ComboFix 09-04-27.02 - Administrator 01/01/2004 3:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1025.18.1015.594 [GMT 2:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
c:\windows\system32\pthreadGC2.dll
.
((((((((((((((((((((((((( Files Created from 2003-0-13-01 to 2004-1-1 )))))))))))))))))))))))))))))))
.
2009-01-25 23:06 . 2009-01-25 23:06 720896 ----a-w c:\windows\iun6002.exe
2009-01-25 23:06 . 2009-01-25 23:06 -------- d-----w c:\program files\Abadisoft
2009-01-25 12:02 . 2009-01-25 12:02 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-01-25 12:02 . 2009-01-25 12:02 -------- d-----w c:\program files\Google
2009-01-25 11:56 . 2009-01-25 11:56 -------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2009-01-25 11:54 . 2007-12-24 11:47 7680 ----a-w c:\windows\system32\ff_vfw.dll
2009-01-25 11:54 . 2007-11-29 10:52 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-25 11:54 . 2007-11-29 10:52 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-25 11:54 . 2009-01-25 11:54 -------- d-----w c:\program files\ffdshow
2009-01-25 11:53 . 2009-01-25 11:53 -------- d-----w c:\program files\CCleaner
2009-01-25 11:49 . 2009-01-25 11:49 -------- d-----w c:\windows\system32\ar-sa
2009-01-25 09:58 . 2009-01-25 11:33 10520 ----a-w c:\windows\system32\avgrsstx.dll
2009-01-25 09:58 . 2009-01-25 11:33 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-01-25 09:58 . 2009-01-25 11:33 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-01-25 09:58 . 2009-01-25 11:33 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-25 09:58 . 2003-12-31 22:04 -------- d-----w c:\windows\system32\drivers\Avg
2009-01-25 09:58 . 2009-01-25 11:55 -------- d-----w c:\documents and settings\Administrator\Application Data\AVGTOOLBAR
2009-01-24 20:46 . 2009-01-24 20:46 -------- d-s---w c:\documents and settings\Administrator\UserData
2009-01-24 20:24 . 2009-01-24 20:24 -------- d-----w c:\documents and settings\Administrator\Contacts
2009-01-24 17:32 . 2009-01-24 17:32 -------- d-----w c:\program files\AVG
2009-01-24 17:32 . 2009-01-25 11:33 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-24 17:28 . 2009-01-24 17:28 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-01-22 14:39 . 2009-01-22 14:49 206256 ----a-w c:\windows\system32\idmmbc.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-26 20:51 . 2009-01-26 20:51 2232 ----a-w c:\windows\java\Packages\Data\JJTRPZRF.DAT
2009-01-26 20:51 . 2009-01-26 20:51 155995 ----a-w c:\windows\java\Packages\MQB5FRHF.ZIP
2009-01-26 20:51 . 2009-01-26 20:51 2678 ----a-w c:\windows\java\Packages\Data\17F3NJNR.DAT
2009-01-26 20:51 . 2009-01-26 20:51 2678 ----a-w c:\windows\java\Packages\Data\OHBJVLZ7.DAT
2009-01-26 20:51 . 2009-01-26 20:51 2678 ----a-w c:\windows\java\Packages\Data\UJLFP7RR.DAT
2009-01-26 20:51 . 2009-01-26 20:51 2678 ----a-w c:\windows\java\Packages\Data\KBF3VV9R.DAT
2009-01-26 20:51 . 2009-01-26 20:51 2678 ----a-w c:\windows\java\Packages\Data\DZHZT7TV.DAT
2009-01-25 12:13 . 2009-01-01 00:24 -------- d-----w c:\program files\JetAudio
2009-01-01 00:44 . 2009-01-01 00:44 73728 ----a-w c:\windows\ALCFDRTM.EXE
2009-01-01 00:30 . 2009-01-01 00:30 -------- d-----w c:\program files\Circle Developement
2009-01-01 00:30 . 2009-01-01 00:30 -------- d-----w c:\program files\Messenger Plus! Live
2009-01-01 00:29 . 2009-01-01 00:29 -------- d-----w c:\program files\Windows Live
