ComboFix 09-04-22.08 - abumalik 04/22/2009 10:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.2037.1445 [GMT 3:00]
Running from: c:\documents and settings\abumalik\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\windows\system32\kakle.dll
c:\windows\system32\winntue16.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
F:\lky.exe
.
((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 )))))))))))))))))))))))))))))))
.
2009-04-20 08:49 . 2009-04-21 18:18 54156 ---ha-w c:\windows\QTFont.qfn
2009-04-20 08:49 . 2009-04-20 08:49 1409 ----a-w c:\windows\QTFont.for
2009-04-18 12:10 . 2009-04-18 12:10 7680 --sha-w c:\windows\Thumbs.db
2009-04-17 05:05 . 2009-03-06 14:20 283136 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-17 05:05 . 2009-02-09 11:21 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-17 05:05 . 2009-02-09 10:51 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 05:05 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 05:05 . 2009-02-09 10:51 723456 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-17 05:05 . 2009-02-09 10:51 681472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 05:05 . 2009-02-09 10:51 693760 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 05:05 . 2009-02-09 10:51 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 05:05 . 2009-02-09 10:51 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:36 . 2009-03-27 06:48 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-16 17:36 . 2008-04-21 21:14 215040 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-15 08:10 . 2009-04-15 08:10 -------- d-----w C:\trendingBot_lite
2009-04-12 11:33 . 2009-04-12 11:33 -------- d-----w c:\documents and settings\abumalik\Local Settings\Application Data\Conduit
2009-04-12 11:33 . 2009-04-13 11:11 -------- d-----w c:\documents and settings\abumalik\Local Settings\Application Data\MyPlayCity
2009-04-04 16:25 . 2009-04-04 16:25 -------- d-----w c:\documents and settings\abumalik\Application Data\Thinstall
2009-03-29 18:40 . 1998-06-23 22:00 108336 ----a-w c:\windows\system32\MSWINSCK.OCX
2009-03-28 20:26 . 2009-03-28 20:26 -------- d-----w c:\documents and settings\All Users\Application Data\Adobe Systems
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-22 08:08 . 2009-01-29 11:24 -------- d-----w c:\documents and settings\abumalik\Application Data\DMCache
2009-04-22 08:07 . 2009-01-29 12:03 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-22 08:03 . 2009-02-25 15:10 761888 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-22 08:03 . 2009-02-25 15:10 6828 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-22 08:03 . 2009-02-25 15:10 4186144 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-22 08:03 . 2009-02-25 15:10 36928 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-22 05:52 . 2001-09-19 12:00 41076 ----a-w c:\windows\system32\perfc001.dat
2009-04-22 05:52 . 2001-09-19 12:00 254322 ----a-w c:\windows\system32\perfh001.dat
2009-04-19 14:38 . 2009-01-29 10:43 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-04-14 18:18 . 2009-02-15 10:43 -------- d-----w c:\program files\GameHouse
2009-04-12 11:32 . 2009-04-12 11:32 -------- d-----w c:\program files\MyPlayCity
2009-04-12 11:32 . 2009-04-12 11:32 -------- d-----w c:\program files\Conduit
2009-04-11 20:31 . 2009-02-01 11:59 -------- d-----w c:\program files\Cooolsoft
2009-04-11 19:45 . 2009-04-11 19:45 -------- d-----w c:\program files\MyPlayCity.com
2009-04-07 16:16 . 2009-04-04 19:18 -------- d-----w c:\program files\iCall
2009-04-05 18:39 . 2009-04-05 18:39 -------- d-----w c:\program files\EA SPORTS
2009-04-03 19:03 . 2009-03-29 18:40 -------- d-----w c:\program files\All2Chat
2009-04-02 07:08 . 2009-01-30 20:03 -------- d-----w c:\program files\JetAudio
2009-03-30 10:57 . 2009-02-01 06:07 99496 ----a-w c:\documents and settings\abumalik\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-29 19:43 . 2009-03-29 19:43 -------- d-----w c:\program files\MSECache
