ComboFix 09-04-23.A3 - user 04/25/2009 23:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.479.186 [GMT 3:00]
Running from: c:\documents and settings\user\سطح المكتب\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
AV: Bitdefender Antivirus *On-access scanning disabled* (Outdated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.
2009-04-24 23:44 . 2009-04-25 01:11 -------- d--h--w C:\$AVG8.VAULT$
2009-04-24 22:59 . 2009-04-24 23:01 -------- dc-h--w c:\windows\ie8
2009-04-24 22:43 . 2009-04-24 22:43 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-04-24 22:43 . 2009-04-24 22:43 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-04-24 22:43 . 2009-04-24 22:43 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-24 22:43 . 2009-04-25 15:19 -------- d-----w c:\windows\system32\drivers\Avg
2009-04-24 22:42 . 2009-04-24 22:42 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-24 21:40 . 2009-03-08 01:32 1985024 ----a-w c:\windows\system32\dllcache\iertutil.dll
2009-04-24 21:40 . 2009-03-08 01:31 59904 ----a-w c:\windows\system32\dllcache\icardie.dll
2009-04-24 21:40 . 2009-03-08 01:31 55296 ----a-w c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-24 21:40 . 2009-02-20 10:20 13824 ------w c:\windows\system32\dllcache\ieudinit.exe
2009-04-24 21:40 . 2009-03-08 01:32 594432 ----a-w c:\windows\system32\dllcache\msfeeds.dll
2009-04-24 21:40 . 2009-03-08 11:30 1466368 ----a-w c:\windows\system32\dllcache\ieframe.dll.mui
2009-04-24 21:40 . 2009-02-06 18:07 3698584 ----a-w c:\windows\system32\dllcache\ieapfltr.dat
2009-04-24 21:40 . 2009-03-08 01:11 445952 ----a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-04-24 21:40 . 2009-03-08 01:39 11063808 ----a-w c:\windows\system32\dllcache\ieframe.dll
2009-04-24 20:19 . 2009-02-05 21:55 31704 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-04-24 20:13 . 2001-09-18 10:29 96704 ----a-w c:\windows\system32\drivers\b57xp32.sys
2009-04-22 11:32 . 2009-04-22 11:32 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-21 03:35 . 2009-04-25 14:42 110 ----a-w c:\windows\cdplayer.ini
2009-04-20 20:43 . 2009-04-20 20:43 -------- d-----w c:\documents and settings\LocalService\سطح المكتب
2009-04-20 19:42 . 2009-04-20 19:42 603904 ----a-w c:\windows\system32\TUProgSt.exe
2009-04-20 19:42 . 2008-11-12 13:44 27904 ----a-w c:\windows\system32\uxtuneup.dll
2009-04-20 19:42 . 2009-04-20 19:42 362240 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-04-20 19:15 . 2009-04-20 19:15 -------- d-----w c:\documents and settings\user\Application Data\TuneUp Software
2009-04-20 19:15 . 2009-04-20 19:15 -------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-04-20 19:14 . 2009-04-20 19:14 -------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-04-20 19:11 . 2009-04-20 19:11 -------- d--h--w c:\windows\system32\GroupPolicy
2009-04-17 20:58 . 2009-04-17 20:58 -------- d-sh--w c:\documents and settings\Administrator\IETldCache
2009-04-17 20:44 . 2009-04-17 20:44 81920 ----a-w c:\documents and settings\user\Application Data\ezpinst.exe
2009-04-17 20:44 . 2009-04-17 20:44 47360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-04-17 20:44 . 2009-04-17 20:44 47360 ----a-w c:\documents and settings\user\Application Data\pcouffin.sys
2009-04-17 20:44 . 2009-04-17 20:44 -------- d-----w c:\documents and settings\user\Application Data\Vso
2009-04-17 20:44 . 2006-09-16 16:44 314368 ----a-w c:\windows\system32\avisynth.dll
2009-04-17 20:44 . 2004-05-26 18:37 719872 ----a-w c:\windows\system32\devil.dll
2009-04-17 13:19 . 2009-04-17 13:19 2180082 ----a-w C:\1.3gp
2009-04-17 11:56 . 2003-06-22 23:44 1415680 ----a-w c:\windows\system32\WMV9VCM.dll
2009-04-17 11:56 . 2006-06-21 09:42 200704 ----a-w c:\windows\system32\ssldivx.dll
2009-04-17 11:56 . 2006-06-21 09:42 1044480 ----a-w c:\windows\system32\libdivx.dll
2009-04-17 11:56 . 2006-05-24 21:46 200704 ----a-w c:\windows\system32\dtu100.dll
