ComboFix 09-04-23.02 - user 04/22/2009 23:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1014.605 [GMT 3:00]
Running from: c:\documents and settings\user\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\1doc2pdf.dll
c:\windows\IE4 Error Log.txt
c:\windows\system32\kakle.dll
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-03-22 to 2009-04-22 )))))))))))))))))))))))))))))))
.
2009-04-21 20:36 . 2009-04-21 21:18 -------- d-----w c:\documents and settings\user\Application Data\Desktopicon
2009-04-14 21:04 . 2009-04-14 21:04 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\Thinstall
2009-04-14 21:04 . 2009-04-14 21:04 -------- d-----w c:\documents and settings\user\Application Data\Thinstall
2009-04-14 10:57 . 2009-04-14 10:57 -------- d--h--w c:\windows\system32\GroupPolicy
2009-04-12 22:17 . 2009-04-12 22:17 268 ---ha-w C:\sqmdata10.sqm
2009-04-12 22:17 . 2009-04-12 22:17 244 ---ha-w C:\sqmnoopt10.sqm
2009-04-10 14:34 . 2007-11-05 07:51 69632 ----a-w c:\windows\system32\itechPrn.exe
2009-04-03 13:23 . 2009-04-03 13:23 0 ----a-w c:\windows\DTNASKH.INI
2009-04-02 21:10 . 2009-04-14 21:07 -------- d-----w c:\windows\system32\SupportAppXL
2009-04-02 19:44 . 2009-04-02 19:44 3302841 ----a-w c:\windows\system32\شكرا أبا متعب.scr
2009-04-02 19:44 . 2009-04-10 18:49 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\Axialis
2009-03-31 19:23 . 2009-03-31 19:23 0 ----a-w c:\windows\DTRUQAH.INI
2009-03-28 18:08 . 2009-03-28 18:08 62976 ----a-w c:\windows\PegtopUI.exe
2009-03-27 12:08 . 2009-03-27 12:08 0 ----a-w c:\windows\CPC10QA4.INI
2009-03-26 17:35 . 2009-03-26 17:35 -------- d-----w c:\documents and settings\user\Application Data\Nitro PDF
2009-03-26 17:27 . 2009-03-26 17:27 -------- d-----w c:\documents and settings\All Users\Application Data\Nitro PDF
2009-03-26 17:26 . 2009-03-26 17:26 -------- d-----w c:\windows\Downloaded Installations
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-22 20:29 . 2009-02-14 17:33 114512 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 20:29 . 2009-02-14 18:04 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-22 20:28 . 2009-02-14 18:04 2136096 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-22 20:28 . 2009-02-14 18:04 18816 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-22 20:26 . 2009-02-14 18:04 524320 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-22 20:26 . 2009-02-14 18:04 3920 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-22 19:44 . 2001-09-19 11:00 70390 ----a-w c:\windows\system32\perfc001.dat
2009-04-22 19:44 . 2001-09-19 11:00 370226 ----a-w c:\windows\system32\perfh001.dat
2009-04-21 19:17 . 2009-04-21 19:17 -------- d-----w c:\program files\FormatFactory
2009-04-17 19:21 . 2009-02-14 19:01 -------- d-----w c:\program files\Internet Download Manager
2009-04-17 19:19 . 2009-02-14 19:01 -------- d-----w c:\documents and settings\user\Application Data\IDM
2009-04-17 19:19 . 2009-02-14 19:01 -------- d-----w c:\documents and settings\user\Application Data\DMCache
2009-04-16 22:11 . 2009-03-03 20:06 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-16 21:20 . 2009-04-16 21:20 -------- d-----w c:\program files\LSoft Technologies
2009-04-16 21:20 . 2009-02-14 18:54 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-10 14:52 . 2009-03-05 20:17 -------- d-----w c:\program files\Investintech.com Inc
2009-04-07 19:53 . 2009-04-07 19:53 -------- d-----w c:\program files\My Company Name
2009-04-02 20:08 . 2009-02-14 20:28 -------- d-----w c:\documents and settings\user\Application Data\PC Suite
2009-04-02 19:44 . 2009-04-02 19:44 -------- d-----w c:\program files\
2009-03-30 14:36 . 2009-02-14 18:52 -------- d-----w c:\program files\Circle Developement
