ComboFix 09-05-25.05 - hamodi 05/26/2009 15:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1015.474 [GMT 3:00]
Running from: c:\documents and settings\hamodi\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\artools.dll
c:\windows\system32\kakle.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-26 to 2009-05-26 )))))))))))))))))))))))))))))))
.
2009-05-19 10:35 . 2009-03-26 15:35 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-05-08 12:51 . 2009-05-08 12:51 -------- d-----w c:\program files\Circle Dvelopement
2009-05-08 12:45 . 2009-05-08 12:45 -------- d-----w c:\windows\system32\%PersonalRootCertificateFolder%
2009-05-07 22:38 . 2009-05-07 22:38 117033 ----a-w c:\documents and settings\hamodi\Application Data\IDM\DwnlData\hamodi\HJTInstall_409\HJTInstall.exe
2009-05-07 21:59 . 2009-05-07 21:59 -------- d-----w c:\program files\Trend Micro
2009-05-07 21:48 . 2009-05-07 21:48 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-07 21:47 . 2009-05-07 21:47 -------- d-----w c:\program files\Common Files\Windows Live
2009-05-07 21:38 . 2009-05-07 21:38 -------- d-----w c:\documents and settings\hamodi\Application Data\URSoft
2009-05-07 21:38 . 2009-05-07 21:41 -------- d-----w c:\program files\Your Uninstaller 2008
2009-05-07 20:32 . 2009-05-07 20:32 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-07 20:28 . 2009-05-07 20:28 -------- d-----w c:\program files\Circle Developement
2009-05-07 20:21 . 2009-05-07 20:21 -------- d-----w c:\program files\Windows Live
2009-05-07 18:56 . 2009-05-07 18:56 -------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-05-07 18:07 . 2009-05-07 18:07 81984 ----a-w c:\windows\system32\bdod.bin
2009-05-07 18:07 . 2009-05-07 18:07 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-07 18:07 . 2009-05-07 18:20 -------- d-----w c:\program files\TweakMASTER
2009-05-07 18:07 . 2009-05-07 18:19 -------- d-----w c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-05-07 18:07 . 2009-05-07 18:07 -------- d-----w c:\documents and settings\mozy
2009-05-07 17:57 . 2009-05-07 17:57 64 --sh--r c:\windows\system32\SESdemo.drv
2009-05-07 17:57 . 2009-05-07 17:57 -------- d-----w c:\program files\ArzooSoft Solutions
2009-05-06 21:28 . 2009-05-06 21:28 -------- d-----w c:\documents and settings\All Users\Application Data\SWiSHMax2WorkFolder
2009-05-04 16:44 . 2009-05-04 16:45 561807 ----a-w c:\documents and settings\hamodi\Application Data\IDM\DwnlData\hamodi\Install_Messenger_367\Install_Messenger.exe
2009-04-27 18:07 . 2009-04-27 18:07 -------- d-----w c:\program files\Microsoft Sync Framework
2009-04-27 18:06 . 2006-11-29 10:06 3426072 ----a-w c:\windows\system32\d3dx9_32.dll
2009-04-27 18:06 . 2009-04-27 18:06 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-04-27 18:04 . 2009-04-27 18:04 -------- d-----w c:\program files\Microsoft
2009-04-27 17:23 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-27 17:23 . 2008-10-16 11:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-04-27 17:09 . 2009-04-27 17:09 283559 ----a-w c:\documents and settings\hamodi\Application Data\IDM\DwnlData\hamodi\wlsetup-all_330\wlsetup-all.exe
2009-04-27 10:41 . 2009-04-27 10:41 -------- d-----w c:\documents and settings\hamodi\DoctorWeb
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-26 13:01 . 2009-04-02 23:52 -------- d-----w c:\documents and settings\hamodi\Application Data\DMCache
2009-05-26 13:00 . 2009-04-02 21:01 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-26 13:00 . 2009-04-02 21:01 2343968 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-26 13:00 . 2009-04-02 21:01 20440 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-26 12:58 . 2009-04-02 21:01 483360 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-26 12:58 . 2009-04-02 21:01 3780 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-08 12:51 . 2009-04-03 23:57 -------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 3
2009-05-08 12:51 . 2001-09-19 12:00 58722 ----a-w c:\windows\system32\perfc001.dat
