 -------- d-----w c:\program files\Ariss
2009-02-28 14:03 . 2009-01-08 14:00 724992 -c--a-w c:\windows.0\iun6002.exe
2009-02-28 10:53 . 2009-02-28 10:49 -------- d-----w c:\program files\USB Disk Security
2009-02-27 20:29 . 2009-02-27 20:29 -------- d-----w c:\program files\Agnitum
2009-02-27 20:26 . 2009-02-27 20:26 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\Agnitum
2009-02-25 20:15 . 2008-10-14 19:25 -------- d-----w c:\program files\أحكام التجويد
2009-02-25 20:15 . 2008-12-17 23:02 -------- d-----w c:\program files\UltraISO
2009-02-25 20:15 . 2008-08-19 10:34 -------- d-----w c:\program files\SpeedItUpFree
2009-02-25 20:15 . 2008-03-07 20:54 -------- d-----w c:\program files\Quran_in_Word
2009-02-25 20:15 . 2008-03-07 20:38 -------- d-----w c:\program files\Teleport Pro
2009-02-25 20:15 . 2008-06-16 11:01 -------- d-----w c:\program files\MobiMB Mobile Media Browser
2009-02-25 20:15 . 2008-01-05 20:46 -------- d-----w c:\program files\GameGain
2009-02-25 20:15 . 2007-12-31 20:21 -------- d-----w c:\program files\AbSecurityPRO
2009-02-25 20:14 . 2008-08-22 05:59 -------- d-----w c:\documents and settings\salem\Application Data\cleaner
2009-02-25 20:13 . 2008-11-17 23:08 -------- d-----w c:\program files\QuickTime
2009-02-21 05:25 . 2008-02-04 15:23 691592 ----a-w c:\windows.0\system32\OGACheckControl.DLL
2009-02-17 22:21 . 2009-02-17 21:14 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\DriverScanner
2009-02-17 22:21 . 2009-02-17 21:06 -------- dc-h--w c:\documents and settings\All Users.WINDOWS.0\Application Data\{148D8B8A-8F96-4822-81EC-D510B626B7D5}
2009-02-17 22:14 . 2009-02-17 18:08 -------- dc-h--w c:\documents and settings\All Users.WINDOWS.0\Application Data\{4439F0FD-AFAF-434D-86E2-DEB14A9C58AC}
2009-02-17 22:10 . 2009-02-17 22:10 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\PC Drivers HeadQuarters
2009-02-17 19:44 . 2009-02-10 10:49 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\YoGen
2009-02-17 18:08 . 2009-02-17 18:08 -------- d-----w c:\program files\iXi Tools
2009-02-16 05:36 . 2008-12-05 21:15 -------- d-----w c:\documents and settings\All Users.WINDOWS.0\Application Data\Microsoft Help
2009-02-13 15:29 . 2009-02-02 03:51 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-09 11:13 . 2009-04-11 19:54 1846784 ----a-w c:\windows.0\system32\win32k.sys
2009-02-06 16:43 . 2009-02-06 16:43 307576 -c--a-w c:\windows.0\WLXPGSS.SCR
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows.0\system32\sirenacm.dll
2009-02-05 20:16 . 2009-02-05 20:16 4096 -c--a-w c:\windows.0\d3dx.dat
2009-02-04 03:04 . 2009-02-04 03:04 0 ----a-w C:\osy3.sys
2009-02-03 20:15 . 2008-12-14 21:16 73216 -c--a-w c:\windows.0\ST6UNST.EXE
2009-01-20 22:12 . 2009-01-20 22:12 72731 -c--a-w c:\windows.0\BricoPackUninst.cmd
2009-01-20 22:12 . 2009-01-20 22:05 6766 -c--a-w c:\windows.0\BricoPackFoldersDelete.cmd
2009-04-11 20:48 . 2008-12-10 10:26 16384 -csha-w c:\windows.0\system32\config\systemprofile\Cookies\index.dat
2009-04-11 20:48 . 2008-12-10 10:26 32768 -csha-w c:\windows.0\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2009-04-11 20:48 . 2009-04-11 20:48 32768 --sha-w c:\windows.0\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009041120090412\index.dat
2009-04-11 20:48 . 2008-12-10 10:26 32768 -csha-w c:\windows.0\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2009-04-12 22:08 . 2009-01-10 19:56 64825632 --sha-w c:\windows.0\system32\drivers\fidbox.dat
2009-04-12 22:09 . 2009-01-10 19:56 1878304 --sha-w c:\windows.0\system32\drivers\fidbox2.dat
.
