ComboFix 09-04-25.01 - salmaa 04/24/2009 20:53.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.510.299 [GMT 2:00]
Running from: c:\documents and settings\salmaa\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-4-24 )))))))))))))))))))))))))))))))
.
2009-04-24 18:58 . 2009-04-24 18:58 -------- d-----w c:\windows\LastGood
2009-04-24 18:58 . 2009-04-24 18:58 -------- d-----w c:\windows\system32\xircom
2009-04-24 18:58 . 2009-04-24 18:58 -------- d-----w c:\windows\srchasst
2009-04-24 18:52 . 2009-04-24 18:52 -------- d-sh--w C:\Recycled
2009-04-24 18:29 . 2009-04-24 18:29 -------- d-----w c:\documents and settings\salmaa\Application Data\COWON
2009-04-24 17:14 . 2009-04-24 17:14 96976 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-24 17:14 . 2009-04-24 17:14 87855 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-24 17:13 . 2009-04-24 17:24 32 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-24 17:13 . 2009-04-24 17:24 32 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-24 17:13 . 2009-04-24 17:24 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-24 17:13 . 2009-04-24 17:24 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-24 17:13 . 2009-04-24 17:13 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-24 17:11 . 2009-04-24 17:11 -------- d-----w c:\documents and settings\salmaa\Application Data\TeraCopy
2009-04-24 17:08 . 2009-04-24 17:08 -------- d-----w c:\documents and settings\salmaa\Local Settings\Application Data\Conduit
2009-04-24 17:08 . 2009-04-24 17:08 -------- d-----w c:\documents and settings\salmaa\Local Settings\Application Data\ahlykoooramasrya
2009-04-24 17:05 . 2009-04-24 17:05 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 18:58 . 2009-04-24 18:58 -------- d-----w c:\program files\microsoft frontpage
2009-04-24 17:13 . 2009-04-24 17:13 -------- d-----w c:\program files\Kaspersky Lab
2009-04-24 17:11 . 2009-04-24 17:11 -------- d-----w c:\program files\KinG FM
2009-04-24 17:11 . 2009-04-24 17:11 -------- d-----w c:\program files\TeraCopy
2009-04-24 17:08 . 2009-04-24 17:08 -------- d-----w c:\program files\Yahoo!
2009-04-24 17:08 . 2009-04-24 17:08 -------- d-----w c:\program files\Conduit
2009-04-24 17:08 . 2009-04-24 17:08 -------- d-----w c:\program files\ahlykoooramasrya
2009-04-24 17:08 . 2009-04-24 17:08 -------- d-----w c:\program files\Internet Download Manager
2009-04-24 17:07 . 2009-04-24 17:07 -------- d-----w c:\documents and settings\salmaa\Application Data\InstallShield
2009-04-24 17:07 . 2009-04-24 17:07 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-24 17:05 . 2009-04-24 17:05 -------- d-----w c:\program files\FastFolders
2009-04-24 16:40 . 2009-04-24 16:39 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-24 16:35 . 2009-04-24 16:35 21640 ----a-w c:\windows\system32\emptyregdb.dat
.
------- Sigcheck -------
[-] 2006-09-08 23:02 2198144 BA08992ECFB4B23B9204ADD12AB385EA c:\windows\system32\ntkrnlpa.exe
[-] 2006-09-08 21:01 2321024 EF63859E4FD9CB3EC31A111481F4B1B6 c:\windows\system32\ntoskrnl.exe
[-] 2006-09-08 22:48 1616896 7F9583EFF8102BCE8BD6716744018F83 c:\windows\explorer.exe
[-] 2006-09-09 06:45 125720 B04B182A92C119511DD3CDBE18602DB1 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ef2809a-5964-4beb-b7d2-0f15117b356f}]
2008-09-15 04:47 1784856 ----a-w c:\program files\ahlykoooramasrya\tbahly.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1ef2809a-5964-4beb-b7d2-0f15117b356f}"= "c:\program files\ahlykoooramasrya\tbahly.dll" [2008-09-15 1784856]
[HKEY_CLASSES_ROOT\clsid\{1ef2809a-5964-4beb-b7d2-0f15117b356f}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1EF2809A-5964-4BEB-B7D2-0F15117B356F}"= "c:\program files\ahlykoooramasrya\tbahly.dll" [2008-09-15 1784856]
[HKEY_CLASSES_ROOT\clsid\{1ef2809a-5964-4beb-b7d2-0f15117b356f}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"f:\\program s\\xp\\New Folder\\WinRAR 3.71\\wrar371.exe"=
"f:\\program s\\xp\\zona\\ZonaNet Windows SP2 v1.0\\Internet\\idm.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
S3 abp470n5;abp470n5; [x]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - ABP470N5
.
Contents of the 'Scheduled Tasks' folder
2009-04-24 c:\windows\Tasks\User_Feed_Synchronization-{B8867CA2-B90B-44DC-8A58-F8E9D8F73F33}.job
- c:\windows\system32\msfeedssync.exe [2008-08-22 01:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.eg/
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-24 20:58
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3192)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Internet Download Manager\IDMan.exe
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-04-24 21:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-24 19:02
Pre-Run: 7,489,290,240 bytes free
Post-Run: 7,489,896,448 bytes free
142