2009-05-08 12:51 . 2001-09-19 12:00 328418 ----a-w c:\windows\system32\perfh001.dat
2009-05-08 12:51 . 2009-04-02 20:54 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-08 11:43 . 2009-04-20 11:44 843 ----a-w C:\ChangeWinXPKey.vbs
2009-05-07 22:21 . 2009-05-07 22:21 -------- d-----w c:\documents and settings\hamodi\Application Data\CyberScrub
2009-05-07 22:21 . 2009-05-07 22:21 -------- d-----w c:\documents and settings\hamodi\Application Data\cleaner
2009-05-07 21:40 . 2009-04-15 12:50 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-07 21:29 . 2009-05-04 16:29 -------- d-----w c:\program files\MSECACHE
2009-05-07 20:06 . 2009-04-16 11:06 -------- d-----w c:\documents and settings\hamodi\Application Data\uTorrent
2009-05-05 10:44 . 2009-04-02 20:54 219784 ----a-w c:\documents and settings\hamodi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-04 16:30 . 2009-05-04 16:30 3584 ----a-r c:\documents and settings\hamodi\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-05-04 16:29 . 2009-05-04 16:29 -------- d-----w c:\program files\Windows Installer Clean Up
2009-05-03 18:17 . 2009-05-03 18:17 198064 ----a-w c:\documents and settings\hamodi\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-03 18:17 . 2009-04-02 23:52 -------- d-----w c:\documents and settings\hamodi\Application Data\IDM
2009-05-03 18:17 . 2009-04-02 23:52 -------- d-----w c:\program files\Internet Download Manager
2009-05-02 15:42 . 2009-05-02 15:38 -------- d-----w c:\program files\coolpro2
2009-05-02 15:40 . 2009-05-02 15:40 -------- d-----w c:\documents and settings\hamodi\Application Data\Syntrillium
2009-05-02 14:33 . 2009-04-02 21:02 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-02 14:33 . 2009-04-02 21:02 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-28 11:10 . 2009-04-24 19:33 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-25 14:52 . 2009-04-25 14:52 0 ----a-w c:\documents and settings\hamodi\Application Data\IDM\DwnlData\hamodi\install_flash_player_301\install_flash_player.exe
2009-04-24 19:37 . 2009-04-24 19:37 -------- d-----w c:\program files\Microsoft Works
2009-04-24 19:37 . 2009-04-24 19:37 -------- d-----w c:\program files\MSBuild
2009-04-24 16:28 . 2009-04-24 16:28 2232 ----a-w c:\windows\java\Packages\Data\5FJBTZL3.DAT
2009-04-24 16:28 . 2009-04-24 16:28 155995 ----a-w c:\windows\java\Packages\F31ZP3RF.ZIP
2009-04-24 16:27 . 2009-04-24 16:27 2678 ----a-w c:\windows\java\Packages\Data\P3J7FLR3.DAT
2009-04-24 16:27 . 2009-04-24 16:27 2678 ----a-w c:\windows\java\Packages\Data\ECZJ13L7.DAT
2009-04-24 16:27 . 2009-04-24 16:27 2678 ----a-w c:\windows\java\Packages\Data\WD7NRDBD.DAT
2009-04-24 16:27 . 2009-04-24 16:27 2678 ----a-w c:\windows\java\Packages\Data\5BFZRHNR.DAT
2009-04-24 16:27 . 2009-04-24 16:27 2678 ----a-w c:\windows\java\Packages\Data\2ST7HBTN.DAT
2009-04-23 18:43 . 2009-04-23 18:31 -------- d-----w c:\program files\MultiTranse
2009-04-23 18:14 . 2009-04-23 17:46 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-23 17:46 . 2009-04-23 17:46 172032 ------w c:\windows\Setup1.exe
2009-04-21 10:18 . 2009-04-21 10:18 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-20 19:14 . 2009-04-20 19:14 -------- d-----w c:\program files\Real_SC
2009-04-20 19:03 . 2009-04-18 19:58 90112 ----a-w c:\windows\system32\ALOAudioFormatSettings3.dll
2009-04-20 19:03 . 2009-04-18 19:58 877568 ----a-w c:\windows\system32\ALOAudioFile2.dll
2009-04-20 19:03 . 2009-04-18 19:58 780288 ----a-w c:\windows\system32\ALOVideoCompress.dll
2009-04-20 19:03 . 2009-04-18 19:58 778240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
2009-04-20 19:03 . 2009-04-18 19:58 495104 ----a-w c:\windows\system32\ALOVideoCoreM.dll
2009-04-20 19:03 . 2009-04-18 19:58 403968 ----a-w c:\windows\system32\ALOWMAFile2.dll
2009-04-20 19:03 . 2009-04-18 19:58 382464 ----a-w c:\windows\system32\ALOAVIFile.dll
2009-04-20 19:03 . 2009-04-18 19:58 2846720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
