ComboFix 09-05-29.01 - Mr 05/30/2009 7:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1023.535 [GMT 3:00]
Running from: g:\هيىك\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AV: Twister AntiTrojanVirus *On-access scanning disabled* (Updated) {FBD70C7C-71BD-4591-96BD-863C6980BE65}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Mr\Application Data\.#
c:\documents and settings\Mr\Favorites\Download programs.url
c:\documents and settings\Mr\Favorites\Games.url
c:\documents and settings\Mr\Favorites\Translator.url
c:\documents and settings\Mr\Favorites\Videos.url
c:\windows\IE4 Error Log.txt
c:\windows\system32\ICON.ico
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 )))))))))))))))))))))))))))))))
.
2009-05-27 15:37 . 2009-05-27 15:37 -------- d--h--w c:\windows\PIF
2009-05-26 17:56 . 2009-05-26 17:56 0 ----a-w c:\windows\ativpsrm.bin
2009-05-26 17:02 . 2009-05-26 17:02 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-26 17:02 . 2009-05-26 17:41 -------- d-----w c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-05-26 17:02 . 2009-05-26 17:37 -------- d-----w c:\program files\TweakMASTER
2009-05-26 17:02 . 2009-05-26 17:02 -------- d-----w c:\documents and settings\mozy
2009-05-26 16:38 . 2009-05-29 00:58 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-26 16:27 . 2008-05-08 12:28 202752 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-26 16:27 . 2008-05-01 14:30 331776 -c----w c:\windows\system32\dllcache\msadce.dll
2009-05-26 16:27 . 2008-10-03 10:15 247326 -c----w c:\windows\system32\dllcache\strmdll.dll
2009-05-26 16:27 . 2008-09-04 16:42 1106944 -c----w c:\windows\system32\dllcache\msxml3.dll
2009-05-26 16:26 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-26 16:26 . 2008-06-13 13:10 272128 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-26 16:26 . 2008-06-13 13:10 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-05-26 16:26 . 2008-10-24 11:10 453632 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-26 16:26 . 2008-12-11 11:57 333184 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-26 16:25 . 2008-04-11 18:50 683520 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-26 16:23 . 2008-10-15 16:57 332800 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-26 16:11 . 2009-05-26 16:11 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-26 16:00 . 2009-05-26 17:53 -------- d--h--w c:\windows\$hf_mig$
2009-05-26 15:04 . 2009-05-26 15:04 4 ----a-w c:\windows\RegDefrag.dat
2009-05-26 14:54 . 2009-05-26 14:54 -------- d-----w c:\program files\Registry Compressor
2009-05-26 14:52 . 2009-05-30 04:13 -------- d-----w c:\program files\Registry Fast
2009-05-17 17:19 . 2009-05-17 17:19 -------- d-----w c:\program files\Circle Developement
2009-05-10 20:06 . 2009-05-10 20:06 -------- d-----w c:\program files\TeamViewer
2009-05-06 17:04 . 2009-05-06 17:04 13824 ----a-w c:\windows\system32\drivers\splitcam.sys
2009-05-06 17:04 . 2009-05-06 17:04 -------- d-----w c:\program files\SplitCam
2009-05-03 13:38 . 2009-05-03 13:38 -------- d-----w c:\documents and settings\Mr\Application Data\InstallShield
2009-05-02 19:21 . 2009-05-22 11:43 -------- d-----w c:\documents and settings\Mr\Application Data\IMVU
2009-05-02 19:20 . 2009-05-02 19:20 80967 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\Uninstall.exe
2009-05-02 19:19 . 2009-05-02 19:20 -------- d-----w c:\documents and settings\Mr\Application Data\IMVUClient
2009-04-30 20:25 . 2009-04-30 20:25 95584 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\IMVUupdater.exe
2009-04-30 20:25 . 2009-04-30 20:25 49920 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\IMVUClient.exe
2009-04-30 20:25 . 2009-04-30 20:25 19200 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\imvuqualityagent.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 04:26 . 2009-02-13 15:18 -------- d-----w c:\documents and settings\Mr\Application Data\Skype