2009-04-17 10:50 . 2009-04-17 10:50 0 ----a-w c:\windows\system32\mapisvc.inf
2009-04-17 02:42 . 2009-04-25 20:30 -------- d--h--w c:\documents and settings\Default User.WINDOWS.0
2009-04-17 02:42 . 2009-04-16 23:52 -------- d-----w c:\documents and settings\All Users.WINDOWS.0
2009-04-17 02:34 . 2009-04-17 00:00 -------- d-----w C:\WINDOWS.0
2009-04-17 01:09 . 2009-04-17 01:10 -------- d-----w C:\c7aef25f98e5c42bb57587dd87e0c971
2009-04-17 01:09 . 2009-04-17 01:09 -------- d-----w c:\windows\Crystal
2009-04-17 01:09 . 2009-04-17 01:09 -------- d-----w c:\windows\system32\Fonts
2009-04-17 01:03 . 2009-04-24 21:21 -------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-04-17 00:59 . 2009-04-17 00:59 -------- d-----w c:\documents and settings\user\Application Data\Bitdefender
2009-04-17 00:59 . 2009-04-17 00:59 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-04-17 00:47 . 2009-04-17 00:47 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\Real
2009-04-17 00:10 . 2006-09-01 13:14 65536 ----a-w c:\windows\system32\QuickTimeVR.qtx
2009-04-17 00:10 . 2006-09-01 13:14 49152 ----a-w c:\windows\system32\QuickTime.qts
2009-04-17 00:10 . 2006-05-13 20:16 118784 ----a-w c:\windows\system32\ac3acm.acm
2009-04-17 00:10 . 2009-04-17 00:46 -------- dc----w c:\windows\ie8(2)
2009-04-16 23:59 . 2009-04-16 23:57 -------- d-s---w c:\documents and settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Microsoft
2009-04-16 23:59 . 2009-04-16 23:59 -------- d-sh--w c:\documents and settings\NetworkService.NT AUTHORITY
2009-04-16 23:56 . 2009-04-16 23:57 -------- d-s---w c:\documents and settings\Default User.WINDOWS.0\Local Settings\Application Data\Microsoft
2009-04-16 23:52 . 2009-04-16 23:52 -------- d-sh--w c:\documents and settings\All Users.WINDOWS.0\DRM
2009-04-16 22:58 . 2001-07-21 11:23 8002 ----a-w c:\windows\system32\smtpctrs.h
2009-04-16 22:58 . 2001-07-21 11:23 773 ----a-w c:\windows\system32\ntfsdrct.h
2009-04-16 14:41 . 2009-04-17 00:49 -------- d-----w c:\documents and settings\user\Application Data\IDM(4)
2009-04-16 14:24 . 2009-04-16 14:24 512096 ----a-w c:\windows\system32\drivers\_mon.s00
2009-04-16 14:24 . 2009-04-16 14:24 15424 ----a-w c:\windows\system32\drivers\_od32drv.s00
2009-04-14 16:07 . 2009-04-17 00:58 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-14 08:27 . 2009-04-14 08:27 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\ESET
2009-04-14 07:36 . 2009-04-14 07:36 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-04-13 07:45 . 2009-04-17 01:03 -------- d-----w c:\documents and settings\All Users\Application Data\CyberLink(2)
2009-04-13 07:32 . 2009-04-17 01:04 -------- d-----w c:\documents and settings\user\Application Data\IDM(3)
2009-04-11 17:59 . 2009-04-17 15:12 81984 ----a-w c:\windows\system32\bdod.bin
2009-04-11 04:36 . 2009-04-17 01:07 -------- d-----w c:\documents and settings\user\Application Data\ErrorSweeper
2009-04-06 05:46 . 2009-01-10 03:50 -------- d--h--w C:\psp(2)
2009-04-05 14:49 . 2009-04-05 14:49 0 ----a-w c:\windows\nsreg.dat
2009-04-05 14:48 . 2009-04-05 14:48 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\Mozilla
2009-03-29 12:21 . 2009-03-29 12:21 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\Netlog
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 20:53 . 2009-02-22 00:11 -------- d-----w c:\documents and settings\user\Application Data\DMCache
2009-04-25 01:11 . 2009-04-14 12:50 -------- d-----w c:\program files\Video Convert Master
2009-04-25 00:29 . 2009-02-21 18:15 -------- d-----w c:\program files\Circle Developement
2009-04-24 22:42 . 2009-04-24 22:42 -------- d-----w c:\program files\AVG
2009-04-24 21:36 . 2009-01-10 03:48 -------- d-----w c:\documents and settings\user\Application Data\IDM
2009-04-24 21:18 . 2009-02-23 02:13 -------- d-----w c:\program files\Google