2009-04-20 19:03 . 2009-04-18 19:58 249856 ----a-w c:\windows\system32\ALOQuickTimeFile.dll
2009-04-20 19:03 . 2009-04-18 19:58 215552 ----a-w c:\windows\system32\ALOWMVFile.dll
2009-04-20 19:03 . 2009-04-18 19:58 188416 ----a-w c:\windows\system32\ALOVideoFile.dll
2009-04-20 04:05 . 2009-04-20 04:05 15872 ----a-r c:\documents and settings\hamodi\Application Data\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2009-04-17 17:23 . 2009-04-15 12:50 82432 ----a-w c:\windows\system32\msxml4r.dll
2009-04-17 17:23 . 2009-04-15 12:50 44544 ----a-w c:\windows\system32\msxml4a.dll
2009-04-17 00:00 . 2009-04-17 00:00 -------- d-----w c:\program files\MSXML 4.0
2009-04-15 13:06 . 2009-04-15 13:06 -------- d-----w c:\program files\iFoxSoft
2009-04-15 13:06 . 2009-04-02 20:18 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-15 11:59 . 2009-04-15 11:59 7680 ----a-w c:\documents and settings\hamodi\Application Data\Thinstall\Data Doctor Recovery Pen Drive 3.0.1.5\1000000b00002i\rundll32.exe
2009-04-15 11:45 . 2009-04-15 11:45 7680 ----a-w c:\documents and settings\hamodi\Application Data\Thinstall\Data Doctor Recovery Pen Drive 3.0.1.5\1000000500002i\hh.exe
2009-04-15 11:44 . 2009-04-15 11:44 7680 ----a-w c:\documents and settings\hamodi\Application Data\Thinstall\Data Doctor Recovery Pen Drive 3.0.1.5\400000d00002i\DataDoctor-HDD.exe
2009-04-15 11:44 . 2009-04-15 11:44 -------- d-----w c:\documents and settings\hamodi\Application Data\Thinstall
2009-04-14 11:07 . 2009-04-02 20:55 -------- d-----w c:\documents and settings\hamodi\Application Data\Default poke bend
2009-04-13 10:36 . 2009-04-13 10:36 -------- d-----w c:\program files\Common Files\SWiSHzone.com
2009-04-13 01:28 . 2009-04-12 22:57 -------- d-----w c:\documents and settings\hamodi\Application Data\CamTrack
2009-04-12 22:57 . 2009-04-12 22:57 -------- d-----w c:\program files\Common Files\snp325
2009-04-12 20:33 . 2009-04-02 20:55 -------- d-----w c:\documents and settings\All Users\Application Data\Grid Blue Memo Site
2009-04-09 17:56 . 2009-04-09 17:56 -------- d-----w c:\program files\Bandoo
2009-04-09 07:43 . 2009-04-09 07:43 239120 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\Vista\klif.sys
2009-04-09 07:43 . 2009-04-09 07:43 218640 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP64\klif.sys
2009-04-09 07:43 . 2009-04-02 21:35 226832 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-04-09 07:43 . 2009-04-09 07:43 230032 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\w2000\klif.sys
2009-04-09 07:42 . 2009-04-09 07:42 176656 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\x64\scrchpg.dll
2009-04-09 07:42 . 2009-04-09 07:42 44808 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\fssync.dll
2009-04-09 07:42 . 2009-04-09 07:42 206088 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\avp.exe
2009-04-09 07:40 . 2009-04-09 07:40 22792 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\x64\vkbd64.dll
2009-04-09 07:40 . 2009-04-09 07:40 176656 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\x64\scrchpg.dll
2009-04-09 07:40 . 2009-04-09 07:40 60168 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\x64\ievkbd.dll
2009-04-09 07:40 . 2009-04-09 07:40 21256 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\vkbd.dll
2009-04-09 07:40 . 2009-04-09 07:39 861448 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\updater.dll
2009-04-09 07:39 . 2009-04-09 07:39 83208 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\mzvkbd.dll
2009-04-09 07:39 . 2009-04-09 07:39 62728 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ievkbd.dll
2009-04-09 07:39 . 2009-04-09 07:39 43784 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\fssync.dll
2009-04-09 07:39 . 2009-04-09 07:39 365832 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ckahum.dll
2009-04-09 07:38 . 2009-04-09 07:38 201992 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\avp.exe
2009-04-09 00:37 . 2009-04-09 00:36 2184832 ----a-w c:\documents and settings\hamodi\Application Data\IDM\DwnlData\hamodi\zyzoom_kis8.0.0.357en_54\zyzoom_kis8.0.0.357en.exe