2009-03-29 19:37 . 2009-01-29 10:06 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-28 20:27 . 2009-01-29 10:26 -------- d-----w c:\program files\Common Files\Adobe
2009-03-28 20:26 . 2009-03-28 20:26 -------- d-----w c:\program files\Common Files\Adobe Systems Shared
2009-03-28 08:11 . 2009-03-28 08:11 -------- d-----w c:\program files\Common Files\xing shared
2009-03-28 08:10 . 2009-01-29 12:42 -------- d-----w c:\program files\Common Files\Real
2009-03-28 08:10 . 2003-03-18 20:14 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-03-27 06:10 . 2009-01-29 11:30 90112 ----a-w c:\windows\DUMPbf68.tmp
2009-03-27 06:07 . 2009-01-29 11:30 90112 ----a-w c:\windows\DUMPa587.tmp
2009-03-27 06:05 . 2009-01-29 11:30 90112 ----a-w c:\windows\DUMP9d49.tmp
2009-03-26 12:27 . 2009-03-07 20:14 -------- d-----w c:\program files\GVR
2009-03-25 14:34 . 2009-03-05 10:38 -------- d-----w c:\program files\Google
2009-03-25 07:04 . 2009-03-05 08:34 -------- d-----w c:\program files\AntiLogger
2009-03-12 22:31 . 2009-03-12 22:25 -------- d-----w c:\program files\Easy Macro Recorder
2009-03-12 15:56 . 2009-03-12 15:56 268 ---ha-w C:\sqmdata00.sqm
2009-03-12 15:56 . 2009-03-12 15:56 244 ---ha-w C:\sqmnoopt00.sqm
2009-03-11 09:52 . 2009-03-11 09:52 -------- d-----w c:\program files\Common Files\Windows Live
2009-03-10 13:50 . 2009-03-10 13:49 -------- d-----w c:\documents and settings\abumalik\Application Data\.purple
2009-03-10 13:48 . 2009-03-10 13:48 -------- d-----w c:\program files\Common Files\GTK
2009-03-08 18:13 . 2009-03-08 18:13 -------- d-----w c:\documents and settings\abumalik\Application Data\Apple Computer
2009-03-07 08:58 . 2009-03-07 08:57 -------- d-----w c:\program files\QuickTime
2009-03-07 08:57 . 2009-03-07 08:57 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-07 08:57 . 2009-03-07 08:57 -------- d-----w c:\program files\Apple Software Update
2009-03-07 08:57 . 2009-03-07 08:57 -------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-03-06 14:20 . 2004-08-03 22:55 283136 ----a-w c:\windows\system32\pdh.dll
2009-03-03 07:10 . 2009-03-03 07:10 -------- d-----w c:\program files\قاموس صخر الجديد
2009-03-03 00:06 . 2004-08-03 22:55 826368 ----a-w c:\windows\system32\wininet.dll
2009-03-02 14:46 . 2009-02-20 06:39 90112 ----a-w c:\windows\system32\agsaami.dll
2009-03-02 14:46 . 2009-02-20 06:39 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-03-02 14:46 . 2009-02-20 06:39 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-03-02 14:46 . 2009-02-20 06:39 1986560 ----a-w c:\windows\system32\akll.dll
2009-03-02 14:46 . 2009-02-20 06:39 196608 ----a-w c:\windows\system32\maag.dll
2009-03-02 14:46 . 2009-02-20 06:39 1245184 ----a-w c:\windows\system32\bkll.dll
2009-03-02 14:46 . 2009-02-20 06:39 1212416 ----a-w c:\windows\system32\ckll.dll
2009-03-02 14:46 . 2009-02-20 06:39 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-03-02 14:46 . 2009-02-20 06:39 237568 ----a-w c:\windows\system32\lame_enc.dll
2009-03-02 14:45 . 2009-03-02 14:45 -------- d-----w c:\program files\Real_SC
2009-02-27 05:06 . 2009-02-25 12:27 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-26 20:54 . 2009-02-26 20:54 -------- d-----w c:\documents and settings\abumalik\Application Data\CyberScrub
2009-02-26 20:54 . 2009-02-26 20:54 -------- d-----w c:\documents and settings\abumalik\Application Data\cleaner
2009-02-26 08:22 . 2009-02-26 08:22 -------- d-----w c:\documents and settings\abumalik\Application Data\Uniblue
2009-02-26 05:52 . 2009-02-25 15:10 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-26 05:52 . 2009-02-25 15:10 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-26 05:52 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-25 15:10 . 2009-02-25 15:10 -------- d-----w c:\program files\Kaspersky Lab
2009-02-25 12:27 . 2009-02-25 12:27 -------- d-----w c:\documents and settings\abumalik\Application Data\URSoft