2009-03-30 14:12 . 2009-03-29 19:27 -------- d-----w c:\program files\WinClear
2009-03-28 18:07 . 2009-03-28 18:07 -------- d-----w c:\program files\Pegtop
2009-03-26 16:38 . 2009-03-26 16:38 -------- d-----w c:\program files\MSECache
2009-03-25 16:06 . 2009-02-14 19:03 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-03-20 16:48 . 2009-03-20 16:48 -------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-03-20 16:48 . 2009-03-20 16:48 127 ----a-w c:\documents and settings\user\Local Settings\Application Data\fusioncache.dat
2009-03-20 15:09 . 2009-02-15 15:36 -------- d-----w c:\program files\HP
2009-03-20 15:08 . 2009-03-20 15:08 -------- d-----w c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-03-20 15:07 . 2009-03-20 14:12 -------- d--h--w c:\program files\Avago-HP
2009-03-19 14:39 . 2009-03-19 13:28 -------- d-----w c:\program files\Clean Disk Security
2009-03-17 17:30 . 2009-03-17 17:30 -------- d-----w c:\program files\GetData
2009-03-17 14:14 . 2009-02-14 17:24 23380 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-15 19:51 . 2009-03-15 19:38 -------- d-----w c:\program files\AnyReader
2009-03-13 12:13 . 2009-03-13 11:18 -------- d-----w c:\program files\AskBarDis
2009-03-13 11:55 . 2009-02-14 18:52 -------- d-----w c:\documents and settings\user\Application Data\StupidMath
2009-03-13 11:18 . 2009-03-13 11:18 -------- d-----w c:\program files\Foxit Software
2009-03-13 11:18 . 2009-03-13 11:18 -------- d-----w c:\documents and settings\user\Application Data\Foxit
2009-03-09 21:47 . 2009-03-02 19:56 -------- d-----w c:\program files\USB Disk Security
2009-03-06 15:52 . 2009-03-06 15:52 -------- d-----w c:\program files\psconvert
2009-03-04 12:05 . 2009-03-04 12:05 -------- d-----w c:\documents and settings\user\Application Data\Investintech
2009-03-03 20:06 . 2009-03-03 20:05 -------- d-----w c:\program files\PDF to Word
2009-02-26 22:14 . 2009-02-14 18:56 -------- d-----w c:\program files\Google
2009-02-22 23:35 . 2009-02-14 20:28 -------- d-----w c:\documents and settings\user\Application Data\Nokia
2009-02-17 23:06 . 2009-02-14 17:27 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-15 15:47 . 2009-02-15 15:35 112858 ----a-w c:\windows\hpoins07.dat
2009-02-15 12:44 . 2009-02-15 12:44 268 ---ha-w C:\sqmdata09.sqm
2009-02-15 12:44 . 2009-02-15 12:44 244 ---ha-w C:\sqmnoopt09.sqm
2009-02-15 07:07 . 2009-02-15 07:07 268 ---ha-w C:\sqmdata08.sqm
2009-02-15 07:07 . 2009-02-15 07:07 244 ---ha-w C:\sqmnoopt08.sqm
2009-02-15 05:54 . 2009-02-15 05:54 268 ---ha-w C:\sqmdata07.sqm
2009-02-15 05:54 . 2009-02-15 05:54 244 ---ha-w C:\sqmnoopt07.sqm
2009-02-14 20:34 . 2009-02-14 20:34 268 ---ha-w C:\sqmdata06.sqm
2009-02-14 20:34 . 2009-02-14 20:34 244 ---ha-w C:\sqmnoopt06.sqm
2009-02-14 20:00 . 2009-02-14 20:00 190640 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-02-14 19:57 . 2009-02-14 19:57 268 ---ha-w C:\sqmdata05.sqm
2009-02-14 19:57 . 2009-02-14 19:57 244 ---ha-w C:\sqmnoopt05.sqm
2009-02-14 19:37 . 2009-02-14 19:37 268 ---ha-w C:\sqmdata04.sqm
2009-02-14 19:37 . 2009-02-14 19:37 244 ---ha-w C:\sqmnoopt04.sqm
2009-02-14 19:28 . 2009-02-14 19:28 268 ---ha-w C:\sqmdata03.sqm
2009-02-14 19:28 . 2009-02-14 19:28 244 ---ha-w C:\sqmnoopt03.sqm
2009-02-14 19:11 . 2009-02-14 19:11 268 ---ha-w C:\sqmdata02.sqm
2009-02-14 19:11 . 2009-02-14 19:11 244 ---ha-w C:\sqmnoopt02.sqm
2009-02-14 19:03 . 2009-02-14 19:03 73216 ----a-w c:\windows\ST6UNST.EXE
2009-02-14 19:03 . 2009-02-14 19:03 172032 ----a-w c:\windows\Setup1.exe
2009-02-14 19:00 . 2009-02-14 19:00 268 ---ha-w C:\sqmdata01.sqm
2009-02-14 19:00 . 2009-02-14 19:00 244 ---ha-w C:\sqmnoopt01.sqm
2009-02-14 18:58 . 2009-02-14 18:58 90112 ----a-w c:\windows\system32\agsaami.dll