2009-04-04 13:42 . 2009-04-04 13:42 -------- d-----w c:\program files\SWiSHmax
2009-04-03 21:35 . 2009-04-03 21:35 -------- d-----w c:\documents and settings\hamodi\Application Data\IE7Pro
2009-04-03 21:35 . 2009-04-03 21:35 -------- d-----w c:\program files\IE7Pro
2009-04-03 17:22 . 2009-04-03 17:22 -------- d-----w c:\program files\Save Flash
2009-04-03 09:31 . 2009-04-03 09:31 -------- d-----w c:\documents and settings\hamodi\Application Data\Ahead
2009-04-02 23:58 . 2009-04-02 23:58 -------- d-----w c:\documents and settings\hamodi\Application Data\Media Player Classic
2009-04-02 23:55 . 2009-04-02 23:29 -------- d-----w c:\program files\CyberLink
2009-04-02 23:50 . 2009-04-02 23:50 -------- d-----w c:\documents and settings\hamodi\Application Data\COWON
2009-04-02 23:31 . 2009-04-02 23:31 -------- d-----w c:\documents and settings\hamodi\Application Data\CyberLink
2009-04-02 23:31 . 2009-04-02 23:31 -------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-04-02 23:29 . 2009-04-02 20:18 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-02 22:21 . 2009-04-02 22:21 -------- d-----w c:\program files\Common Files\xing shared
2009-04-02 22:21 . 2009-04-02 22:20 -------- d-----w c:\program files\Common Files\Real
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Steam"="c:\program files\Valve\Steam\Steam.exe" [2009-05-01 1217784]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-03 2815408]
"SES"="c:\program files\ArzooSoft Solutions\Secure Evidence Scrubber\SES.exe" [2009-03-22 1185792]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-02 206088]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-02 198160]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"tsnp325"="c:\windows\tsnp325.exe" [2007-04-21 270336]
"snp325"="c:\windows\vsnp325.exe" [2007-05-10 835584]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-4-3 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\hamodi\\سطح المكتب\\برامج\\utorrent-1.8.3-beta-14984.upx.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [13/04/2009 01:57 ص 10343168]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.yahoo.com
IE: إضافة إلى حاجب إعلان الشعار - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath -
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox 3.1 Beta 3\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox 3.1 Beta 3\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-26 16:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-602162358-842925246-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="MsnMsgr.Exe"
"MRUList"="a"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2052)
c:\windows\system32\msi.dll
c:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\rundll32.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\program files\Messenger\msmsgs.exe
.
**************************************************************************
.
Completion time: 2009-05-26 16:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-26 13:06
Pre-Run: 44,981,403,648 bytes free
Post-Run: 44,908,888,064 bytes free
277 --- E O F --- 2009-05-08 12:49
المفكره الاولى اللي طالب اني اقفل برنامج الحمايه
وذي الثانيه
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:07:38 م, on 26/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\tsnp325.exe
C:\WINDOWS\vsnp325.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Valve\Steam\Steam.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\ArzooSoft Solutions\Secure Evidence Scrubber\SES.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 3\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe
O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [SES] "C:\Program Files\ArzooSoft Solutions\Secure Evidence Scrubber\SES.exe" /boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: إضافة إلى حاجب إعلان الشعار - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
--
End of file - 8121 bytes
وامس ماطلعت الاولى لان التاريخ
يعطيكم العافيه انتظر ردكم