2009-02-25 12:27 . 2009-02-25 12:27 -------- d-----w c:\program files\Your Uninstaller 2008
2009-02-24 17:21 . 2009-02-16 08:52 -------- d-----w c:\program files\Paltalk Messenger
2009-02-24 17:21 . 2009-02-14 10:44 -------- d-----w c:\program files\SysResources Manager
2009-02-24 17:21 . 2009-01-29 10:43 -------- d-----w c:\program files\Al-Wafi
2009-02-23 21:17 . 2009-02-23 21:13 -------- d-----w c:\documents and settings\abumalik\Application Data\ICQ
2009-02-23 21:17 . 2009-02-23 21:12 -------- d-----w c:\program files\ICQ6.5
2009-02-20 16:50 . 2004-08-03 22:55 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 06:39 . 2009-02-20 06:39 344064 ----a-w c:\windows\system32\msvcr70.dll
2009-02-20 06:39 . 2009-02-20 06:39 487424 ----a-w c:\windows\system32\msvcp70.dll
2009-02-20 06:39 . 2009-02-20 06:39 974848 ----a-w c:\windows\system32\mfc70.dll
2009-02-16 08:59 . 2009-02-16 08:59 146 ----a-w C:\YServer.txt
2009-02-14 10:54 . 2009-02-14 10:54 15620 ----a-w c:\windows\system32\SystemRes10.b30.SYS
2009-02-12 09:27 . 2009-02-12 09:27 230424 ----a-w C:\img2-001.raw
2009-02-09 14:04 . 2004-08-03 22:46 1846656 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:22 . 2004-08-04 00:48 2025472 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:22 . 2004-08-03 22:48 2146816 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:21 . 2004-08-03 22:56 110592 ----a-w c:\windows\system32\services.exe
2009-02-09 10:51 . 2004-08-03 22:55 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:51 . 2004-08-03 22:55 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:51 . 2004-08-03 22:55 681472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:51 . 2004-08-03 22:55 693760 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:03 . 2009-02-04 20:38 157 ----a-w C:\home.htm
2009-02-06 10:39 . 2001-09-19 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:57 . 2004-08-03 22:55 56832 ----a-w c:\windows\system32\secur32.dll
2009-02-02 07:33 . 2004-08-03 20:59 250048 --sha-r C:\ntldr
2009-01-31 04:42 . 2009-01-29 09:44 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-01-31 04:37 . 2009-01-31 04:37 2678 ----a-w c:\windows\java\Packages\Data\AQAVD39B.DAT
2009-01-31 04:37 . 2009-01-31 04:37 2678 ----a-w c:\windows\java\Packages\Data\1F1VTZ9J.DAT
2009-01-31 04:37 . 2009-01-31 04:37 2678 ----a-w c:\windows\java\Packages\Data\JV9Z3P3X.DAT
2009-01-31 04:37 . 2009-01-31 04:37 2678 ----a-w c:\windows\java\Packages\Data\GMHZBHJ7.DAT
2009-01-31 04:37 . 2009-01-31 04:37 2678 ----a-w c:\windows\java\Packages\Data\1N9V5RHF.DAT
2009-01-29 10:43 . 2009-01-29 10:43 172032 ------w c:\windows\Setup1.exe
2009-01-29 10:43 . 2009-01-29 10:43 73216 ----a-w c:\windows\ST6UNST.EXE
2009-01-29 10:43 . 2009-01-29 10:43 2232 ----a-w c:\windows\java\Packages\Data\VDZT71ZH.DAT
2009-01-29 10:43 . 2009-01-29 10:43 155995 ----a-w c:\windows\java\Packages\SBB177BD.ZIP
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
2008-03-04 10:44 1470488 ----a-w c:\program files\MyPlayCity\tbMyPl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyPl.dll" [2008-03-04 1470488]
[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}"= "c:\program files\MyPlayCity\tbMyPl.dll" [2008-03-04 1470488]
[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-29 2745776]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-11 5724184]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-08-26 860160]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-06-23 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-06-23 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-06-23 81920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"tsnp325"="c:\windows\tsnp325.exe" [2007-04-21 270336]
"snp325"="c:\windows\vsnp325.exe" [2007-05-10 835584]
"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-09-06 820736]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-06-29 176128]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-26 206088]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-28 198160]
