طلعلي ايقونة قوقل جديده
ComboFix 09-05-26.05 - Adil Mahmoud 05/28/2009 2:04.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1256.966.1033.18.502.274 [GMT 3:00]
Running from: c:\documents and settings\Adil Mahmoud\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Adil Mahmoud\Application Data\FunWebProducts
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Images\
000B5ABD.urr
c:\program files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\Internet Explorer\msimg32.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\
00039210
c:\program files\MyWebSearch\bar\Cache\
00043777
c:\program files\MyWebSearch\bar\Cache\
0004B36E
c:\program files\MyWebSearch\bar\Cache\
0006AB75
c:\program files\MyWebSearch\bar\Cache\
0007248D.bin
c:\program files\MyWebSearch\bar\Cache\
00073391.bin
c:\program files\MyWebSearch\bar\Cache\
00075801.bin
c:\program files\MyWebSearch\bar\Cache\
0007592A.bin
c:\program files\MyWebSearch\bar\Cache\
00077D4C.bin
c:\program files\MyWebSearch\bar\Cache\
00077ED2
c:\program files\MyWebSearch\bar\Cache\
000B8A0A
c:\program files\MyWebSearch\bar\Cache\
000E6C33.bin
c:\program files\MyWebSearch\bar\Cache\
000E8E32.bin
c:\program files\MyWebSearch\bar\Cache\
000E97E6.bin
c:\program files\MyWebSearch\bar\Cache\
000EC2DE.bin
c:\program files\MyWebSearch\bar\Cache\
000EEA3C.bin
c:\program files\MyWebSearch\bar\Cache\
000F1469.bin
c:\program files\MyWebSearch\bar\Cache\
000F3D1F.bin
c:\program files\MyWebSearch\bar\Cache\
00C6D8C9
c:\program files\MyWebSearch\bar\Cache\
01C94007
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search2
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
c:\windows\IE4 Error Log.txt
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\nsprs.dll
c:\windows\system32\serauth1.dll
c:\windows\system32\serauth2.dll
c:\windows\system32\ssprs.dll
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))
.
2009-05-25 19:53 . 2009-05-27 23:04 -------- d-----w c:\windows\system32\CatRoot2
2009-05-20 20:24 . 2009-05-20 20:24 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-19 01:06 . 2009-05-19 01:06 -------- d-----w c:\program files\Ask Search Assistant
2009-05-17 20:39 . 2009-05-17 20:39 -------- d-----w c:\windows\ulead.dat
2009-05-17 20:00 . 2009-05-17 20:00 -------- d-----w c:\windows\PreviewSoft
2009-05-17 20:00 . 2009-05-17 20:00 -------- d-----w c:\program files\Ulead GIF-X.Plugin 2.0
2009-05-17 19:59 . 2009-05-17 20:00 -------- d-----w c:\windows\Noslip
2009-05-09 21:08 . 2009-05-09 21:08 390664 ----a-w c:\documents and settings\Adil Mahmoud\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-01 17:06 . 2009-05-01 16:44 33973608 ----a-w c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ara_web.exe
2009-04-30 18:57 . 2009-04-30 18:57 -------- d-----w c:\program files\AAALOGO
2009-04-29 21:30 . 2009-04-29 21:30 -------- d--h--w c:\windows\PIF
2009-04-29 17:14 . 2009-04-29 17:14 -------- d-----w c:\documents and settings\Adil Mahmoud\Local Settings\Application Data\Thinstall
2009-04-28 21:37 . 2004-08-03 20:08 25600 -c--a-w c:\windows\system32\dllcache\usbser.sys
2009-04-28 21:37 . 2004-08-03 20:08 25600 ----a-w c:\windows\system32\drivers\usbser.sys
2009-04-28 21:36 . 2008-03-21 10:57 14640 ------w c:\windows\system32\spmsgXP_2k3.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 23:13 . 2008-01-31 22:05 -------- d-----w c:\program files\Nakido
2009-05-27 23:12 . 2008-12-18 19:14 1048608 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-27 23:11 . 2008-12-18 19:14 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-27 23:08 . 2008-12-18 19:14 4664 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-27 23:08 . 2008-12-18 19:14 4652064 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-27 23:08 . 2008-12-18 19:14 37424 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-22 13:09 . 2008-10-31 15:53 -------- d-----w c:\documents and settings\Adil Mahmoud\Application Data\MxBoost
2009-05-19 01:06 . 2008-01-11 15:34 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-14 00:02 . 2007-12-10 17:29 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-01 17:18 . 2009-01-17 19:09 -------- d-----w c:\program files\NSS
2009-04-29 17:14 . 2009-03-01 13:55 -------- d-----w c:\documents and settings\Adil Mahmoud\Application Data\Thinstall
