هذا التقرير ComboFix
.......................................
ComboFix 09-04-14.06 - Administrator 04/18/2009 19:21.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1015.664 [GMT 3:00]
Running from: G:\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-03-18 to 2009-04-18 )))))))))))))))))))))))))))))))
.
2009-04-18 14:48 . 2009-04-18 14:48 -------- d-----w c:\windows\LastGood
2009-04-18 14:48 . 2008-05-15 07:08 104192 ----a-w c:\windows\system32\drivers\br3gmdm.sys
2009-04-14 16:12 . 2009-04-14 16:12 -------- d--h--w c:\windows\PIF
2009-04-14 15:51 . 2009-04-14 15:51 -------- d-----w c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-04-14 15:51 . 2009-04-14 15:51 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-14 15:37 . 2008-09-18 16:23 8101988 ----a-w c:\windows\system32\idtsg.cpl
2009-04-14 15:37 . 2008-09-18 16:23 442470 ----a-w c:\windows\sttray.exe
2009-04-14 15:37 . 2008-09-18 16:23 2314240 ----a-w c:\windows\system32\stlang.dll
2009-04-14 15:37 . 2008-09-18 16:23 221276 ----a-w c:\windows\system32\stacsv.exe
2009-04-14 15:37 . 2008-09-18 16:23 150528 ----a-w c:\windows\system32\staco.dll
2009-04-14 07:43 . 2008-09-18 16:23 442476 ------w c:\windows\system32\stacapi.dll
2009-04-13 15:19 . 2009-04-13 15:19 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Thinstall
2009-04-13 15:19 . 2009-04-13 15:19 -------- d-----w c:\documents and settings\Administrator\Application Data\Thinstall
2009-04-11 14:34 . 2009-04-11 14:34 -------- d-----w c:\documents and settings\Administrator\Application Data\CyberScrub
2009-04-11 08:12 . 2009-04-11 08:12 -------- d-----w c:\documents and settings\Administrator\Application Data\WinBatch
2009-04-07 15:36 . 2009-04-18 07:11 -------- d-----w c:\documents and settings\Administrator\Application Data\cleaner
2009-04-07 08:15 . 2009-04-07 08:15 2572 ----a-w c:\windows\system32\PerfStringBackup.TMP
2009-04-07 08:13 . 2009-03-17 10:58 540672 ----a-w c:\windows\RtlExUpd.dll
2009-04-04 08:43 . 2009-04-04 08:43 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-03-31 16:20 . 2009-02-12 02:30 1481728 ----a-w c:\windows\system32\legitcheckcontrol.dll.bak
2009-03-31 16:19 . 2007-02-28 12:30 336768 -c--a-w c:\windows\system32\dllcache\WgaTray.exe
2009-03-31 16:19 . 2007-02-28 12:29 236928 -c--a-w c:\windows\system32\dllcache\WgaLogon.dll
2009-03-31 16:13 . 2009-03-31 16:22 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-03-31 16:11 . 2009-03-31 16:12 -------- dc-h--w c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-03-31 15:44 . 2009-03-31 15:44 -------- d-----w c:\windows\system32\ar-sa
2009-03-31 15:31 . 2008-12-20 23:15 52224 -c----w c:\windows\system32\dllcache\msfeedsbs.dll
2009-03-31 15:31 . 2008-12-20 23:15 459264 -c----w c:\windows\system32\dllcache\msfeeds.dll
2009-03-31 15:31 . 2008-12-20 23:15 267776 -c----w c:\windows\system32\dllcache\iertutil.dll
2009-03-31 15:31 . 2008-12-20 23:15 383488 -c----w c:\windows\system32\dllcache\ieapfltr.dll
2009-03-31 15:31 . 2008-12-20 23:15 63488 -c----w c:\windows\system32\dllcache\icardie.dll
2009-03-31 15:31 . 2008-12-19 09:10 13824 -c----w c:\windows\system32\dllcache\ieudinit.exe
2009-03-31 15:31 . 2007-04-17 09:32 2455488 -c----w c:\windows\system32\dllcache\ieapfltr.dat
2009-03-31 15:31 . 2007-03-08 05:10 991232 -c----w c:\windows\system32\dllcache\ieframe.dll.mui
2009-03-31 15:31 . 2008-12-20 23:15 6066688 -c----w c:\windows\system32\dllcache\ieframe.dll
2009-03-29 15:37 . 2009-03-29 15:37 -------- d-----w c:\windows\Sun
2009-03-29 15:32 . 2007-09-02 17:56 1686016 ----a-w c:\windows\system32\clinetsuitex6.ocx
