ComboFix 09-04-29.01 - Administrator 05/17/2009 5:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1014.583 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-5-17 )))))))))))))))))))))))))))))))
.
2009-05-17 02:39 . 2009-05-17 02:39 -------- d-----w c:\documents and settings\Administrator\Application Data\Desktopicon
2009-05-17 02:39 . 2009-05-17 02:39 -------- d-----w c:\program files\Unlocker
2009-05-17 00:58 . 2009-05-17 01:00 -------- d-----w c:\program files\Common Files\Adobe
2009-05-17 00:58 . 2009-05-17 00:58 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-17 00:58 . 2009-05-17 00:58 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-17 00:40 . 2009-05-17 00:40 -------- d--h--w c:\windows\PIF
2009-05-17 00:20 . 2009-05-17 00:21 -------- d-----w c:\program files\Common Files\delet
2009-05-16 19:21 . 2009-05-16 19:21 -------- d-sh--w c:\documents and settings\Administrator\IECompatCache
2009-05-16 19:20 . 2009-05-16 19:20 -------- d-----w c:\program files\CCleaner
2009-05-16 19:15 . 2009-05-16 19:25 -------- d-----w c:\documents and settings\Administrator\Application Data\QuickScan
2009-05-16 14:57 . 2009-05-16 14:57 -------- d-----w c:\program files\Windows Defender
2009-05-16 14:30 . 2009-05-16 14:30 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-16 14:30 . 2009-05-16 14:30 -------- d-sh--w c:\documents and settings\Administrator\IETldCache
2009-05-16 14:13 . 2006-06-29 10:07 14048 ------w c:\windows\system32\spmsg2.dll
2009-05-16 14:01 . 2009-05-16 14:11 -------- d-----w c:\windows\system32\XPSViewer
2009-05-16 14:01 . 2009-05-16 14:01 -------- d-----w c:\program files\MSBuild
2009-05-16 14:01 . 2009-05-16 14:01 -------- d-----w c:\program files\Reference Assemblies
2009-05-16 14:00 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-05-16 14:00 . 2008-07-06 12:06 89088 ------w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-05-16 14:00 . 2008-07-06 10:50 597504 ------w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-05-16 14:00 . 2008-07-06 12:06 575488 ------w c:\windows\system32\dllcache\xpsshhdr.dll
2009-05-16 14:00 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-05-16 14:00 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\dllcache\xpssvcs.dll
2009-05-16 14:00 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-05-16 13:52 . 2009-05-16 13:52 -------- d-----w c:\windows\ie8updates
2009-05-16 13:52 . 2009-04-25 05:30 102400 ------w c:\windows\system32\dllcache\iecompat.dll
2009-05-16 13:46 . 2009-05-16 13:52 -------- dc-h--w c:\windows\ie8
2009-05-16 11:14 . 2009-05-16 14:45 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-16 10:59 . 2009-05-16 14:40 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-16 10:59 . 2009-05-16 14:40 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-16 10:57 . 2009-05-17 02:30 978464 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-16 10:57 . 2009-05-17 02:30 163872 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-16 10:57 . 2009-05-16 10:57 -------- d-----w c:\program files\Kaspersky Lab
2009-05-16 10:57 . 2009-05-17 02:31 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-16 10:55 . 2009-05-16 10:55 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-16 10:46 . 2009-05-16 10:46 203776 ----a-w c:\windows\system32\clrviddc.dll
2009-05-16 10:39 . 2009-05-16 10:39 -------- d-----w c:\program files\Common Files\xing shared
2009-05-16 10:38 . 2009-05-16 10:38 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-16 10:38 . 2009-05-16 10:38 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-16 10:38 . 2009-05-16 10:39 -------- d-----w c:\program files\Common Files\Real
2009-05-16 10:38 . 2009-05-16 10:38 -------- d-----w c:\program files\Real
2009-05-16 10:22 . 2009-05-16 10:22 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\ACD Systems
2009-05-16 10:22 . 2009-05-16 10:22 -------- d-----w c:\documents and settings\Administrator\Application Data\ACD Systems
2009-05-16 10:21 . 2009-05-16 10:21 -------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-05-16 10:21 . 2009-05-16 10:21 -------- d-----w c:\program files\Common Files\ACD Systems
2009-05-16 10:21 . 2009-05-16 10:21 -------- d-----w c:\program files\ACD Systems
2009-05-16 09:57 . 2009-05-16 09:57 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Downloaded Installations
2009-05-16 09:57 . 2008-04-21 21:14 215040 ------w c:\windows\system32\dllcache\wordpad.exe
2009-05-16 09:55 . 2009-05-16 11:18 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-16 09:54 . 2008-12-11 10:57 333952 ------w c:\windows\system32\dllcache\srv.sys
2009-05-16 09:54 . 2009-05-16 18:34 -------- d-----w c:\documents and settings\Administrator\Tracing