------- Sigcheck -------
[-] 2008-06-03 14:40 547328 A55B8899D2EA2E800061BCFD456E34DC c:\windows.0\system32\winlogon.exe
[-] 2008-10-31 22:23 1607680 D5FE9A885387582FFD57016ED4DE8D57 c:\windows.0\explorer.exe
[-] 2008-06-03 14:38 25088 B5E8782D4AF1B3756F38E11E7C157BBE c:\windows.0\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [02/06/2009 06:53 PM 3885408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [04/03/2009 07:23 PM 2794928]
"ctfmon.exe"="c:\windows.0\system32\ctfmon.exe" [06/03/2008 05:38 PM 25088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [02/06/2009 12:08 AM 81000]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [02/13/2009 05:23 PM 1225032]
"IgfxTray"="c:\windows.0\system32\igfxtray.exe" [02/15/2008 12:46 PM 135168]
"HotKeysCmds"="c:\windows.0\system32\hkcmd.exe" [02/15/2008 12:46 PM 159744]
"Persistence"="c:\windows.0\system32\igfxpers.exe" [02/15/2008 12:46 PM 131072]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [05/02/2008 12:15 AM 15872]
"VistaDrive"="c:\windows\VistaDrive\VistaDrive.exe" [10/05/2006 08:56 PM 280779]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.0\system32\ctfmon.exe" [06/03/2008 05:38 PM 25088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"ITD7"="c:\program files\Steganos Internet Trace Destructor 7\ITD7.exe" [05/02/2005 10:31 AM 274432]
"tscuninstall"="c:\windows.0\system32\tscupgrd.exe" [09/01/2004 03:00 AM 44544]
"nltide_3"="advpack.dll" [12/21/2008 02:15 AM 124928 c:\windows.0\system32\advpack.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [05/13/2008 09:13 AM 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Ela-Salaty.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\Ela-Salaty.lnk
backup=c:\windows.0\pss\Ela-Salaty.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^FastStone Capture.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Update Notifier.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\Update Notifier.lnk
backup=c:\windows.0\pss\Update Notifier.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows.0\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AvaFind]
--a--c--- 06/01/2004 12:48 PM 295936 c:\program files\AvaFind\AvaFind.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 06/03/2008 05:38 PM 25088 c:\windows.0\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 01/02/2007 12:22 AM 3739648 c:\program files\Google\Google Talk\googletalk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a--c--- 08/24/2007 07:00 AM 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 04/03/2009 07:23 PM 2794928 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 02/15/2008 12:46 PM 159744 c:\windows.0\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 02/15/2008 12:46 PM 131072 c:\windows.0\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 02/15/2008 12:46 PM 135168 c:\windows.0\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 03/12/2009 08:56 PM 342312 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a--c--- 11/05/2008 09:59 PM 4347120 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
--a------ 03/17/2009 03:05 PM 190024 c:\program files\MessengerPlus! 3\MsgPlus.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
-----c--- 04/14/2008 03:12 AM 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 02/06/2009 06:53 PM 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\oovoo.exe]
--a------ 02/25/2009 06:29 PM 14657328 c:\program files\ooVoo\ooVoo.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
--a------ 02/13/2009 04:51 PM 433480 c:\program files\Agnitum\Outpost Firewall Pro\feedback.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostMonitor]
--a------ 02/13/2009 05:23 PM 1225032 c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicPick Start]
--a------ 03/18/2009 10:33 AM 912384 c:\program files\PicPick\picpick.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 01/05/2009 04:18 PM 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 07/12/2007 04:00 AM 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 03/08/2009 11:08 PM 198160 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Typing Assistant (English)]
--a------ 01/18/2009 01:12 PM 1622016 c:\program files\Typing Assistant (English) 4.3\Typing Assistant (English).exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Antivirus]
--a------ 02/28/2009 01:53 PM 798720 c:\program files\USB Disk Security\USBGuard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 06/03/2008 05:18 PM 110592 c:\windows.0\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a--c--- 07/27/2006 09:19 AM 282624 c:\windows.0\sttray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
-ra--c--- 12/29/2004 01:01 AM 544768 c:\windows.0\sm56hlpr.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Thomson SpeedTouch\\ST330\\service\\st330service.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
"37676:TCP"= 37676:TCP
oVoo TCP المنفذ 37676
"37676:UDP"= 37676:UDP
oVoo UDP المنفذ 37676
"37677:UDP"= 37677:UDP
oVoo UDP المنفذ 37677
R0 pavboot;pavboot; [x]