2009-04-24 21:15 . 2009-04-18 15:09 -------- d-----w c:\program files\ESET
2009-04-24 20:19 . 2009-04-17 00:47 -------- d-----w c:\program files\Hotspot Shield
2009-04-21 04:18 . 2009-04-21 04:18 -------- d-----w c:\program files\Common Files\xing shared
2009-04-21 04:18 . 2009-02-21 17:41 -------- d-----w c:\program files\Common Files\Real
2009-04-21 04:17 . 2003-03-18 16:14 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-21 03:34 . 2003-02-21 00:42 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-20 19:42 . 2009-04-20 19:15 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-04-19 22:04 . 2009-02-22 00:10 -------- d-----w c:\program files\Internet Download Manager
2009-04-17 21:17 . 2009-04-17 00:49 -------- d-----w c:\program files\IObit
2009-04-17 12:28 . 2009-04-17 12:28 -------- d-----w c:\program files\USB GATE
2009-04-17 11:56 . 2009-04-17 00:47 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-17 11:55 . 2009-04-17 00:46 -------- d-----w c:\program files\JetAudio
2009-04-17 11:01 . 2009-03-20 13:19 -------- d-----w c:\program files\Yahoo!
2009-04-17 01:10 . 2009-03-04 16:05 -------- d-----w c:\program files\Total Video Converter
2009-04-17 01:09 . 2009-04-05 14:48 -------- d-----w c:\program files\Mozilla Firefox(2)
2009-04-17 01:09 . 2009-02-22 05:57 -------- d-----w c:\documents and settings\user\Application Data\COWON
2009-04-17 01:09 . 2009-04-17 01:09 -------- d-----w c:\program files\Common Files\COWON
2009-04-17 01:09 . 2009-02-21 18:01 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-17 01:09 . 2009-04-17 01:09 -------- d-----w c:\program files\Netlog Music Tool
2009-04-17 01:09 . 2009-02-21 18:01 -------- d-----w c:\program files\CyberLink
2009-04-17 01:09 . 2009-02-21 17:51 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-17 01:09 . 2009-01-10 03:52 -------- d-----w c:\program files\JetAudio(3)
2009-04-17 01:09 . 2009-03-23 00:50 -------- d-----w c:\program files\Common Files\AVSMedia
2009-04-17 01:09 . 2009-03-23 00:50 -------- d-----w c:\program files\AVS4YOU
2009-04-17 01:08 . 2009-02-21 17:34 -------- d-----w c:\program files\GRETECH
2009-04-17 01:07 . 2009-02-21 18:15 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-17 01:04 . 2009-03-07 17:42 -------- d-----w c:\program files\NCC Education
2009-04-17 01:03 . 2009-02-21 18:04 -------- d-----w c:\program files\Common Files\Nero
2009-04-17 00:59 . 2009-04-17 00:49 -------- d-----w c:\program files\VS Revo Group
2009-04-17 00:58 . 2009-02-21 18:07 -------- d-----w c:\program files\Real_SC
2009-04-17 00:47 . 2009-04-17 00:47 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-04-17 00:46 . 2009-04-17 00:07 -------- d-----w c:\program files\JetAudio(2)(2)
2009-04-17 00:46 . 2009-04-17 00:10 -------- d-----w c:\program files\K-Lite Codec Pack(2)
2009-04-16 23:01 . 2001-09-19 18:00 81950 ----a-w c:\windows\system32\perfc001.dat
2009-04-16 23:01 . 2001-09-19 18:00 388386 ----a-w c:\windows\system32\perfh001.dat
2009-04-16 18:55 . 2009-04-16 16:44 0 ----a-w C:\dfinstall.log
2009-04-16 14:41 . 2009-04-10 01:24 -------- d-----w c:\program files\Common Files\BitDefender
2009-04-12 08:29 . 2009-02-21 22:21 187395 ----a-w C:\stInstall.log
2009-04-12 08:22 . 2009-02-21 22:22 14299 ----a-w C:\st330AdaptorMgr.log
2009-03-24 05:01 . 2009-03-24 04:02 4294 ----a-w C:\log.txt
2009-03-23 00:55 . 2009-03-23 00:55 -------- d-----w c:\documents and settings\user\Application Data\AVS4YOU
2009-03-23 00:55 . 2009-03-23 00:55 -------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2009-03-22 15:59 . 2009-03-22 15:59 557 ----a-w C:\TID29atsonline.log
2009-03-22 15:59 . 2009-03-22 15:59 557 ----a-w C:\atsonline.log
2009-03-22 15:35 . 2009-03-07 17:43 493568 ----a-w C:\ncceuro.mdb
2009-03-21 05:03 . 2009-03-20 12:52 -------- d-----w c:\program files\ObjectRescue Pro
2009-03-20 13:28 . 2009-03-20 13:28 -------- d-----w c:\documents and settings\user\Application Data\Yahoo!
