ComboFix 09-05-17.03 - jws 05/23/2009 16:26.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.479.122 [GMT 3:00]
Running from: c:\documents and settings\jws\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((( Files Created from 2009-04-23 to 2009-05-23 )))))))))))))))))))))))))))))))
.
2009-05-23 03:57 . 2009-05-23 03:57 -------- d-----w c:\program files\MSXML 4.0
2009-05-22 23:47 . 2009-05-22 23:55 -------- d-----w c:\documents and settings\jws\Application Data\FairStars Audio Converter
2009-05-22 12:51 . 2009-05-23 12:39 -------- d-----w C:\Temp
2009-05-22 12:39 . 2009-05-14 16:57 204800 ----a-w c:\windows\system32\nspupdtxml.dll
2009-05-22 08:44 . 2009-05-22 08:44 -------- d-----w c:\program files\Lion King
2009-05-19 17:23 . 2001-08-17 11:02 9600 -c--a-w c:\windows\system32\dllcache\hidusb.sys
2009-05-19 17:23 . 2001-08-17 11:02 9600 ----a-w c:\windows\system32\drivers\hidusb.sys
2009-05-19 12:22 . 2005-01-04 00:43 4682 ----a-w c:\windows\system32\npptNT2.sys
2009-05-19 12:22 . 2009-05-19 12:22 -------- d-----w c:\program files\Common Files\INCA Shared
2009-05-19 11:18 . 2009-05-19 11:18 -------- d-----w c:\program files\Game Power 7
2009-05-18 05:45 . 2009-05-18 05:45 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-18 05:45 . 2009-05-18 05:45 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-18 05:45 . 2009-05-18 05:45 -------- d-----w c:\documents and settings\jws\Application Data\SUPERAntiSpyware.com
2009-05-18 05:44 . 2009-05-18 05:44 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-16 02:35 . 2009-05-16 02:35 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-16 02:09 . 2003-02-28 15:26 139536 ----a-w c:\windows\system32\javaee.dll
2009-05-15 06:15 . 2009-05-15 06:15 -------- d-----w c:\program files\Common Files\xing shared
2009-05-14 18:25 . 2009-05-15 19:41 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-14 17:51 . 2009-05-19 10:40 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-14 17:51 . 2009-05-14 17:51 -------- d-----w c:\program files\Nsasoft
2009-05-14 01:53 . 2009-02-09 11:48 2059264 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-05-14 01:53 . 2009-02-09 11:48 2017280 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-14 01:53 . 2009-02-09 11:48 2182016 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-14 01:52 . 2009-02-09 11:48 2137600 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-14 00:32 . 2008-06-14 17:59 271616 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-14 00:32 . 2008-06-14 17:59 271616 ------w c:\windows\system32\drivers\bthport.sys
2009-05-14 00:29 . 2008-10-24 11:10 453632 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-13 23:55 . 2009-05-13 23:55 -------- d-----w c:\documents and settings\jws\Application Data\CyberScrub
2009-05-13 23:54 . 2009-05-14 00:14 -------- d-----w c:\documents and settings\jws\Application Data\cleaner
2009-05-13 22:42 . 2008-10-16 11:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-05-13 22:42 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-05-13 13:38 . 2009-05-13 13:38 -------- d-----w c:\documents and settings\jws\Local Settings\Application Data\Conduit
2009-05-13 13:38 . 2009-05-13 13:38 -------- d-----w c:\program files\Conduit
2009-05-13 13:38 . 2009-05-13 13:38 -------- d-----w c:\documents and settings\jws\Application Data\4shared Desktop
2009-05-13 04:18 . 2003-08-15 11:55 348160 ----a-w c:\windows\system32\eSellerateEngine.dll
2009-05-13 04:18 . 2009-05-13 04:19 -------- d-----w c:\program files\Acoustica MP3 Audio Mixer
2009-05-13 04:00 . 2009-05-13 04:00 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-05-12 17:27 . 2009-05-17 11:57 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-12 14:22 . 2009-05-12 14:22 -------- d-----w c:\documents and settings\jws\Application Data\vlc
2009-05-12 10:11 . 2009-05-12 10:11 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-05-12 09:56 . 2009-05-19 12:10 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-12 09:50 . 2009-05-22 14:18 -------- d-----w c:\documents and settings\jws\Tracing
2009-05-12 09:48 . 2006-11-29 10:06 3426072 ----a-w c:\windows\system32\d3dx9_32.dll
2009-05-12 09:48 . 2009-05-12 09:48 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-05-12 09:46 . 2009-05-12 09:46 -------- d-----w c:\program files\Microsoft
2009-05-12 09:45 . 2009-05-12 09:45 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-12 09:45 . 2009-05-12 09:48 -------- d-----w c:\program files\Windows Live
2009-05-12 09:42 . 2009-05-12 09:42 -------- d-----w c:\program files\Common Files\Windows Live
2009-05-12 04:31 . 2009-05-12 04:31 -------- d-----w c:\documents and settings\jws\Application Data\COWON
2009-05-12 04:12 . 2008-10-16 11:09 43544 ----a-w c:\windows\system32\wups2.dll
2009-05-12 02:29 . 2009-05-18 10:41 -------- d-----w c:\documents and settings\jws\Application Data\IDM
2009-05-12 02:29 . 2009-05-23 13:30 -------- d-----w c:\documents and settings\jws\Application Data\DMCache
2009-05-12 02:29 . 2009-05-12 04:00 -------- d-----w c:\program files\Internet Download Manager
2009-05-11 20:50 . 2009-05-11 20:51 -------- d-----w c:\documents and settings\jws\Contacts
2009-05-11 17:52 . 2009-05-11 17:52 0 ----a-w c:\windows\nsreg.dat
2009-05-11 17:52 . 2009-05-11 17:52 -------- d-----w c:\documents and settings\jws\Local Settings\Application Data\Mozilla
2009-05-11 16:56 . 2009-05-12 10:20 -------- d-----w c:\documents and settings\jws\Local Settings\Application Data\Google
2009-05-11 16:44 . 2009-05-12 10:19 -------- d-----w c:\program files\Google
2009-05-11 16:33 . 2009-05-11 16:52 -------- d-----w c:\documents and settings\jws\Application Data\Paltalk
2009-05-11 16:33 . 2009-05-11 16:33 -------- d-----w c:\windows\PaltalkScene
2009-05-11 16:33 . 2009-05-11 16:34 -------- d-----w c:\program files\Paltalk Messenger
2009-05-10 17:37 . 2009-05-10 17:37 -------- d-----w c:\documents and settings\jws\Local Settings\Application Data\Stardock
2009-05-10 17:26 . 2009-05-10 17:34 -------- d-----w c:\windows\Icon_Patcher
2009-05-10 17:25 . 2009-05-10 17:25 -------- d-----w c:\program files\MSECache
2009-05-10 17:06 . 2009-05-20 14:43 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-10 17:06 . 2009-05-20 14:43 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-10 17:05 . 2009-05-23 09:26 1172000 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-10 17:05 . 2009-05-23 09:26 311328 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-10 17:05 . 2009-05-10 17:05 -------- d-----w c:\program files\Kaspersky Lab
2009-05-10 17:05 . 2009-05-23 09:28 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-10 16:50 . 2009-05-15 00:05 -------- d-----w c:\windows\system32\ar-sa
2009-05-10 16:48 . 2008-07-09 07:34 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-10 16:48 . 2009-05-15 00:11 -------- d--h--w c:\windows\$hf_mig$
2009-05-10 16:43 . 2009-05-10 16:43 -------- d-----w c:\program files\Common FilesMicrosoft Shared
2009-05-10 16:43 . 1998-06-17 21:00 89360 ----a-w c:\windows\system32\VB5DB.DLL
2009-05-10 16:43 . 2009-05-10 16:43 -------- d-----w c:\program files\tringkeyboard
2009-05-10 16:42 . 2009-05-10 16:42 47104 ------w c:\windows\AKDeInstall.exe
2009-05-10 16:42 . 2009-05-10 16:42 -------- d-----w c:\program files\mpegable
2009-05-10 16:42 . 2009-05-10 16:42 -------- d-----w c:\program files\VideoLAN
2009-05-10 16:21 . 2009-05-10 16:21 -------- d-----w c:\windows\speech
2009-05-10 16:20 . 2009-05-10 16:20 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-05-10 16:19 . 2009-05-10 16:19 172032 ------w c:\windows\Setup1.exe
2009-05-10 16:19 . 2009-05-10 16:19 73216 ----a-w c:\windows\ST6UNST.EXE
2009-05-10 16:18 . 2009-05-10 16:18 196608 ----a-w c:\windows\system32\maag.dll
2009-05-10 16:18 . 2009-05-10 16:18 1212416 ----a-w c:\windows\system32\ckll.dll
2009-05-10 16:18 . 2009-05-10 16:18 1245184 ----a-w c:\windows\system32\bkll.dll
2009-05-10 16:18 . 2009-05-10 16:18 1986560 ----a-w c:\windows\system32\akll.dll
2009-05-10 16:18 . 2009-05-10 16:18 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-05-10 16:18 . 2009-05-10 16:18 90112 ----a-w c:\windows\system32\agsaami.dll
2009-05-10 16:18 . 2009-05-10 16:18 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-05-10 16:18 . 2009-05-10 16:18 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-05-10 16:18 . 2009-05-10 16:18 53760 ----a-w c:\windows\system\ppacklib.dll
2009-05-10 16:18 . 2009-05-10 16:18 -------- d-----w c:\windows\system32\RMBin
2009-05-10 16:18 . 2009-05-10 16:18 -------- d-----w c:\program files\Real_SC
2009-05-10 16:16 . 2009-05-21 13:01 10 ----a-w c:\windows\popcinfo.dat
2009-05-10 16:16 . 2009-05-10 16:16 -------- d-----w c:\program files\PopCap Games
2009-05-10 16:15 . 2009-05-10 16:15 -------- d-----w c:\program files\Quran_in_Word
2009-05-10 16:12 . 2009-05-15 06:14 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-10 16:12 . 2009-05-15 06:15 -------- d-----w c:\program files\Common Files\Real
2009-05-10 16:12 . 2009-05-10 16:13 -------- d-----w c:\program files\Real
2009-05-10 15:58 . 2003-04-29 18:07 306688 ----a-w c:\windows\IsUninst.exe
2009-05-10 15:58 . 2009-05-10 15:58 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-10 15:56 . 2009-05-10 15:56 -------- d-----w c:\program files\Macromedia
2009-05-10 15:45 . 2009-05-10 15:45 -------- d-----w c:\program files\CyberLink
2009-05-10 15:38 . 2009-05-10 15:38 -------- d-----w c:\documents and settings\jws\Application Data\BSplayer Pro
2009-05-10 15:38 . 2009-05-10 15:38 -------- d-----w c:\documents and settings\jws\Application Data\BSplayer
2009-05-10 15:38 . 2009-05-10 15:38 -------- d-----w c:\program files\Webteh
2009-05-10 15:27 . 2009-05-11 16:21 -------- d-----w c:\documents and settings\jws\Local Settings\Application Data\Adobe
2009-05-10 15:26 . 2009-05-10 15:59 -------- d-----w c:\program files\Common Files\Adobe
2009-05-10 15:11 . 2007-01-20 18:26 1565480 ----a-w c:\windows\system32\wmv9vcm.dll
2009-05-10 15:11 . 2006-11-01 11:52 765952 ----a-w c:\windows\system32\xvidcore.dll
2009-05-10 15:11 . 2006-11-01 11:54 180224 ----a-w c:\windows\system32\xvidvfw.dll
2009-05-10 15:11 . 2007-01-30 03:03 3596288 ----a-w c:\windows\system32\qt-dx331.dll
2009-05-10 15:11 . 2007-01-30 03:03 200704 ----a-w c:\windows\system32\ssldivx.dll
2009-05-10 15:11 . 2007-01-30 03:03 1044480 ----a-w c:\windows\system32\libdivx.dll
2009-05-10 15:11 . 2007-01-30 02:56 73728 ----a-w c:\windows\system32\dpl100.dll
2009-05-10 15:11 . 2007-01-30 02:56 196608 ----a-w c:\windows\system32\dtu100.dll
2009-05-10 15:11 . 2007-02-01 02:56 639066 ----a-w c:\windows\system32\divx.dll
2009-05-10 15:11 . 2007-01-09 15:46 10752 ----a-w c:\windows\system32\ff_vfw.dll
2009-05-10 15:11 . 2009-05-15 06:14 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-10 15:11 . 2009-05-10 15:11 -------- d-----w c:\program files\K-Lite Codec Pack
2009-05-10 14:32 . 2004-08-03 20:08 26496 -c--a-w c:\windows\system32\dllcache\usbstor.sys
2009-05-10 14:32 . 2009-05-10 14:32 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-10 14:01 . 2007-04-09 10:23 28040 ----a-w c:\windows\system32\mdimon.dll
2009-05-10 14:00 . 2009-05-10 14:00 -------- d-----w c:\program files\Microsoft.NET
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-23 09:26 . 2009-05-10 17:05 2144 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-23 09:26 . 2009-05-10 17:05 10236 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-14 16:49 . 2009-05-22 12:39 393216 ----a-w c:\windows\system32\nspcrypt.dll
2009-05-13 14:54 . 2009-05-22 12:39 80672 ----a-w c:\windows\system32\TKFsFt2k.sys
2009-05-13 14:54 . 2009-05-22 12:39 76764 ----a-w c:\windows\system32\TKFsFtNt4.sys
2009-05-13 14:54 . 2009-05-22 12:39 63610 ----a-w c:\windows\system32\TKRgAcNt4.sys
2009-05-13 14:54 . 2009-05-22 12:39 60960 ----a-w c:\windows\system32\TKFsFt2k64.sys
2009-05-13 14:54 . 2009-05-22 12:39 60448 ----a-w c:\windows\system32\TKRgAc2k64.sys
2009-05-13 14:54 . 2009-05-22 12:39 41984 ----a-w c:\windows\system32\TKRgAc2k.sys
2009-05-13 14:54 . 2009-05-22 12:39 40574 ----a-w c:\windows\system32\TKRgFtNt4.sys
2009-05-13 14:54 . 2009-05-22 12:39 35872 ----a-w c:\windows\system32\TKRgFtXp64.sys
2009-05-13 14:54 . 2009-05-22 12:39 25984 ----a-w c:\windows\system32\TKRgFt2k.sys
2009-05-13 14:54 . 2009-05-22 12:39 24576 ----a-w c:\windows\system32\TKRgFtXp.sys
2009-05-12 04:31 . 2009-05-10 15:53 -------- d-----w c:\program files\JetAudio
2009-05-11 11:41 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-10 17:26 . 2004-08-03 21:55 218624 ----a-w c:\windows\system32\uxtheme.dll
2009-05-10 17:26 . 2004-08-03 21:56 1949184 ----a-w c:\windows\system32\logonui.exe
2009-05-10 15:54 . 2009-05-10 15:53 -------- d-----w c:\program files\The KMPlayer
2009-05-09 20:23 . 2009-05-09 19:47 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-09 19:53 . 2009-05-09 19:53 -------- d-----w c:\program files\Silicon Integrated Systems
2009-05-09 19:50 . 2009-05-09 19:48 -------- d-----w c:\program files\SiS VGA Utilities V3.61a
2009-05-09 17:39 . 2009-05-09 17:39 -------- d-----w c:\program files\microsoft frontpage
2009-05-09 17:35 . 2009-05-09 17:35 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-28 07:22 . 2009-05-22 12:40 242176 ----a-w c:\windows\system32\TKTool64.dll
2009-04-28 07:22 . 2009-05-22 12:40 188416 ----a-w c:\windows\system32\TKTool.dll
2009-04-21 06:06 . 2009-05-22 12:40 51370 ----a-w c:\windows\system32\TKFsAvNt4.sys
2009-04-21 06:06 . 2009-05-22 12:40 46624 ----a-w c:\windows\system32\TKFsAv2k64.sys
2009-04-21 06:06 . 2009-05-22 12:40 31488 ----a-w c:\windows\system32\TKFsAv2k.sys
2009-04-21 06:06 . 2009-05-22 12:39 88864 ----a-w c:\windows\system32\TKFsAc2k.sys
2009-04-21 06:06 . 2009-05-22 12:39 163488 ----a-w c:\windows\system32\TKFsAcNt4.sys
2009-04-21 06:06 . 2009-05-22 12:39 107040 ----a-w c:\windows\system32\TKFsAc2k64.sys
2009-04-09 11:14 . 2009-05-22 12:40 344064 ----a-w c:\windows\system32\TKFsAv.dll
2009-04-09 11:14 . 2009-05-22 12:40 324096 ----a-w c:\windows\system32\TKFsAv64.dll
2009-04-09 11:14 . 2009-05-22 12:39 199168 ----a-w c:\windows\system32\TKFsAc64.dll
2009-04-09 11:14 . 2009-05-22 12:39 192512 ----a-w c:\windows\system32\TKRgAc64.dll
2009-04-09 11:14 . 2009-05-22 12:39 185344 ----a-w c:\windows\system32\TKRgFt64.dll
2009-04-09 11:14 . 2009-05-22 12:39 155648 ----a-w c:\windows\system32\TKFsAc.dll
2009-04-09 11:14 . 2009-05-22 12:39 147456 ----a-w c:\windows\system32\TKRgAc.dll
2009-04-09 11:14 . 2009-05-22 12:39 143360 ----a-w c:\windows\system32\TKRgFt.dll
2009-03-26 15:35 . 2009-05-07 07:42 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-03-13 21:25 . 2009-04-25 03:55 25088 ----a-w c:\windows\system32\msxml3a.dll
2009-03-06 14:44 . 2004-08-03 21:55 282624 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:06 . 2004-08-03 21:55 826368 ----a-w c:\windows\system32\wininet.dll
.
------- Sigcheck -------
[-] 2009-05-10 17:31 1655296 2FD48AAEAEC9C891F72277BBE701F5DB c:\windows\explorer.exe
[-] 2008-04-14 15:59 1031168 CA3445DCE9EB70A2CA2504E0AF5C543F c:\windows\SoftwareDistribution\Download\b86141217825998609b93e71cc29eb6e\explorer.exe
[-] 2009-05-10 17:31 1655296 2FD48AAEAEC9C891F72277BBE701F5DB c:\windows\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((( SnapShot_2009-05-18_05.12.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-12-01 21:08 . 2006-12-01 21:08 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 21:26 . 2006-12-01 21:26 57856 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 21:25 . 2006-12-01 21:25 69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2008-09-30 13:45 . 2008-09-30 13:45 91656 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2009-05-22 12:40 . 2008-06-02 14:24 39048 c:\windows\system32\TKToolNt4.sys
+ 2009-05-22 12:40 . 2008-06-02 14:25 28696 c:\windows\system32\TKTool2k64.sys
+ 2009-05-22 12:40 . 2008-06-02 14:23 18048 c:\windows\system32\TKTool2k.sys
+ 2009-05-22 12:40 . 2009-05-14 16:57 45056 c:\windows\system32\nspavcr.dll
+ 2009-05-22 12:40 . 2009-05-14 16:49 61440 c:\windows\system32\nspavcm.dll
+ 2003-04-18 13:29 . 2003-04-18 13:29 82432 c:\windows\system32\msxml4r.dll
- 2009-05-12 16:21 . 2009-05-12 16:21 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-05-12 16:21 . 2009-05-18 21:26 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-05-22 12:40 . 2009-02-15 16:06 39936 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspclsvc.dll
+ 2009-05-18 05:45 . 2009-05-18 05:45 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2009-05-18 05:45 . 2009-05-18 05:45 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2009-05-23 03:57 . 2009-05-23 03:57 32768 c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
+ 2009-05-22 12:39 . 2009-02-15 16:06 290816 c:\windows\system32\WINHTTP5.DLL
+ 2009-05-22 12:39 . 2009-01-14 12:44 184832 c:\windows\system32\TKFsFt64.dll
+ 2009-05-22 12:39 . 2009-01-14 12:44 143360 c:\windows\system32\TKFsFt.dll
+ 2009-05-22 12:40 . 2009-01-14 12:44 233565 c:\windows\system32\TKFsAvHook.dll
+ 2009-05-22 12:39 . 2009-05-14 16:55 606208 c:\windows\system32\nspupdt.dll
+ 2009-05-22 12:40 . 2009-05-14 16:49 155648 c:\windows\system32\nspsysopt.dll
+ 2009-05-22 12:39 . 2009-05-14 16:50 208896 c:\windows\system32\nspmainxml.dll
+ 2009-05-22 12:39 . 2009-05-14 18:34 864256 c:\windows\system32\nsplic.dll
+ 2009-05-22 12:39 . 2009-05-15 10:39 524288 c:\windows\system32\nspcutil.dll
+ 2009-05-22 12:40 . 2009-05-15 10:39 454656 c:\windows\system32\nspavxml.dll
+ 2009-02-15 16:06 . 2009-02-15 16:06 290816 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\WINHTTP5.DLL
+ 2009-05-22 12:40 . 2009-05-15 10:40 813600 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspupsvc.exe
+ 2009-05-22 12:40 . 2009-05-15 10:40 641568 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspupcpy.exe
+ 2009-05-22 12:39 . 2009-05-15 10:40 354848 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspsvc.exe
+ 2009-05-22 12:39 . 2009-05-15 10:39 462848 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspsvc.dll
+ 2009-05-22 12:39 . 2009-05-14 16:49 102400 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspregwsc.dll
+ 2009-05-22 12:40 . 2009-05-15 10:40 557056 c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspavsvc.dll
+ 2009-05-22 12:39 . 2009-02-15 16:06 172032 c:\windows\system32\dzip32.dll
+ 2009-05-22 12:39 . 2009-02-15 16:06 139264 c:\windows\system32\dunzip32.dll
+ 2006-12-01 21:25 . 2006-12-01 21:25 1093120 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 21:25 . 2006-12-01 21:25 1101824 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2008-09-30 13:42 . 2008-09-30 13:42 1286152 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2009-05-22 12:39 . 2009-02-15 16:06 1511424 c:\windows\system32\sn3win.dll
+ 2008-09-30 13:43 . 2008-09-30 13:43 1286152 c:\windows\system32\msxml4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-07 2807216]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-14 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSRaid"="c:\program files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe" [2004-12-22 892928]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-05-11 206088]
"VistaStart1.3"="c:\windows\Resources\Themes\Vista_Anthracite\VistaStart\VistaStart1.3.exe" [2006-03-20 510464]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-15 198160]
"nProtect Security Platform 2007"="c:\documents and settings\jws\سطح المكتب\rappelz\مجلد جديد\nspmain.exe" [2009-05-15 911904]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-12-01 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-10 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-5-9 331776]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 09:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4830:UDP"= 4830:UDP:Windows Media Format SDK (firefox.exe)
"4831:UDP"= 4831:UDP:Windows Media Format SDK (firefox.exe)
"4832:UDP"= 4832:UDP:Windows Media Format SDK (firefox.exe)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [14/05/2009 02:22 م 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [14/05/2009 02:22 م 72944]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [14/05/2009 02:22 م 7408]
R3 TKFsFt;TKFsFt;c:\windows\system32\TKFsFt2k.sys [22/05/2009 03:39 م 80672]
R3 TKRgFt;TKRgFt;c:\windows\system32\TKRgFtXp.sys [22/05/2009 03:39 م 24576]
S2 gupdate1c9d2e9ef8fb89a;خدمة تحديث Google (gupdate1c9d2e9ef8fb89a);c:\program files\Google\Update\GoogleUpdate.exe [12/05/2009 01:10 م 133104]
S2 NSPService;nProtect Security Platform 2007 Service;c:\windows\system32\INCAInternet\nProtect Security Platform 2007\nspsvc.exe [22/05/2009 03:39 م 354848]
S3 TKFsAc;TKFsAc;c:\windows\system32\TKFsAc2k.sys [22/05/2009 03:39 م 88864]
S3 TKFsAv;TKFsAv;c:\windows\system32\TKFsAv2k.sys [22/05/2009 03:40 م 31488]
S3 TKRgAc;TKRgAc;c:\windows\system32\TKRgAc2k.sys [22/05/2009 03:39 م 41984]
.
Contents of the 'Scheduled Tasks' folder
2009-05-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-12 10:10]
2009-05-23 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-23 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
.
.
------- Supplementary Scan -------
.
uStart Page =
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\jws\Application Data\Mozilla\Firefox\Profiles\
0p1wnn5g.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://ar.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:ar
fficial
FF - component: c:\documents and settings\jws\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-23 16:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{34facb95-2fc1-4c94-9946-07fb4cddfaab}]
@Denied: (Full) (Everyone)
"Model"=dword:0000008e
"Therad"=dword:0000000c
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):9f,08,31,ac,5d,24,ec,7b,54,fd,9d,e5,cd,66,3f,1c,d2,ad,ae,2a,8c,
c8,65,aa,19,9a,d3,2a,39,d3,5a,b1,9c,06,7f,d9,1a,15,5d,62,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(804)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\cscui.dll
.
Completion time: 2009-05-23 16:32
ComboFix-quarantined-files.txt 2009-05-23 13:32
ComboFix2.txt 2009-05-18 05:14
ComboFix3.txt 2009-05-13 22:41
Pre-Run: 7,823,384,576 bytes free
Post-Run: 7,835,787,264 bytes free
348 --- E O F --- 2009-05-23 03:57