2009-01-01 00:26 . 2009-01-01 00:25 -------- d-----w c:\program files\Internet Download Manager
2009-01-01 00:24 . 2009-01-01 00:24 -------- d-----w c:\program files\Common Files\COWON
2009-01-01 00:24 . 2008-12-31 23:39 -------- d--h--w c:\program files\InstallShield Installation Information
2009-01-01 00:24 . 2008-12-31 23:39 -------- d-----w c:\program files\Common Files\InstallShield
2008-12-31 23:59 . 2008-12-31 23:59 -------- d-----w c:\program files\Soft4Ever
2008-12-31 23:57 . 2008-12-31 23:57 -------- d-----w c:\program files\PowerMenu
2008-12-31 23:57 . 2008-12-31 23:57 -------- d-----w c:\program files\Folderico
2008-12-31 23:57 . 2001-09-19 16:00 58586 ----a-w c:\windows\system32\perfc001.dat
2008-12-31 23:57 . 2001-09-19 16:00 328222 ----a-w c:\windows\system32\perfh001.dat
2008-12-31 23:39 . 2008-12-31 23:39 -------- d-----w c:\program files\Realtek
2008-12-31 22:57 . 2008-12-31 22:57 -------- d-----w c:\program files\microsoft frontpage
2008-12-31 22:52 . 2001-09-19 16:00 67 --sha-w c:\windows\Fonts\desktop.ini
2008-12-31 22:52 . 2008-12-31 22:52 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2008-12-31 22:50 . 2008-12-31 22:50 22144 ----a-w c:\windows\system32\emptyregdb.dat
2007-12-08 04:39 . 2007-10-12 10:33 28672 ----a-w c:\windows\system32\vb6lib.dll
2007-08-16 14:17 . 2007-08-16 14:17 51568 ----a-w c:\windows\system32\sirenacm.dll
2007-08-13 16:54 . 2006-09-12 03:53 818688 ----a-w c:\windows\system32\wininet.dll
2007-08-13 16:54 . 2004-08-04 01:55 413696 ----a-w c:\windows\system32\vbscript.dll
2007-08-13 16:54 . 2001-09-19 16:00 156160 ----a-w c:\windows\system32\msls31.dll
2007-08-13 16:45 . 2004-08-04 01:55 78336 ----a-w c:\windows\system32\ieencode.dll
2007-08-13 16:44 . 2004-08-04 01:55 40960 ----a-w c:\windows\system32\licmgr10.dll
2007-08-13 16:42 . 2004-08-04 01:55 17408 ----a-w c:\windows\system32\corpol.dll
2007-08-13 16:39 . 2004-08-04 01:55 71680 ----a-w c:\windows\system32\admparse.dll
2007-08-13 16:39 . 2004-08-04 01:55 55296 ----a-w c:\windows\system32\iesetup.dll
2007-08-13 16:36 . 2004-08-04 01:55 36352 ----a-w c:\windows\system32\imgutil.dll
2007-08-13 16:32 . 2004-08-04 01:56 45568 ----a-w c:\windows\system32\mshta.exe
2007-08-13 16:01 . 2004-08-04 01:53 48128 ----a-w c:\windows\system32\mshtmler.dll
2007-05-17 15:07 . 2007-05-17 15:07 53325 ----a-w c:\windows\system32\btfunc.dll
2007-05-11 01:10 . 2007-05-11 01:10 34704 ----a-w c:\windows\system32\drivers\blueletaudio.sys
2007-05-08 23:59 . 2007-05-08 23:59 15632 ----a-w c:\windows\system32\btinstall.dll
2007-05-08 23:59 . 2007-05-08 23:59 36496 ----a-w c:\windows\system32\drivers\btcusb.sys
2007-03-05 04:00 . 2007-03-05 04:00 27792 ----a-w c:\windows\system32\drivers\BlueletSCOAudio.sys
2007-03-05 03:59 . 2007-03-05 03:59 18320 ----a-w c:\windows\system32\drivers\btnetdrv.sys
2007-03-05 03:57 . 2007-03-05 03:57 19472 ----a-w c:\windows\system32\drivers\VHIDMini.sys
2007-03-05 03:56 . 2007-03-05 03:56 35600 ----a-w c:\windows\system32\drivers\BTHidMgr.sys
2007-03-05 03:55 . 2007-03-05 03:55 20880 ----a-w c:\windows\system32\drivers\vbtenum.sys
2007-03-05 03:53 . 2007-03-05 03:53 44304 ----a-w c:\windows\system32\drivers\VcommMgr.sys
2007-03-05 03:52 . 2007-03-05 03:52 34448 ----a-w c:\windows\system32\drivers\VComm.sys
2007-02-12 15:55 . 2004-01-01 00:37 692224 ----a-w c:\windows\system32\hsys30.dll
2007-01-12 03:22 . 2007-01-12 03:22 40960 ----a-w c:\windows\system32\drivers\SCTray.exe