R1 SASKUTIL;SASKUTIL; [x]
R3 afw;Agnitum firewall driver;c:\windows.0\system32\DRIVERS\afw.sys [06/20/2008 09:45 AM 30864]
R3 afwcore;afwcore;c:\windows.0\system32\drivers\afwcore.sys [02/10/2009 04:15 PM 257432]
R3 ASWFilt;ASWFilt;c:\windows.0\system32\Filt\ASWFilt.dll [02/10/2009 11:13 AM 35296]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [11/17/2008 08:05 AM 195752]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows.0\system32\DRIVERS\RTL8187.sys [01/11/2007 01:20 PM 194304]
R3 SASENUM;SASENUM; [x]
R3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows.0\system32\DRIVERS\steth.sys [03/27/2009 06:49 PM 40320]
R3 utezmjk5;AVZ Kernel Driver; [x]
S1 aswSP;avast! Self Protection; [x]
S1 SandBox;SandBox;c:\windows.0\system32\drivers\SandBox.sys [02/10/2009 11:10 AM 705600]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [03/29/2009 02:52 AM 9968]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [02/13/2009 04:51 PM 1267016]
S2 aswFsBlk;aswFsBlk;c:\windows.0\system32\DRIVERS\aswFsBlk.sys [02/06/2009 12:07 AM 20560]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [01/14/2009 05:53 PM 226656]
S3 ST330;ST330;c:\windows.0\system32\drivers\st330.sys [03/27/2009 06:49 PM 30464]
S3 STBUS;STBUS;c:\windows.0\system32\drivers\stbus.sys [03/27/2009 06:49 PM 12672]
S3 stppp;Speedtouch PPP Adapter Adapter;c:\windows.0\system32\DRIVERS\stppp.sys [03/27/2009 07:36 PM 32000]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{2C84C589-6EF0-4670-8E67-D2B37567DDFF} - (no file)
MSConfigStartUp-DriverUpdaterPro - c:\program files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.traducegratis.com/homepage.html
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = *.local
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
LSP: c:\windows.0\system32\idmmbc.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-13 01:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1343024091-1645522239-682003330-1003\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\ B1'!) *.7 *'DEH/E *#*0*\Attributes]
"Vendor"="Microsoft"
"Technology"="MMSys"
[HKEY_USERS\S-1-5-21-1343024091-1645522239-682003330-1003\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\ B1'!) *.7 *'DEH/E *#*0*\UI\AudioVolume]
"CLSID"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(892)
c:\windows.0\system32\SETUPAPI.dll
c:\windows.0\system32\sfc_os.dll
c:\windows.0\system32\COMRes.dll
c:\windows.0\system32\cscui.dll
- - - - - - - > 'lsass.exe'(948)
c:\windows.0\system32\setupapi.dll
c:\windows.0\system32\idmmbc.dll
- - - - - - - > 'explorer.exe'(440)
c:\windows.0\system32\SHDOCVW.dll
c:\windows.0\system32\msctfime.ime
c:\windows.0\system32\COMRes.dll
c:\windows.0\System32\cscui.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows.0\system32\SETUPAPI.dll
c:\windows.0\system32\NETSHELL.dll
c:\windows.0\system32\credui.dll
c:\windows.0\system32\MSVCP60.dll
c:\windows.0\system32\wpdshserviceobj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows.0\system32\portabledevicetypes.dll
c:\windows.0\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
SystemRoot\System32\smss.exe [796]
??\c:\windows.0\system32\csrss.exe [868]
??\c:\windows.0\system32\winlogon.exe [892]
c:\windows.0\system32\services.exe [936]
c:\windows.0\system32\lsass.exe [948]
c:\windows.0\system32\svchost.exe [1120]
c:\windows.0\system32\svchost.exe [1220]
c:\windows.0\System32\svchost.exe [1356]
c:\program files\Thomson SpeedTouch\ST330\service\st330service.exe [1388]
c:\windows.0\system32\svchost.exe [1580]
c:\windows.0\system32\svchost.exe [1760]
c:\program files\Alwil Software\Avast4\aswUpdSv.exe [1816]
c:\program files\Alwil Software\Avast4\ashServ.exe [1904]
c:\windows.0\system32\spoolsv.exe [328]
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [1268]
c:\program files\Bonjour\mDNSResponder.exe [1328]
c:\windows.0\system32\svchost.exe [1376]
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [1096]
c:\windows.0\System32\alg.exe [2372]
c:\windows.0\System32\svchost.exe [3076]
c:\windows.0\system32\ctfmon.exe [3796]
c:\windows.0\system32\CF28117.exe [2504]
c:\progra~1\ALWILS~1\Avast4\ashDisp.exe [3036]
c:\windows.0\system32\igfxtray.exe [3188]
c:\windows.0\system32\hkcmd.exe [3220]
c:\windows.0\system32\igfxpers.exe [1108]
c:\windows.0\system32\igfxsrvc.exe [3224]
c:\windows\VistaDrive\VistaDrive.exe [3276]
c:\program files\Windows Live\Messenger\msnmsgr.exe [3380]
c:\program files\Internet Download Manager\IDMan.exe [3532]
c:\windows.0\system32\wscntfy.exe [396]
c:\program files\Windows Live\Contacts\wlcomm.exe [3840]
c:\windows.0\explorer.exe [440]
c:\combofix\catchme.cfexe [2808]
.
**************************************************************************
.
Completion time: 04/13/2009 1:14 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-12 22:14
ComboFix2.txt 2008-12-20 15:59
ComboFix3.txt 2008-12-08 19:14
ComboFix4.txt 2008-11-18 21:03
ComboFix5.txt 2009-04-12 21:54
Pre-Run: 8,975,306,752 bytes free
Post-Run: 9,616,896,000 bytes free
442 --- E O F --- 2009-03-15 08:12