2009-05-16 09:52 . 2009-05-16 09:52 -------- d-----w c:\program files\Microsoft
2009-05-16 09:52 . 2008-10-03 10:03 247326 ------w c:\windows\system32\dllcache\strmdll.dll
2009-05-16 09:51 . 2009-05-16 09:53 -------- d-----w c:\program files\Windows Live
2009-05-16 09:51 . 2008-10-24 11:21 455296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-16 09:50 . 2008-09-04 17:15 1106944 ------w c:\windows\system32\dllcache\msxml3.dll
2009-05-16 09:50 . 2008-10-15 16:35 337408 ------w c:\windows\system32\dllcache\netapi32.dll
2009-05-16 09:49 . 2008-05-01 14:34 331776 ------w c:\windows\system32\dllcache\msadce.dll
2009-05-16 09:48 . 2008-04-11 19:04 691712 ------w c:\windows\system32\dllcache\inetcomm.dll
2009-05-16 09:46 . 2009-03-08 01:33 759296 ----a-w c:\windows\system32\dllcache\VGX.dll
2009-05-16 09:45 . 2008-06-14 17:31 271616 ------w c:\windows\system32\dllcache\bthport.sys
2009-05-16 09:45 . 2008-06-14 17:31 271616 ------w c:\windows\system32\drivers\bthport.sys
2009-05-16 09:44 . 2008-05-08 14:02 203136 ------w c:\windows\system32\dllcache\rmcast.sys
2009-05-16 09:43 . 2009-05-16 09:43 -------- d-----w c:\program files\Common Files\Windows Live
2009-05-16 09:42 . 2009-05-16 09:42 0 ----a-w c:\windows\nsreg.dat
2009-05-16 09:42 . 2009-05-16 09:42 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-16 09:06 . 2001-08-17 13:59 3072 ----a-w c:\windows\system32\drivers\audstub.sys
2009-05-16 09:05 . 2008-04-14 21:07 57472 ----a-w c:\windows\system32\drivers\redbook.sys
2009-05-16 09:03 . 2001-08-17 13:46 6400 ----a-w c:\windows\system32\drivers\enum1394.sys
2009-05-16 09:02 . 2008-04-14 21:29 73728 ----a-w c:\windows\system32\usbui.dll
2009-05-16 09:01 . 2008-04-14 00:06 10240 ----a-w c:\windows\system32\drivers\compbatt.sys
2009-05-16 09:01 . 2008-04-14 21:05 16384 ----a-w c:\windows\system32\drivers\battc.sys
2009-05-16 09:01 . 2008-04-14 00:06 13952 ----a-w c:\windows\system32\drivers\CmBatt.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-17 02:36 . 2001-09-19 21:00 65404 ----a-w c:\windows\system32\perfc001.dat
2009-05-17 02:36 . 2001-09-19 21:00 361990 ----a-w c:\windows\system32\perfh001.dat
2009-05-17 02:30 . 2009-05-16 10:57 9772 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-17 02:30 . 2009-05-16 10:57 1640 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-17 02:25 . 2009-05-16 08:38 38624 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-16 14:40 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-16 08:23 . 2009-05-16 08:23 -------- d-----w c:\program files\Toshiba
2009-05-16 07:20 . 2009-05-16 06:17 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-16 06:20 . 2009-05-16 06:20 -------- d-----w c:\program files\Windows Media Connect 2
2009-05-16 06:18 . 2001-09-19 21:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-16 06:13 . 2009-05-16 06:13 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2008-05-07 08:08 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2008-05-07 08:08 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2008-05-07 08:08 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2008-04-15 00:29 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2008-05-07 08:08 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2008-05-07 08:08 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2008-05-07 08:08 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2008-05-07 08:08 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2008-05-07 08:08 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2008-05-07 08:08 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2008-04-15 00:29 283136 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-16 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-16 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-05-16 33808]
S0 ulsata2;ulsata2; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2D30B4B3-A75C-C964-51A6-EC3EDEF1B853}]
c:\program files\sys back\msnger.exe s
.
Contents of the 'Scheduled Tasks' folder
2009-05-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]
2009-05-17 c:\windows\Tasks\User_Feed_Synchronization-{4910CC4D-0A99-42C3-9745-93633420B84E}.job
- c:\windows\system32\msfeedssync.exe [2008-05-07 01:31]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\32fn55dz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\32fn55dz.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\32fn55dz.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-17 05:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3380)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-17 5:46
ComboFix-quarantined-files.txt 2009-05-17 02:46
Pre-Run: 36,222,111,744 bytes free
Post-Run: 36,218,695,680 bytes free
184