2009-03-29 15:32 . 2004-06-14 11:56 427864 ----a-w c:\windows\system32\XceedZip.dll
2009-03-28 07:11 . 2009-04-18 14:43 -------- d-----w c:\windows\SxsCaPendDel
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-18 14:48 . 2009-03-04 14:33 -------- d-----w c:\program files\BandRich
2009-04-18 14:42 . 2009-03-04 06:11 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-18 14:41 . 2009-03-04 06:23 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-18 14:40 . 2009-03-04 06:23 4436 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-18 14:40 . 2009-03-04 06:23 368672 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-18 14:40 . 2009-03-04 06:23 368672 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-18 14:40 . 2009-03-04 06:23 14124 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-18 14:40 . 2009-03-04 06:23 1401376 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-18 14:40 . 2009-03-04 06:23 1401376 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-14 16:32 . 2009-04-14 16:32 -------- d-----w c:\program files\iVocalize Web Conference 4
2009-04-14 15:51 . 2009-04-14 15:51 -------- d-----w c:\program files\Common Files\Real
2009-04-14 15:51 . 2009-03-08 06:24 -------- d-----w c:\program files\Ringz Studio
2009-04-14 15:45 . 2009-03-02 16:13 -------- d-----w c:\documents and settings\Administrator\Application Data\BSplayer
2009-04-14 07:42 . 2009-04-07 08:16 -------- d-----w c:\program files\IDT
2009-04-14 07:42 . 2009-03-02 16:20 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-13 15:00 . 2009-04-07 08:16 8208 ----a-w c:\windows\system32\drivers\sthdae.log
2009-04-12 15:52 . 2009-04-12 15:52 319488 ----a-w c:\windows\HideWin.exe
2009-04-07 08:14 . 2009-04-07 08:14 -------- d-----w c:\program files\Realtek
2009-03-31 16:22 . 2009-03-31 16:13 -------- d-----w c:\program files\ma-config.com
2009-03-31 09:32 . 2009-03-08 14:50 -------- d-----w c:\documents and settings\Administrator\Application Data\Screenshot Sender
2009-03-19 08:21 . 2009-03-09 06:22 -------- d-----w c:\program files\Circle Developement
2009-03-17 07:35 . 2009-03-02 15:38 293528 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-15 07:41 . 2009-03-14 16:04 432 ----a-w c:\windows\system32\drivers\stwrte.log
2009-03-10 14:43 . 2009-03-02 16:04 -------- d-----w c:\program files\Common Files\Adobe
2009-03-09 06:22 . 2009-03-08 14:49 -------- d-----w c:\program files\Messenger Plus! Live
2009-03-09 06:22 . 2009-03-09 06:22 -------- d-----w c:\program files\Windows Live
2009-03-09 06:22 . 2009-03-07 15:27 -------- d-----w c:\program files\MSN Messenger
2009-03-08 16:12 . 2009-03-08 16:12 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-08 14:49 . 2009-03-08 14:49 -------- d-----w c:\program files\Adverts
2009-03-08 09:13 . 2009-03-08 09:13 268 ---ha-w C:\sqmdata05.sqm
2009-03-08 09:13 . 2009-03-08 09:13 244 ---ha-w C:\sqmnoopt05.sqm
2009-03-08 06:57 . 2009-03-08 06:51 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-08 06:56 . 2009-03-08 06:56 -------- d-----w c:\program files\Microsoft Works
2009-03-08 06:55 . 2009-03-08 06:55 -------- d-----w c:\program files\MSBuild
2009-03-08 06:54 . 2009-03-08 06:54 -------- d-----w c:\program files\Microsoft.NET
2009-03-08 06:47 . 2009-03-08 06:38 -------- d-----w c:\program files\Google
2009-03-08 06:46 . 2009-03-08 06:46 280 ---ha-w C:\sqmdata04.sqm
2009-03-08 06:46 . 2009-03-08 06:46 244 ---ha-w C:\sqmnoopt04.sqm
2009-03-08 06:36 . 2009-03-08 06:36 268 ---ha-w C:\sqmdata03.sqm
2009-03-08 06:36 . 2009-03-08 06:36 244 ---ha-w C:\sqmnoopt03.sqm