2009-03-16 20:27 . 2009-02-23 04:22 -------- d-----w c:\program files\BitComet
2009-03-15 10:33 . 2009-03-15 10:33 -------- d-----w c:\documents and settings\user\Application Data\Media Player Classic
2009-03-14 19:32 . 2009-03-14 15:42 -------- d-----w c:\program files\XP Repair Pro 2007
2009-03-14 16:39 . 2009-03-14 16:32 6104 ----a-w c:\windows\BricoPackFoldersDelete.cmd
2009-03-14 16:39 . 2009-03-14 16:39 52821 ----a-w c:\windows\BricoPackUninst.cmd
2009-03-14 16:39 . 2008-05-07 05:09 218624 ----a-w c:\windows\system32\uxtheme.dll
2009-03-11 10:41 . 2009-02-21 18:21 249856 ------w c:\windows\Setup1.exe
2009-03-11 10:41 . 2009-02-21 18:21 73216 ----a-w c:\windows\ST6UNST.EXE
2009-03-11 10:34 . 2009-03-10 02:41 -------- d-----w c:\program files\Paltalk Messenger
2009-03-10 17:25 . 2009-03-10 17:24 -------- d-----w c:\program files\PrimerDB
2009-03-10 03:19 . 2009-03-10 03:19 2678 ----a-w c:\windows\java\Packages\Data\ID3PVF9J.DAT
2009-03-10 03:19 . 2009-03-10 03:19 2678 ----a-w c:\windows\java\Packages\Data\BJPBBJ71.DAT
2009-03-10 03:19 . 2009-03-10 03:19 2678 ----a-w c:\windows\java\Packages\Data\SEDVDVNR.DAT
2009-03-10 03:19 . 2009-03-10 03:19 2678 ----a-w c:\windows\java\Packages\Data\O01ZPB9Z.DAT
2009-03-10 03:19 . 2009-03-10 03:19 2678 ----a-w c:\windows\java\Packages\Data\DJRXB5NN.DAT
2009-03-10 02:05 . 2009-03-10 02:05 -------- d-----w c:\documents and settings\user\Application Data\ACD Systems
2009-03-09 19:54 . 2009-02-21 15:04 95608 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-09 12:01 . 2009-02-21 16:35 -------- d-----w c:\program files\Microsoft Works
2009-03-08 11:09 . 2007-08-13 15:43 638816 ----a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 11:09 . 2007-08-13 15:39 391536 ----a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 01:41 . 2007-08-13 15:54 5937152 ----a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-08 01:39 . 2008-05-07 05:08 11063808 ----a-w c:\windows\system32\ieframe(2)(2)(2).dll
2009-03-08 01:34 . 2008-05-07 05:08 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2008-05-07 05:08 914944 ----a-w c:\windows\system32\wininet(2)(2)(2).dll
2009-03-08 01:34 . 2007-08-13 15:54 914944 ----a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 01:34 . 2008-05-07 05:08 1206784 ----a-w c:\windows\system32\urlmon(2)(2)(2)(2).dll
2009-03-08 01:34 . 2007-08-13 15:54 1206784 ----a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 01:34 . 2007-08-13 15:54 236544 ----a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 01:34 . 2008-05-07 05:08 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:34 . 2007-08-13 15:44 43008 ----a-w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 01:34 . 2008-05-07 05:08 105984 ----a-w c:\windows\system32\url(2)(2)(2)(2).dll
2009-03-08 01:34 . 2007-08-13 15:44 105984 ----a-w c:\windows\system32\dllcache\url.dll
2009-03-08 01:34 . 2007-08-13 15:44 193536 ----a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 01:34 . 2007-08-13 15:44 109568 ----a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 01:33 . 2009-03-07 17:58 759296 ----a-w c:\windows\system32\dllcache\VGX.dll
2009-03-08 01:33 . 2008-05-07 05:08 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2007-08-13 15:42 18944 ----a-w c:\windows\system32\dllcache\corpol.dll
2009-03-08 01:33 . 2007-08-13 15:54 25600 ----a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 01:33 . 2008-05-09 10:53 726528 ----a-w c:\windows\system32\dllcache\jscript.dll
2009-03-08 01:33 . 2007-08-13 15:39 229376 ----a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 01:33 . 2008-05-09 10:53 420352 ----a-w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 01:33 . 2008-04-14 21:29 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:33 . 2007-08-13 15:39 125952 ----a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 01:32 . 2008-05-07 05:08 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2007-08-13 15:39 72704 ----a-w c:\windows\system32\dllcache\admparse.dll