2009-04-28 21:37 . 2009-04-28 21:37 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-04-28 21:37 . 2009-04-28 21:37 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-04-28 13:31 . 2007-09-24 09:47 348440 ----a-w c:\documents and settings\Adil Mahmoud\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-16 20:47 . 2009-04-16 20:47 -------- d-----w c:\program files\NoNameScript
2009-04-15 21:07 . 2009-04-08 13:04 -------- d-----w c:\documents and settings\Adil Mahmoud\Application Data\Skype
2009-04-15 21:02 . 2008-01-11 15:41 -------- d-----w c:\program files\Windows Live
2009-04-15 21:01 . 2009-04-15 21:01 -------- d-----w c:\program files\Microsoft Sync Framework
2009-04-15 20:55 . 2009-04-15 20:55 -------- d-----w c:\program files\Microsoft
2009-04-15 20:55 . 2009-04-15 20:55 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-15 20:18 . 2009-04-15 20:18 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-14 13:03 . 2009-04-08 13:10 -------- d-----w c:\documents and settings\Adil Mahmoud\Application Data\skypePM
2009-04-12 20:34 . 2009-02-28 16:31 -------- d-----w c:\program files\MSECACHE
2009-04-10 12:07 . 2008-09-11 18:17 -------- d-----w c:\program files\Kelk 2000
2009-04-08 13:10 . 2009-04-08 13:10 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-04-08 13:04 . 2009-04-08 13:04 -------- d-----r c:\program files\Skype
2009-04-08 13:04 . 2009-04-08 13:04 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-04-08 13:04 . 2009-04-08 13:04 -------- d-----w c:\program files\Common Files\Skype
2009-03-06 14:00 . 2006-01-16 06:41 284160 ----a-w c:\windows\system32\pdh.dll
2008-06-05 10:58 . 2005-08-15 08:37 2076672 ----a-w c:\program files\SwishMax.exe
2008-06-05 10:57 . 2004-05-18 17:15 102 ----a-w c:\program files\logfile.txt
2008-06-05 10:56 . 2008-06-05 10:56 29743 ----a-w c:\program files\uninstal.log
2008-06-03 22:21 . 2008-06-03 22:21 1771 ----a-w c:\program files\Movie1.swi
2006-08-17 07:26 . 2005-08-15 08:43 28 ------w c:\program files\p4.svf
2006-02-24 05:58 . 2004-04-07 11:04 81920 ----a-w c:\program files\visetool.dll
2005-07-08 06:00 . 2004-07-14 10:49 5979062 ----a-w c:\program files\SwishMax.chm
2005-07-08 05:59 . 2004-07-14 11:15 78 ----a-w c:\program files\cmdfile1.txt
2005-07-08 05:59 . 2004-07-14 11:01 120 ----a-w c:\program files\cmdfile.txt
2005-07-08 05:46 . 2004-04-07 10:02 1003939 ----a-w c:\program files\SWiSHpla.exe
2005-07-08 05:46 . 2004-04-07 09:34 204800 ----a-w c:\program files\lame_enc.dll
2005-07-08 05:43 . 2004-04-07 09:22 25774 ----a-r c:\program files\LPGL.txt
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-08-18 307200]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-12 118784]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-02 761948]
"Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2006-02-02 73728]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-06 185896]
"VistaStart1.3"="c:\windows\Resources\Themes\Vista_Anthracite\VistaStart\VistaStart1.3.exe" [2006-03-20 510464]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-05 206088]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-12-09 15691264]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\agrsmmsg.exe [2005-10-15 88203]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-08-03 266240]
"TFncKy"="TFncKy.exe" [BU]
"TDispVol"="TDispVol.exe" - c:\windows\system32\TDispVol.exe [2005-03-11 73728]
"NDSTray.exe"="NDSTray.exe" [BU]
"CFSServ.exe"="CFSServ.exe" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
c:\documents and settings\Adil Mahmoud\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2008-6-25 385024]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-12-10 113664]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-2-3 1753088]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):6c,6f,6e,67,68,6f,72,6e,75,69,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Toshiba\\ConfigFree\\CFXFER.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Nakido\\nakido.exe"=
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
S0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2007-02-08 36592]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-05 33808]
S1 NetBurn;Paragon NetBurning Driver;c:\windows\system32\DRIVERS\NetBurn.sys [2007-02-08 84752]
S2 Nakido;Nakido;c:\program files\Nakido\nakido.exe [2009-05-20 325632]
S2 NetBurnerService;Net Burner iSCSI Service;c:\program files\Paragon Software\Drive Backup 8.5 Enterprise Server Edition\Net Burner Service\NetBurnerService.exe [2007-02-08 223248]
S2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe [2004-08-04 14336]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
--- Other Services/Drivers In Memory ---
*Deregistered* - AegisP
*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Ati HotKey Poller
*Deregistered* - AudioSrv
*Deregistered* - Automatic LiveUpdate Scheduler
*Deregistered* - AVP
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - CFSvcs
*Deregistered* - Compbatt
*Deregistered* - Crypkey License
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - DLABOIOM
*Deregistered* - DLADResN
*Deregistered* - DLAIFS_M
*Deregistered* - DLAOPIOM
*Deregistered* - DLAPoolM
*Deregistered* - DLARTL_N
*Deregistered* - DLAUDF_M
*Deregistered* - DLAUDFAM
*Deregistered* - DRVNDDM
*Deregistered* - eeCtrl
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - EvtEng
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - hotcore3
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - kl1
*Deregistered* - klbg
*Deregistered* - KLIF
*Deregistered* - klim5
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LiveUpdate
*Deregistered* - LmHosts
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - Nakido
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - NetBurn
*Deregistered* - NetBurnerService
*Deregistered* - Netdevio
*Deregistered* - Netman
*Deregistered* - NetworkX
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - NwlnkIpx
*Deregistered* - NwlnkNb
*Deregistered* - NwlnkSpx
*Deregistered* - NwSapAgent
*Deregistered* - PartMgr
*Deregistered* - Pml Driver HPZ12
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RegSrvc
*Deregistered* - RpcSs
*Deregistered* - S24EventMonitor
*Deregistered* - s24trans
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - SeaPort
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - TAPPSRV
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - Tosrfcom
*Deregistered* - TrkWks
*Deregistered* - TVALD
*Deregistered* - Tvs
*Deregistered* - Uim_IM
*Deregistered* - UimBus
*Deregistered* - UMWdf
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
SafeBoot-Wdf01000.sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.plusnetwork.com/
uInternet Settings,ProxyServer = 127.0.0.1:9666
uInternet Settings,ProxyOverride = local
IE: &MSN Search - c:\program files\MSN Toolbar Suite\msntb.dll/search.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/229?5ffc62ad4625433481b64c2b04fe285
IE: Open in new foreground tab - c:\program files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/230?5ffc62ad4625433481b64c2b04fe285
FF - ProfilePath - c:\documents and settings\Adil Mahmoud\Application Data\Mozilla\Firefox\Profiles\3y0gvo5n.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.plusnetwork.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-28 02:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-3157261852-356736783-2184133925-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="a"
[HKEY_LOCAL_MACHINE\software\Intel\Wireless\Folders\¬ q*2*]
"Path"="c:\\WINDOWS\\system32\\config\\systemprofile\\Application Data\\Intel\\Wireless\\"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(484)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'explorer.exe'(3324)
c:\windows\system32\TDispVol.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
c:\windows\system32\netshell.dll
c:\windows\system32\credui.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Toshiba\ConfigFree\CFSvcs.exe
c:\windows\system32\Crypserv.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\TPSBattM.exe
c:\program files\Toshiba\ConfigFree\NDSTray.exe
c:\program files\Synaptics\SynTP\Toshiba.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
c:\windows\system32\mspaint.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2009-05-27 2:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-27 23:26
Pre-Run: 48,794,488,832 bytes free
Post-Run: 48,627,240,960 bytes free
477 --- E O F --- 2009-05-14 00:02