2009-03-08 06:32 . 2009-03-08 06:32 268 ---ha-w C:\sqmdata02.sqm
2009-03-08 06:32 . 2009-03-08 06:32 244 ---ha-w C:\sqmnoopt02.sqm
2009-03-07 15:34 . 2009-03-07 15:34 -------- d-----w c:\program files\Common Files\xing shared
2009-03-07 15:34 . 2009-03-02 16:12 -------- d-----w c:\program files\Real
2009-03-07 15:33 . 2009-03-07 15:33 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-03-07 15:33 . 2009-03-07 15:33 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-03-07 15:30 . 2009-03-07 15:30 172 ---ha-w C:\sqmnoopt01.sqm
2009-03-07 15:30 . 2009-03-07 15:30 172 ---ha-w C:\sqmdata01.sqm
2009-03-07 15:30 . 2009-03-07 15:30 268 ---ha-w C:\sqmdata00.sqm
2009-03-07 15:30 . 2009-03-07 15:30 244 ---ha-w C:\sqmnoopt00.sqm
2009-03-07 06:34 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-07 06:34 . 2009-03-04 06:23 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-03-07 06:34 . 2009-03-04 06:23 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-03-04 06:23 . 2009-03-04 06:23 -------- d-----w c:\program files\Kaspersky Lab
2009-03-04 06:13 . 2009-03-04 06:11 -------- d-----w c:\program files\Your Uninstaller 2008
2009-03-04 06:11 . 2009-03-04 06:11 -------- d-----w c:\documents and settings\Administrator\Application Data\URSoft
2009-03-04 06:08 . 2009-03-04 06:08 -------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-04 06:08 . 2009-03-04 06:08 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2009-03-03 16:07 . 2009-03-03 16:06 -------- d-----w c:\program files\HP
2009-03-03 16:07 . 2009-03-03 16:07 -------- d-----w c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-03-03 16:06 . 2009-03-03 16:04 -------- d--h--w c:\program files\Marvell-HP
2009-03-02 16:43 . 2009-03-02 16:43 5311 ----a-w C:\huadio.tmp
2009-03-02 16:20 . 2009-03-02 16:20 -------- d-----w c:\program files\PLANET
2009-03-02 16:19 . 2009-03-02 16:19 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-02 16:19 . 2009-03-02 16:19 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-03-02 16:14 . 2009-03-02 16:14 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-02 16:14 . 2009-03-02 16:14 -------- d-----w c:\program files\Java
2009-03-02 16:14 . 2009-03-02 16:14 2232 ----a-w c:\windows\java\Packages\Data\B1ZXJ5Z9.DAT
2009-03-02 16:14 . 2009-03-02 16:14 155995 ----a-w c:\windows\java\Packages\RFV931N5.ZIP
2009-03-02 16:14 . 2009-03-02 16:14 2678 ----a-w c:\windows\java\Packages\Data\PNLBL3PJ.DAT
2009-03-02 16:14 . 2009-03-02 16:14 2678 ----a-w c:\windows\java\Packages\Data\XZRBTB79.DAT
2009-03-02 16:14 . 2009-03-02 16:14 2678 ----a-w c:\windows\java\Packages\Data\MWHVPNXR.DAT
2009-03-02 16:14 . 2009-03-02 16:14 2678 ----a-w c:\windows\java\Packages\Data\L3BHRJVB.DAT
2009-03-02 16:14 . 2009-03-02 16:14 2678 ----a-w c:\windows\java\Packages\Data\JNV9VLNL.DAT
2009-03-02 16:13 . 2009-03-02 16:13 -------- d-----w c:\documents and settings\Administrator\Application Data\BSplayer Pro
2009-03-02 16:13 . 2009-03-02 16:13 -------- d-----w c:\program files\Webteh
2009-03-02 16:12 . 2009-03-02 16:12 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-02 16:04 . 2009-03-02 16:04 -------- d-----w c:\program files\VideoLAN
2009-03-02 16:02 . 2009-03-02 16:01 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-03-02 16:01 . 2009-03-02 16:01 -------- d-----w c:\program files\CCleaner
2009-03-02 16:01 . 2009-03-02 16:01 73216 ----a-w c:\windows\ST6UNST.EXE
2009-03-02 16:01 . 2009-03-02 16:01 172032 ------w c:\windows\Setup1.exe
2009-03-02 16:01 . 2009-03-02 16:01 -------- d-----w c:\program files\Yahoo!