2009-03-08 01:32 . 2007-08-13 15:39 173056 ----a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 01:32 . 2007-08-13 14:56 163840 ----a-w c:\windows\system32\dllcache\ieakui.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-04-24 20:19 204248 ----a-w c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-10-29 2606512]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2009\MemOptimizer.exe" [2008-11-20 155904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-21 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"GroupManager"="c:\program files\Total Video Converter\groupmanager.exe" [2009-03-18 32256]
"USB GATE"="c:\program files\USB GATE\USB GATE.exe" [2009-04-17 925696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-21 198160]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-24 1932568]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2004-12-28 544768]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-24 22:43 10520 ----a-w c:\windows\system32\avgrsstx.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Thomson SpeedTouch\\ST330\\service\\st330service.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11996:TCP"= 11996:TCP:BitComet 11996 TCP
"11996:UDP"= 11996:UDP:BitComet 11996 UDP
R2 gupdate1c9c33e198238a;خدمة تحديث Google (gupdate1c9c33e198238a);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-22 133104]
S0 ulsata2;ulsata2; [x]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-24 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-24 108552]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-24 298264]
S2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [2009-02-05 117208]
S2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2009-04-20 603904]
S3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\DRIVERS\HssDrv.sys [2009-02-05 31704]
S3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2009-02-21 30464]
S3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2009-02-21 12672]
S3 STETH;SpeedTouch Ethernet Adapter NT Driver;c:\windows\system32\DRIVERS\steth.sys [2009-02-21 40320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{040b3ab5-0422-11de-b1a3-000e50eae444}]
\Shell\AutoRun\command - zPharaoh.exe
\Shell\explore\command - zPharaoh.exe
\Shell\open\command - zPharaoh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-04-25 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 13:28]
2009-04-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-22 11:32]
2009-04-25 c:\windows\Tasks\User_Feed_Synchronization-{FA8D0ADC-7619-4086-BD8A-F8AD5DF6DE99}.job
- c:\windows\system32\msfeedssync.exe [2008-05-07 01:31]
2009-04-25 c:\windows\Tasks\الصيانة بنقرة واحدة.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 13:28]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {9B3843C1-7CDE-49C7-8641-674920712C60} = 212.119.64.2 212.119.64.3
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-25 23:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{13d5df11-bcfa-47ee-998c-dec9911cdbeb}]
@Denied: (Full) (Everyone)
"Model"=dword:0000006d
"Therad"=dword:00000001
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,63,79,71,b5,16,81,4c,9c,49,f5,68,62,d0,c2,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):61,bb,be,4d,82,f3,f4,1e,0e,ed,bb,ba,bd,c8,ff,9f,de,a5,ca,c7,04,
a0,6c,3e,fe,2d,f9,c1,df,c7,cc,85,f0,c1,fe,7f,f6,37,e2,8e,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(928)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-25 0:04
ComboFix-quarantined-files.txt 2009-04-25 21:03
ComboFix2.txt 2009-04-25 20:41
Pre-Run: 6,786,736,128 bytes free
Post-Run: 6,779,158,528 bytes free
312 --- E O F --- 2009-03-15 08:33