2006-11-21 20:41 . 2006-11-21 20:41 22416 ----a-w c:\windows\system32\drivers\BTNetFilter.sys
2006-09-12 11:34 . 2006-09-12 11:34 982528 ----a-w c:\windows\system32\syssetup.dll
2006-09-12 11:19 . 2006-09-12 11:19 130560 ----a-w c:\windows\system32\logonui.exe
2006-09-12 08:39 . 2006-09-12 08:39 3114496 ----a-w c:\windows\system32\winntbbu.dll
2006-09-12 03:53 . 2006-09-12 03:53 140288 ----a-w c:\windows\system32\sfc_os.dll
2006-09-12 03:53 . 2006-09-12 03:53 72704 ----a-w c:\windows\system32\hlink.dll
2006-09-12 03:53 . 2008-12-31 22:50 679424 ----a-w c:\windows\system32\inetcomm.dll
2006-09-12 03:33 . 2006-09-12 03:33 746496 ----a-w c:\windows\system32\zipfldr.dll
2006-09-12 03:32 . 2006-09-12 03:32 33792 ----a-w c:\windows\system32\wupdmgr.exe
2006-09-12 03:32 . 2008-12-31 22:51 125208 ----a-w c:\windows\system32\wuauclt.exe
2006-09-12 03:31 . 2006-09-12 03:31 151552 ----a-w c:\windows\system32\wscript.exe
2006-09-12 03:31 . 2006-09-12 03:31 8192 ----a-w c:\windows\system32\wpabaln.exe
2006-09-12 03:31 . 2008-12-31 22:49 72704 ----a-w c:\windows\system32\winchat.exe
2006-09-12 03:31 . 2006-09-12 03:31 689152 ----a-w c:\windows\system32\wiashext.dll
2006-09-12 03:30 . 2006-09-12 03:30 790528 ----a-w c:\windows\system32\wiaacmgr.exe
2006-09-12 03:30 . 2006-09-12 03:30 53248 ----a-w c:\windows\system32\utilman.exe
2006-09-12 03:29 . 2006-09-12 03:29 291328 ----a-w c:\windows\system32\syncui.dll
2006-09-12 03:29 . 2006-09-12 03:29 52224 ----a-w c:\windows\system32\syncapp.exe
2006-09-12 03:29 . 2006-09-12 03:29 103424 ----a-w c:\windows\system32\stobject.dll
2006-09-12 03:28 . 2008-12-31 22:49 159232 ----a-w c:\windows\system32\sndvol32.exe
2006-09-12 03:28 . 2008-12-31 22:49 134144 ----a-w c:\windows\system32\sndrec32.exe
2006-09-12 03:28 . 2006-09-12 03:28 931840 ----a-w c:\windows\system32\shimgvw.dll
2006-09-12 03:27 . 2006-09-12 03:27 45056 ----a-w c:\windows\system32\rcimlby.exe
2006-09-12 03:27 . 2006-09-12 03:27 293376 ----a-w c:\windows\system32\osk.exe
2006-09-12 03:26 . 2009-01-01 00:44 70656 ----a-w c:\windows\NOTEPAD.EXE
2006-09-12 03:26 . 2006-09-12 03:26 70656 ----a-w c:\windows\system32\notepad.exe
2006-09-12 03:26 . 2006-09-12 03:26 1923072 ----a-w c:\windows\system32\netshell.dll
2006-09-12 03:26 . 2006-09-12 03:26 57344 ----a-w c:\windows\system32\narrator.exe
2006-09-12 03:26 . 2006-09-12 03:26 83456 ----a-w c:\windows\system32\mydocs.dll
2006-09-12 03:26 . 2008-12-31 22:49 662016 ----a-w c:\windows\system32\mstsc.exe
2006-09-12 03:25 . 2008-12-31 22:50 331776 ----a-w c:\windows\system32\mstask.dll
2006-09-12 03:25 . 2008-12-31 22:49 389120 ----a-w c:\windows\system32\mspaint.exe
2006-09-12 03:25 . 2006-09-12 03:25 128512 ----a-w c:\windows\system32\msiexec.exe
2006-09-12 03:25 . 2006-09-12 03:25 2122240 ----a-w c:\windows\system32\msgina.dll
2006-09-12 03:16 . 2008-12-31 22:50 172544 ----a-w c:\windows\pchealth\helpctr\binaries\msconfig.exe
2006-09-12 03:15 . 2006-09-12 03:15 200192 ----a-w c:\windows\system32\moricons.dll
2006-09-12 03:15 . 2006-09-12 03:15 340480 ----a-w c:\windows\system32\mobsync.exe
2006-09-12 03:15 . 2006-09-12 03:15 55296 ----a-w c:\windows\system32\migpwd.exe
2006-09-12 03:14 . 2006-09-12 03:14 75776 ----a-w c:\windows\system32\magnify.exe
2006-09-12 03:13 . 2006-09-12 03:13 401920 ----a-w c:\windows\system32\fontext.dll
2006-09-12 03:12 . 2006-09-12 03:12 1616384 ----a-w c:\windows\explorer.exe