"iCall Internet Phone"="c:\program files\iCall\iCall.exe" [2007-08-28 1191936]
"SigmatelSysTrayApp"="sttray.exe" - c:\windows\sttray.exe [2006-05-26 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\abumalik\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Reader Speed Launch.lnk - c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A70001000000}\SC_Reader.exe [2009-1-29 25214]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2007-9-8 10186752]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\iCall\\iCall.exe"=
R1 is-J14C0drv;is-J14C0drv; [x]
R3 AVPsys;AVPsys; [x]
R3 PAC207;PC Camera;c:\windows\system32\DRIVERS\PFC027.SYS [2007-05-29 508160]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2007-05-07 10343168]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-26 33808]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0deacf48-edf2-11dd-acbc-0019d11703f8}]
\Shell\AutoRun\command - qxty9be.cmd
\Shell\open\Command - qxty9be.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f1c6a06-0241-11de-adc1-0019d11703f8}]
\Shell\autOplay\commAND - H:\hpkgv.exe
\Shell\AutoRun\command - H:\hpkgv.exe
\Shell\eXPLoRe\COmmaNd - H:\hpkgv.exe
\Shell\OPen\commanD - H:\hpkgv.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37bc5f28-1062-11de-ae5f-0019d11703f8}]
\Shell\AutoRun\command - H:\i.cmd
\Shell\open\Command - H:\i.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62efdad7-ff60-11dd-ad9f-0019d11703f8}]
\Shell\AutoRun\command - m9ma.exe
\Shell\explore\Command - m9ma.exe
\Shell\open\Command - m9ma.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64db2270-0caa-11de-ae32-0019d11703f8}]
\Shell\AutoRun\command - I:\i.com
\Shell\open\Command - I:\i.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8752a125-f69a-11dd-ad2f-0019d11703f8}]
\sHell\AutOPlAy\comMand - H:\yqen.pif
\sHell\AutoRun\command - H:\yqen.pif
\sHell\explore\COmmanD - H:\yqen.pif
\sHell\opEn\COmMaNd - H:\yqen.pif
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a44b78f3-0a23-11de-ae0d-0019d11703f8}]
\Shell\AutoRun\command - H:\gyn.cmd
\Shell\open\Command - H:\gyn.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b49c5979-07e1-11de-adf8-0019d11703f8}]
\Shell\AutoRun\command - ej10fkdo.bat
\Shell\open\Command - ej10fkdo.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{edb0099e-0d95-11de-ae3c-0019d11703f8}]
\Shell\AutoRun\command - w2.com
\Shell\open\Command - w2.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f951cd8a-1bac-11de-aef2-0019d11703f8}]
\Shell\AutoRun\command - driver\usb\–گپ¼‡‘ٹ•†‘ح€Œژ
\Shell\open\command - driver\usb\–گپ¼‡‘ٹ•†‘ح€Œژ
.
Contents of the 'Scheduled Tasks' folder
2009-04-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:57]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ae/
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {B05499F8-952E-4B73-A721-CB5EFBB76860} = 192.168.115.1
DPF: Microsoft XML Parser for Java -
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-22 11:08
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):17,fb,04,22,33,d0,3c,28,2e,b2,0e,b7,c4,c4,81,a0,9a,d0,02,3a,e9,
70,d2,b4,00,e7,75,31,b9,b4,60,33,e3,c3,b2,35,9d,b4,86,b9,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{dbd2e664-7726-402c-8d0b-08e81d26436f}]
@Denied: (Full) (Everyone)
"Model"=dword:0000005c
"Therad"=dword:0000000a
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,08,f2,fb,a4,ff,
b7,32,cc,05,98,32,02,34,2b,da,61,51,8b,20,c9,80,81,74,b8,08,75,92,e3,cf,9d,\
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\stacsv.exe
c:\windows\system32\wdfmgr.exe
c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
c:\progra~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-22 11:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-22 08:11
Pre-Run: 23,795,052,544 bytes free
Post-Run: 24,268,263,424 bytes free
303 --- E O F --- 2009-04-17 07:01