2009-02-14 18:58 . 2009-02-14 18:58 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-02-14 18:58 . 2009-02-14 18:58 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-02-14 18:58 . 2009-02-14 18:58 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-02-14 18:58 . 2009-02-14 18:58 1986560 ----a-w c:\windows\system32\akll.dll
2009-02-14 18:58 . 2009-02-14 18:58 196608 ----a-w c:\windows\system32\maag.dll
2009-02-14 18:58 . 2009-02-14 18:58 1245184 ----a-w c:\windows\system32\bkll.dll
2009-02-14 18:58 . 2009-02-14 18:58 1212416 ----a-w c:\windows\system32\ckll.dll
2009-02-14 18:56 . 2009-02-14 18:56 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-02-14 18:56 . 2009-02-14 18:56 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-02-14 18:53 . 2009-02-14 18:53 47104 ----a-w c:\windows\AKDeInstall.exe
2009-02-14 18:52 . 2009-02-14 18:52 268 ---ha-w C:\sqmdata00.sqm
2009-02-14 18:52 . 2009-02-14 18:52 244 ---ha-w C:\sqmnoopt00.sqm
2009-02-14 18:27 . 2009-02-14 18:27 2232 ----a-w c:\windows\java\Packages\Data\2XZDNFLZ.DAT
2009-02-14 18:27 . 2009-02-14 18:27 155995 ----a-w c:\windows\java\Packages\MDB713LV.ZIP
2009-02-14 18:27 . 2009-02-14 18:27 2678 ----a-w c:\windows\java\Packages\Data\97B7PJDR.DAT
2009-02-14 18:27 . 2009-02-14 18:27 2678 ----a-w c:\windows\java\Packages\Data\7DFNP7XJ.DAT
2009-02-14 18:26 . 2009-02-14 18:26 2678 ----a-w c:\windows\java\Packages\Data\UZNVRV17.DAT
2009-02-14 18:26 . 2009-02-14 18:26 2678 ----a-w c:\windows\java\Packages\Data\MKSH7BHN.DAT
2009-02-14 18:26 . 2009-02-14 18:26 2678 ----a-w c:\windows\java\Packages\Data\KONVRBHV.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 09:58 333192 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-08-16 5728112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-14 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-14 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Taskman"=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\CNAB4RPK.EXE"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-14 33808]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6130a4c1-081e-11de-b4c6-0018dede1ecf}]
\Shell\AutoRun\command - F:\1utbfd.bat
\Shell\open\Command - F:\1utbfd.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6138ba9c-0354-11de-b4b3-0018dede1ecf}]
\Shell\Auto\command - auto.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
\Shell\explore\Command - asneg.com
\Shell\open\Command - asneg.com
.
Contents of the 'Scheduled Tasks' folder
2009-04-20 c:\windows\Tasks\WebReg psc 1400 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2005-05-11 21:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-22 23:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):5d,f5,3a,53,a9,58,29,6e,81,f0,43,5c,24,5c,e5,91,7c,c8,f3,95,1d,
0a,49,38,0f,0c,a9,6d,54,58,f3,71,05,2f,12,29,34,d6,1c,e4,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{bf3e163e-b920-426e-8aa9-66dd293fb054}]
@Denied: (Full) (Everyone)
"Model"=dword:0000006a
"Therad"=dword:00000015
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3972)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\windows\system32\Msi.dll
c:\program files\Common Files\Microsoft Shared\Web Components\10\1025\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1025\OWCI11.DLL
c:\windows\system32\shdoclc.dll
c:\progra~1\MICROS~2\OFFICE11\MCPS.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\windows\system32\CNAB4RPK.EXE
c:\windows\system32\spool\drivers\w32x86\3\HP1006MC.EXE
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 2009-04-22 23:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-22 20:31
Pre-Run: 15,949,377,536 bytes free
Post-Run: 16,858,402,816 bytes free
250
k:
