هذا تقرير الاداة الاول
ComboFix 09-05-25.01 - I-R-I 05/25/2009 21:03.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.223.79 [GMT 3:00]
Running from: c:\documents and settings\I-R-I\سطح المكتب\منوعات\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\I-R-I\Local Settings\Temporary Internet Files\_tm39.tmp
.
((((((((((((((((((((((((( Files Created from 2009-04-25 to 2009-05-25 )))))))))))))))))))))))))))))))
.
2009-05-25 17:53 . 2009-05-25 17:53 32784 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\update\rollback\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-05-25 00:12 . 2009-05-25 17:17 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Internet Saving Optimizer
2009-05-25 00:10 . 2009-05-25 00:10 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Media Access Startup
2009-05-25 00:10 . 2009-05-25 00:10 -------- d-----w c:\program files\Media Access Startup
2009-05-25 00:09 . 2009-05-25 00:09 -------- d-----w c:\program files\System Search Dispatcher
2009-05-25 00:08 . 2009-05-25 00:08 -------- d-----w c:\program files\DoubleD
2009-05-25 00:08 . 2009-05-25 00:08 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\DoubleD
2009-05-24 07:23 . 2003-02-28 15:26 139536 ----a-w c:\windows\system32\javaee.dll
2009-05-23 20:26 . 2009-05-23 20:26 45056 ----a-r c:\documents and settings\I-R-I\Application Data\Microsoft\Installer\{E936802D-D59E-4FDC-9642-F8178F68BC1D}\NewShortcut11_E936802DD59E4FDC9642F8178F68BC1D.exe
2009-05-23 20:26 . 2009-05-23 20:26 45056 ----a-r c:\documents and settings\I-R-I\Application Data\Microsoft\Installer\{E936802D-D59E-4FDC-9642-F8178F68BC1D}\NewShortcut1_E936802DD59E4FDC9642F8178F68BC1D.exe
2009-05-23 20:26 . 2009-05-23 20:26 10134 ----a-r c:\documents and settings\I-R-I\Application Data\Microsoft\Installer\{E936802D-D59E-4FDC-9642-F8178F68BC1D}\ARPPRODUCTICON.exe
2009-05-23 10:46 . 2009-05-23 10:46 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Help
2009-05-21 01:13 . 2009-05-21 01:13 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-21 00:10 . 2009-03-24 13:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-21 00:10 . 2009-05-21 01:12 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-20 20:44 . 2009-05-20 20:44 -------- d-----w c:\program files\Conduit
2009-05-20 12:21 . 2009-05-20 12:21 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Conduit
2009-05-19 13:39 . 2009-05-20 20:44 -------- d-----w c:\program files\iVocalize Web Conference 4
2009-05-19 12:07 . 2009-05-19 12:09 811008 ----a-w c:\windows\AL-MOHAGR.scr
2009-05-19 02:43 . 2009-05-23 11:28 -------- d-----w c:\program files\a-squared Free
2009-05-18 11:59 . 2009-05-25 09:21 -------- d-----w c:\program files\Muslim Bag
2009-05-18 11:59 . 2009-05-18 11:59 -------- d-----w c:\windows\Muslim Bag
2009-05-16 07:30 . 2009-05-18 05:58 -------- d-----w c:\program files\LtUcx
2009-05-16 07:08 . 2009-05-16 07:08 -------- d-----w c:\program files\Domain Tools
2009-05-16 06:49 . 2009-05-25 17:19 -------- d-----w c:\program files\All2Chat
2009-05-14 09:21 . 2009-05-14 09:21 -------- d-----w c:\program files\BlazeVideo
2009-05-14 09:16 . 2009-05-20 00:00 10017 ----a-w c:\documents and settings\All Users\Application Data\BlazeVideo\VideoMagic3\BlazeVideoMagic.dll
2009-05-14 09:16 . 2009-05-19 04:23 -------- d-----w c:\program files\Blaze Video Magic
2009-05-14 09:16 . 2009-05-14 09:16 -------- d-----w c:\documents and settings\All Users\Application Data\BlazeVideo
2009-05-08 15:35 . 2009-05-08 15:36 53319 ----a-w c:\documents and settings\All Users\Application Data\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
2009-05-08 13:45 . 2009-05-08 13:49 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Google
2009-05-05 00:46 . 2009-05-05 00:46 196608 ----a-w c:\windows\system32\avisynth.dll
2009-05-05 00:46 . 2009-05-05 00:46 -------- d-----w c:\program files\DivXCodec
2009-05-05 00:46 . 2009-05-05 00:47 -------- d-----w c:\program files\GordianKnot
2009-05-05 00:46 . 2009-05-05 00:46 33280 ----a-w c:\windows\system32\HUFFYUV.DLL
2009-05-05 00:13 . 2009-05-09 09:59 -------- d-----w c:\documents and settings\I-R-I\Application Data\Thinstall
2009-05-05 00:13 . 2009-05-05 00:13 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Thinstall
2009-05-04 22:27 . 2009-05-04 22:27 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Identities
2009-05-04 04:54 . 2009-05-04 11:15 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Adobe
2009-05-04 00:05 . 2004-03-29 12:23 90112 ----a-w c:\windows\unvise32.exe
2009-05-04 00:05 . 2009-05-04 00:05 -------- d-----w c:\program files\Common Files\SWiSHzone.com
2009-05-04 00:05 . 2009-05-04 00:07 -------- d-----w c:\program files\SWiSH Max2
2009-05-03 08:11 . 2009-05-03 08:11 -------- d-----w c:\documents and settings\I-R-I\Application Data\Media Player Classic
2009-05-03 06:55 . 2009-05-08 15:35 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-03 06:44 . 2009-05-03 06:44 -------- d--h--w c:\windows\PIF
2009-05-03 01:02 . 2009-05-03 01:02 2967799 ----a-w c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-05-03 00:59 . 2009-05-03 00:59 -------- d-----w c:\documents and settings\I-R-I\Application Data\Malwarebytes
2009-05-03 00:59 . 2009-04-06 12:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-03 00:59 . 2009-04-06 12:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-03 00:59 . 2009-05-03 01:02 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-03 00:59 . 2009-05-03 00:59 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 20:55 . 2009-05-02 20:55 0 ----a-w c:\windows\nsreg.dat
2009-05-02 20:55 . 2009-05-02 20:55 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Mozilla
2009-05-02 13:51 . 2009-05-02 13:51 40960 ----a-r c:\documents and settings\I-R-I\Application Data\Microsoft\Installer\{C6E3BCF7-7F0E-4FDF-AA48-608F9687EDCD}\NewShortcut11_C6E3BCF77F0E4FDFAA48608F9687EDCD.exe
2009-05-02 13:51 . 2009-05-02 13:51 40960 ----a-r c:\documents and settings\I-R-I\Application Data\Microsoft\Installer\{C6E3BCF7-7F0E-4FDF-AA48-608F9687EDCD}\NewShortcut1_C6E3BCF77F0E4FDFAA48608F9687EDCD.exe
2009-05-02 13:51 . 2009-05-02 13:51 10134 ----a-r c:\documents and settings\I-R-I\Application Data\Microsoft\Installer\{C6E3BCF7-7F0E-4FDF-AA48-608F9687EDCD}\ARPPRODUCTICON.exe
2009-05-02 13:51 . 2009-05-23 20:25 -------- d-----w c:\program files\Samy Soft
2009-05-01 17:44 . 2008-06-14 17:59 271616 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-01 17:44 . 2008-06-14 17:59 271616 ------w c:\windows\system32\drivers\bthport.sys
2009-05-01 17:12 . 2009-02-09 11:48 2059264 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-05-01 17:12 . 2009-02-09 11:48 2017280 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-01 17:12 . 2009-02-09 11:48 2182016 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-01 17:12 . 2009-02-09 11:48 2137600 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-01 16:56 . 2008-10-24 11:10 453632 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-01 16:41 . 2009-05-04 21:41 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-01 14:49 . 2009-05-02 00:22 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-01 14:43 . 2008-07-09 07:34 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-01 14:43 . 2009-05-02 00:50 -------- d--h--w c:\windows\$hf_mig$
2009-05-01 14:30 . 2008-10-16 11:09 43544 ----a-w c:\windows\system32\wups2.dll
2009-05-01 14:27 . 2009-05-01 14:27 -------- d-s---w c:\documents and settings\I-R-I\UserData
2009-05-01 13:18 . 2009-05-23 03:40 -------- d-----w c:\documents and settings\I-R-I\Application Data\X-NetStat
2009-05-01 13:18 . 2009-05-01 13:18 -------- d-----w c:\program files\X-NetStat Professional
2009-05-01 09:53 . 2009-05-01 09:53 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-01 09:47 . 2009-05-25 17:28 -------- d-----w c:\documents and settings\I-R-I\Tracing
2009-05-01 09:45 . 2009-05-01 09:45 -------- d-----w c:\program files\Microsoft
2009-05-01 09:45 . 2009-05-01 09:45 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-01 00:55 . 2009-05-01 00:55 -------- d-----w c:\documents and settings\I-R-I\Application Data\COWON
2009-04-30 21:00 . 2009-04-30 21:00 -------- d-----w c:\documents and settings\I-R-I\Contacts
2009-04-30 19:37 . 2009-04-30 19:37 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-30 19:01 . 2004-08-03 21:55 21504 -c--a-w c:\windows\system32\dllcache\hidserv.dll
2009-04-30 19:01 . 2004-08-03 21:55 21504 ----a-w c:\windows\system32\hidserv.dll
2009-04-30 19:01 . 2004-08-03 21:45 14720 -c--a-w c:\windows\system32\dllcache\kbdhid.sys
2009-04-30 19:01 . 2004-08-03 21:45 14720 ----a-w c:\windows\system32\drivers\kbdhid.sys
2009-04-30 19:01 . 2001-09-18 10:38 12160 -c--a-w c:\windows\system32\dllcache\mouhid.sys
2009-04-30 19:01 . 2001-09-18 10:38 12160 ----a-w c:\windows\system32\drivers\mouhid.sys
2009-04-30 19:01 . 2001-08-17 11:02 9600 -c--a-w c:\windows\system32\dllcache\hidusb.sys
2009-04-30 19:01 . 2001-08-17 11:02 9600 ----a-w c:\windows\system32\drivers\hidusb.sys
2009-04-30 19:01 . 2004-08-03 20:08 31616 -c--a-w c:\windows\system32\dllcache\usbccgp.sys
2009-04-30 19:01 . 2004-08-03 20:08 31616 ----a-w c:\windows\system32\drivers\usbccgp.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 18:08 . 2009-05-25 17:23 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-25 18:08 . 2009-05-25 17:23 213024 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-25 18:08 . 2009-05-25 17:23 1808 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-25 18:07 . 2009-05-25 17:23 594976 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-25 18:07 . 2009-05-25 17:23 5728 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-25 17:53 . 2009-05-25 17:53 227344 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\update\rollback\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-05-25 17:53 . 2009-05-25 17:53 206088 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\update\rollback\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-05-25 17:53 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-25 17:53 . 2009-05-25 17:24 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-25 17:53 . 2009-05-25 17:24 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-25 17:53 . 2009-05-25 17:53 33808 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-05-25 17:53 . 2009-05-25 17:53 206088 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-05-25 17:53 . 2009-05-25 17:53 226832 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-05-25 17:32 . 2001-09-19 15:00 41076 ----a-w c:\windows\system32\perfc001.dat
2009-05-25 17:32 . 2001-09-19 15:00 254326 ----a-w c:\windows\system32\perfh001.dat
2009-05-25 17:23 . 2009-05-25 17:23 -------- d-----w c:\program files\Kaspersky Lab
2009-05-24 07:23 . 2009-05-24 07:23 2678 ----a-w c:\windows\java\Packages\Data\CRBZPFNR.DAT
2009-05-24 07:23 . 2009-05-24 07:23 2678 ----a-w c:\windows\java\Packages\Data\OMJ775RZ.DAT
2009-05-24 07:23 . 2009-05-24 07:23 2678 ----a-w c:\windows\java\Packages\Data\R53JRNB7.DAT
2009-05-24 07:23 . 2009-05-24 07:23 2678 ----a-w c:\windows\java\Packages\Data\Y8KTBR7J.DAT
2009-05-24 07:23 . 2009-05-24 07:23 2678 ----a-w c:\windows\java\Packages\Data\BF7HNFRD.DAT
2009-05-23 20:31 . 2009-04-30 15:08 -------- d-----w c:\documents and settings\I-R-I\Application Data\dvdcss
2009-05-23 10:04 . 2009-04-30 14:25 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-21 10:58 . 2009-04-30 15:02 -------- d-----w c:\program files\Google
2009-05-20 20:44 . 2009-04-30 14:54 -------- d-----w c:\program files\mpegable
2009-05-17 06:14 . 2009-04-30 14:55 -------- d-----w c:\program files\JetAudio
2009-05-09 13:01 . 2009-04-30 14:33 226304 ----a-w c:\documents and settings\I-R-I\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-01 09:45 . 2009-04-30 14:53 -------- d-----w c:\program files\Windows Live
2009-04-30 17:40 . 2009-04-30 14:50 -------- d-----w c:\program files\Common Files\Adobe
2009-04-30 17:38 . 2009-04-30 14:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-30 17:31 . 2009-04-30 17:31 -------- d-----w c:\program files\Conexant
2009-04-30 15:02 . 2009-04-30 15:02 -------- d-----w c:\documents and settings\I-R-I\Application Data\GRETECH
2009-04-30 15:02 . 2009-04-30 15:02 -------- d-----w c:\program files\GRETECH
2009-04-30 15:01 . 2009-04-30 15:01 -------- d-----w c:\program files\Common Files\xing shared
2009-04-30 15:01 . 2009-04-30 15:01 -------- d-----w c:\program files\Common Files\Real
2009-04-30 15:01 . 2009-04-30 15:01 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-30 15:01 . 2003-02-21 02:42 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-30 15:01 . 2009-04-30 15:01 -------- d-----w c:\program files\Real
2009-04-30 15:00 . 2009-04-30 15:00 -------- d-----w c:\documents and settings\I-R-I\Application Data\vlc
2009-04-30 14:58 . 2009-04-30 14:58 -------- d-----w c:\program files\VideoLAN
2009-04-30 14:58 . 2009-04-30 14:58 -------- d-----w c:\program files\XP Codec Pack
2009-04-30 14:56 . 2009-04-30 14:55 -------- d-----w c:\program files\Common Files\COWON
2009-04-30 14:55 . 2009-04-30 14:55 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-30 14:54 . 2009-04-30 14:54 47104 ------w c:\windows\AKDeInstall.exe
2009-04-30 14:48 . 2009-04-30 14:48 2232 ----a-w c:\windows\java\Packages\Data\RTFJPJFX.DAT
2009-04-30 14:48 . 2009-04-30 14:48 155995 ----a-w c:\windows\java\Packages\2KUYYN97.ZIP
2009-04-30 14:47 . 2009-04-30 14:47 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-04-30 14:47 . 2009-04-30 14:47 172032 ------w c:\windows\Setup1.exe
2009-04-30 14:47 . 2009-04-30 14:47 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-30 14:44 . 2009-04-30 14:44 -------- d-----w c:\program files\Microsoft.NET
2009-04-30 14:26 . 2009-04-30 14:26 -------- d-----w c:\program files\microsoft frontpage
2009-04-30 14:22 . 2009-04-30 14:22 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-06 14:44 . 2004-08-04 00:55 282624 ----a-w c:\windows\system32\pdh.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-05-21_10.39.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-12-01 21:46 . 2006-12-01 21:46 65536 c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 21:26 . 2006-12-01 21:26 57856 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 21:25 . 2006-12-01 21:25 69632 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 19:56 . 2006-12-01 19:56 96256 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2001-09-19 15:00 . 2009-05-25 17:32 40972 c:\windows\system32\perfc009.dat
- 2001-09-19 15:00 . 2009-05-21 10:04 40972 c:\windows\system32\perfc009.dat
- 2009-04-30 14:48 . 2002-02-18 07:23 21264 c:\windows\system32\msjdbc10.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 21264 c:\windows\system32\msjdbc10.dll
- 2009-04-30 14:48 . 2002-02-18 07:23 15120 c:\windows\system32\jdbgmgr.exe
+ 2009-04-30 14:48 . 2003-02-28 15:26 15120 c:\windows\system32\jdbgmgr.exe
- 2009-04-30 14:48 . 2002-02-18 07:22 63248 c:\windows\system32\javaprxy.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 63248 c:\windows\system32\javaprxy.dll
+ 2009-04-30 14:30 . 2009-05-25 13:23 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-04-30 14:30 . 2009-04-30 14:30 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-30 14:30 . 2009-05-25 13:23 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-30 14:30 . 2009-04-30 14:30 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-04-30 14:30 . 2009-05-25 13:23 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-04-30 14:30 . 2009-04-30 14:30 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-04-30 14:48 . 2002-02-18 07:23 49424 c:\windows\system32\clspack.exe
+ 2009-04-30 14:48 . 2003-02-28 15:26 49424 c:\windows\system32\clspack.exe
- 2009-04-30 14:48 . 2002-02-18 07:23 46352 c:\windows\setdebug.exe
+ 2009-04-30 14:48 . 2003-02-28 15:26 46352 c:\windows\setdebug.exe
+ 2009-04-30 14:25 . 2009-05-23 10:04 2426 c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2009-04-30 14:25 . 2009-05-23 10:02 8972 c:\windows\pchealth\helpctr\Config\Cntstore.bin
- 2009-04-30 14:48 . 2002-02-18 04:35 6550 c:\windows\jautoexp.dat
+ 2009-04-30 14:48 . 2003-02-28 13:35 6550 c:\windows\jautoexp.dat
+ 2009-04-30 14:48 . 2003-02-28 15:26 171792 c:\windows\system32\wjview.exe
- 2009-04-30 14:48 . 2002-02-18 07:23 171792 c:\windows\system32\wjview.exe
- 2009-04-30 14:48 . 2002-02-18 07:23 286992 c:\windows\system32\vmhelper.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 286992 c:\windows\system32\vmhelper.dll
+ 2008-12-06 12:03 . 2008-09-10 18:56 185920 c:\windows\system32\rmoc3260.dll
- 2009-04-30 15:01 . 2008-09-10 18:56 185920 c:\windows\system32\rmoc3260.dll
- 2001-09-19 15:00 . 2009-05-21 10:04 314644 c:\windows\system32\perfh009.dat
+ 2001-09-19 15:00 . 2009-05-25 17:32 314644 c:\windows\system32\perfh009.dat
- 2000-05-23 19:45 . 2000-05-23 19:45 118784 c:\windows\system32\MSSTDFMT.DLL
+ 2000-04-03 17:05 . 2000-04-03 17:05 118784 c:\windows\system32\msstdfmt.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 947472 c:\windows\system32\msjava.dll
- 2009-04-30 14:48 . 2002-02-18 07:23 154384 c:\windows\system32\msawt.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 154384 c:\windows\system32\msawt.dll
- 2009-04-30 14:48 . 2002-02-18 07:23 172304 c:\windows\system32\jview.exe
+ 2009-04-30 14:48 . 2003-02-28 15:26 172304 c:\windows\system32\jview.exe
- 2009-04-30 14:48 . 2002-02-18 07:22 171280 c:\windows\system32\jit.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 171280 c:\windows\system32\jit.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 404752 c:\windows\system32\javart.dll
- 2009-04-30 14:48 . 2002-02-18 07:22 404752 c:\windows\system32\javart.dll
- 2009-04-30 14:48 . 2002-02-18 07:22 187152 c:\windows\system32\javacypt.dll
+ 2009-04-30 14:48 . 2003-02-28 15:26 187152 c:\windows\system32\javacypt.dll
+ 2009-04-30 14:48 . 2003-02-28 13:34 313856 c:\windows\system32\dx3j.dll
- 2009-04-30 14:48 . 2002-02-18 04:34 313856 c:\windows\system32\dx3j.dll
+ 2009-05-25 17:22 . 2009-05-25 17:53 226832 c:\windows\system32\drivers\klif.sys
- 2009-05-21 05:03 . 2009-05-21 05:29 226832 c:\windows\system32\drivers\klif.sys
+ 2006-12-01 21:25 . 2006-12-01 21:25 1093120 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 21:25 . 2006-12-01 21:25 1101824 c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2009-05-24 07:16 . 2009-05-06 21:16 24699336 c:\windows\system32\MRT.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DSLSTATEXE"="c:\program files\Conexant\Adsl\dslstat.exe" [2005-08-25 344064]
"DSLAGENTEXE"="c:\program files\Conexant\Adsl\dslagent.exe" [2005-08-25 65536]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-30 198160]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-25 206088]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{AC456810-5875-7680-8C89-12FBF6A9A98A}]
c:\windows\Bifrost\win.exe s
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: إضافة إلى حاجب إعلان الشعار - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\I-R-I\Application Data\Mozilla\Firefox\Profiles\ipxx5lif.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - 4shared Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2233703&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&q=
FF - component: c:\program files\Media Access Startup\1.0.0.610\FF\components\HPFFAddOn.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-25 21:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(784)
c:\windows\system32\NTMARTA.DLL
- - - - - - - > 'explorer.exe'(2640)
c:\windows\system32\msi.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.ARA
.
------------------------ Other Running Processes ------------------------
.
c:\program files\a-squared Free\a2service.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-25 21:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-25 18:11
ComboFix2.txt 2009-05-24 09:07
ComboFix3.txt 2009-05-21 10:42
Pre-Run: 14,644,060,160 bytes free
Post-Run: 14,681,411,584 bytes free
307 --- E O F --- 2009-05-24 07:24