2009-03-02 16:00 . 2009-03-02 16:00 -------- d-----w c:\program files\Ahead
2009-03-02 16:00 . 2009-03-02 16:00 -------- d-----w c:\program files\Common Files\Ahead
2009-03-02 15:40 . 2009-03-02 15:32 166455 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-02 15:33 . 2009-03-02 15:33 -------- d-----w c:\program files\microsoft frontpage
2009-03-02 15:30 . 2009-03-02 15:30 21640 ----a-w c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-04-14_09.10.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-18 14:40 . 2009-04-18 14:40 16384 c:\windows\temp\Perflib_Perfdata_66c.dat
+ 2009-04-18 14:48 . 2009-04-18 14:48 49152 c:\windows\Installer\{6A5CC193-FA73-4D82-8F33-A33AAD7471E0}\BRService.exe_6A5CC193FA734D828F33A33AAD7471E0_2.exe
- 2009-03-28 06:39 . 2009-03-28 06:39 49152 c:\windows\Installer\{6A5CC193-FA73-4D82-8F33-A33AAD7471E0}\BRService.exe_6A5CC193FA734D828F33A33AAD7471E0_2.exe
- 2009-03-28 06:39 . 2009-03-28 06:39 49152 c:\windows\Installer\{6A5CC193-FA73-4D82-8F33-A33AAD7471E0}\ARPPRODUCTICON.exe
+ 2009-04-18 14:48 . 2009-04-18 14:48 49152 c:\windows\Installer\{6A5CC193-FA73-4D82-8F33-A33AAD7471E0}\ARPPRODUCTICON.exe
+ 2009-04-18 14:48 . 2009-04-18 14:48 8854 c:\windows\Installer\{6A5CC193-FA73-4D82-8F33-A33AAD7471E0}\UNINST_Uninstall_C_6A5CC193FA734D828F33A33AAD7471E0.exe
- 2009-03-28 06:39 . 2009-03-28 06:39 8854 c:\windows\Installer\{6A5CC193-FA73-4D82-8F33-A33AAD7471E0}\UNINST_Uninstall_C_6A5CC193FA734D828F33A33AAD7471E0.exe
+ 2009-04-14 15:37 . 2008-09-18 16:23 221276 c:\windows\system32\stacsv.exe
+ 2009-04-14 15:37 . 2008-09-18 16:23 150528 c:\windows\system32\staco.dll
+ 2006-10-18 15:05 . 2006-10-18 15:05 185952 c:\windows\system32\rmoc3260.dll
+ 2009-03-16 08:00 . 2009-04-18 07:39 607620 c:\windows\system32\Restore\rstrlog.dat
+ 2004-05-14 04:59 . 2004-05-14 04:59 278528 c:\windows\system32\pncrt.dll
- 2009-03-07 15:33 . 2009-03-07 15:33 278528 c:\windows\system32\pncrt.dll
+ 2009-04-18 14:48 . 2008-05-15 07:08 104192 c:\windows\system32\DRVSTORE\brser_60DDB4EF1E4851DEE61B1AC95366B8B03382515D\br3gmdm.sys
- 2009-03-28 06:39 . 2008-05-15 07:08 104192 c:\windows\system32\DRVSTORE\brser_60DDB4EF1E4851DEE61B1AC95366B8B03382515D\br3gmdm.sys
- 2009-03-28 06:39 . 2008-05-15 07:08 104192 c:\windows\system32\DRVSTORE\brmdm_C0855280C59C074A202D0419EEC2049938F4FB2A\br3gmdm.sys
+ 2009-04-18 14:48 . 2008-05-15 07:08 104192 c:\windows\system32\DRVSTORE\brmdm_C0855280C59C074A202D0419EEC2049938F4FB2A\br3gmdm.sys
+ 2009-03-04 06:23 . 2009-04-18 14:40 368672 c:\windows\system32\drivers\fidbox2.dat
- 2009-03-28 06:39 . 2008-05-15 07:08 104192 c:\windows\system32\drivers\br3gmdm.sys
+ 2009-04-18 14:48 . 2008-05-15 07:08 104192 c:\windows\system32\drivers\br3gmdm.sys
+ 2009-04-14 15:37 . 2008-09-18 16:23 442470 c:\windows\sttray.exe
+ 2009-04-14 15:37 . 2008-09-18 16:23 2314240 c:\windows\system32\stlang.dll
+ 2009-03-04 06:23 . 2009-04-18 14:40 1401376 c:\windows\system32\drivers\fidbox.dat
- 2009-03-04 06:23 . 2009-04-14 08:10 1401376 c:\windows\system32\drivers\fidbox.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 131072]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2007-01-22 36864]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-03-07 206088]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"CTFMON"="c:\windows\system32\wscript.exe" [2004-08-03 114688]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-09-18 442470]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-11-26 97357]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
WL-8316 Configuration Utility.lnk - c:\program files\PLANET\PLANET WL-8316\WL-8316 Configuration Utility.exe [2009-3-2 786432]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 22:04 39792 ----a-w c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage Setup]
2009-03-02 16:13 120832 ----a-w c:\program files\Webteh\BSplayer\AdVantageSetup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 07:50 155648 ----a-w c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-03-02 16:14 136600 ----a-w c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP2014MC.EXE"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
R3 autorun;autorun;C:\huadio.tmp [2009-03-02 5311]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-03-15 216232]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-03-07 33808]
S2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [2008-10-03 87264]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys [2008-05-15 104192]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - BANDLUXE_SERVICE
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-18 19:22
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\C:\huadio.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1168)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: ~,10time:~,-3
ComboFix-quarantined-files.txt 2009-04-18 16:23
ComboFix2.txt 2009-04-18 07:23
ComboFix3.txt 2009-04-15 06:48
ComboFix4.txt 2009-04-14 09:11
Pre-Run: 34,943,479,808 bytes free
Post-Run: 34,933,456,896 bytes free
262
............