2006-09-12 03:12 . 2006-09-12 03:12 108032 ----a-w c:\windows\system32\dfrgres.dll
2006-09-12 03:12 . 2006-09-12 03:12 391680 ----a-w c:\windows\system32\cmd.exe
2006-09-12 03:12 . 2008-12-31 22:49 83968 ----a-w c:\windows\system32\charmap.exe
2006-09-12 03:11 . 2008-12-31 22:49 947984 ----a-w c:\windows\system32\calc.exe
2006-09-12 03:11 . 2006-09-12 03:11 91648 ----a-w c:\windows\system32\cabview.dll
2006-09-12 03:11 . 2006-09-12 03:11 43008 ----a-w c:\windows\system32\batmeter.dll
2006-09-12 03:11 . 2006-09-12 03:11 100864 ----a-w c:\windows\system32\ahui.exe
.
------- Sigcheck -------
[-] 2006-01-27 18:45 576512 C287C8218DAC8EE3AEF1FB2018064699 c:\windows\system32\user32.dll
[-] 2006-09-12 04:22 2196608 E2E05AC6E25670D9A9F592E3E223B92D c:\windows\system32\ntkrnlpa.exe
[-] 2006-09-08 23:01 2321024 EF63859E4FD9CB3EC31A111481F4B1B6 c:\windows\system32\ntoskrnl.exe
[-] 2006-09-12 03:12 1616384 810316E2E8D32075C8B984320A6011CF c:\windows\explorer.exe
[-] 2006-07-01 10:50 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\system32\spoolsv.exe
[-] 2006-09-12 03:32 125208 B79383100A456E981C5ABA1BEAD8B035 c:\windows\system32\wuauclt.exe
[-] 2006-09-12 03:52 1353216 09C097450F5C7415E4AC441172ED4F61 c:\windows\system32\kernel32.dll
[-] 2006-07-01 10:59 1547776 5839C7D4FA3AE3ACEB7422829B010900 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-01 2745776]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-01-25 171448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-05-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-05-06 118784]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-25 1932568]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-09-10 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-09-15 2557952]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
"MPlayer2_FixUp"="c:\windows\inf\unregmp2.exe" [2006-05-10 180736]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 24576]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-01-25 11:33 10520 ----a-w c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil_.exe"=
R3 FXDRV;FXDRV; [x]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-01-25 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-01-25 325640]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-01-25 108552]
S1 HMFAxCore56d706f6725c732df006697fd5ec3381;HMFAxCore56d706f6725c732df006697fd5ec3381;c:\windows\system32\drivers\HMFAxCore56d706f6725c732df006697fd5ec3381.sys [2004-01-01 15872]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-01-25 908056]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-25 298264]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{993060dc-d79c-11dd-966d-806d6172696f}]
\Shell\AutoRun\command - G:\setup.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2004-01-01 03:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{112f2fe1-8638-423a-b114-69f685616903}]
@Denied: (Full) (Everyone)
"Model"=dword:0000016c
"Therad"=dword:00000001
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,97,ef,15,4c,15,04,a1,41,07,d0,42,05,ee,1e,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):37,0d,6a,43,e1,2e,ac,72,00,0e,20,8d,f2,0d,c6,ea,22,6f,b9,c7,a6,
98,94,86,2b,89,5b,8e,15,84,e3,d3,3b,d0,db,0b,e4,86,3b,45,00,00,00,00,00,00,\
.
Completion time: 2004-01-01 3:55
ComboFix-quarantined-files.txt 2004-01-01 01:55
Pre-Run: 35,786,358,784 bytes free
Post-Run: 35,825,717,248 bytes free
239