2009-05-30 04:25 . 2009-01-27 21:33 -------- d-----w c:\documents and settings\Mr\Application Data\DMCache
2009-05-30 04:25 . 2009-01-29 10:29 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-30 04:22 . 2009-01-29 10:29 737312 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-30 04:22 . 2009-01-29 10:29 5696 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-30 04:22 . 2009-01-29 10:29 5336608 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-30 04:22 . 2009-01-29 10:29 48012 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-29 00:42 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-29 00:42 . 2009-01-29 10:30 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-29 00:42 . 2009-01-29 10:30 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-29 00:42 . 2009-02-06 16:12 33808 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-05-29 00:42 . 2009-02-06 16:11 226832 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-05-28 00:22 . 2009-01-29 11:09 75096 ----a-w c:\windows\system32\drivers\avipbb.sys
2009-05-27 15:42 . 2009-01-29 22:09 -------- d-----w c:\documents and settings\Mr\Application Data\TeamViewer
2009-05-27 11:46 . 2009-01-27 22:39 -------- d-----w c:\program files\LtUcx
2009-05-26 14:19 . 2009-04-06 02:51 -------- d-----w c:\program files\Gabest
2009-05-25 11:05 . 2009-01-27 23:35 -------- d-----w c:\program files\Google
2009-05-24 21:40 . 2009-04-28 23:02 85182 ----a-r c:\documents and settings\Mr\Application Data\Microsoft\Installer\{67301210-0258-3640-4130-252661511020}\_AE85D8FAC19F386F7D93C8.exe
2009-05-24 21:40 . 2009-04-28 23:02 85182 ----a-r c:\documents and settings\Mr\Application Data\Microsoft\Installer\{67301210-0258-3640-4130-252661511020}\_0F459530E77A9A33C60310.exe
2009-05-24 21:40 . 2009-04-28 23:02 -------- d-----w c:\program files\SS Telecom
2009-05-17 17:19 . 2009-01-29 13:13 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-17 17:19 . 2009-01-29 13:12 -------- d-----w c:\program files\Windows Live Messenger Khalid Edition v5.5 Arabic
2009-05-15 01:37 . 2009-03-06 22:25 -------- d-----w c:\program files\QuickTime
2009-05-15 01:36 . 2009-03-02 18:30 -------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2009-05-15 01:34 . 2009-01-27 21:56 -------- d-----w c:\program files\Alwil Software
2009-05-15 01:34 . 2009-03-22 17:10 -------- d-----w c:\program files\UltraISO
2009-05-15 01:34 . 2009-01-29 11:28 -------- d-----w c:\program files\Common Files\Filseclab
2009-05-03 13:38 . 2009-01-27 21:08 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-23 22:52 . 2009-04-23 22:52 38400 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\MemoryHook.dll
2009-04-23 22:52 . 2009-04-23 22:52 288768 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\cal3d.dll
2009-04-23 22:52 . 2009-04-23 22:52 185856 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\boost_python.dll
2009-04-23 22:52 . 2009-04-23 22:52 256000 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\audiere.dll
2009-04-23 22:51 . 2009-04-23 22:51 28672 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\CallStack.dll
2009-04-22 17:28 . 2009-04-22 17:28 9433600 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\xul.dll
2009-04-15 01:55 . 2009-03-06 22:25 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-15 01:55 . 2009-03-06 22:24 -------- d-----w c:\program files\Common Files\Apple
2009-04-06 16:04 . 2009-04-06 16:04 271929 ----a-w c:\documents and settings\Mr\Application Data\IMVUClient\pixomatic.dll
2009-03-21 14:18 . 2004-08-03 22:56 56880 ----a-w c:\windows\system32\scvideo.dll
2009-03-16 17:50 . 2009-03-16 17:50 81984 ----a-w c:\windows\system32\bdod.bin
2009-03-06 14:44 . 2004-08-03 22:56 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-21 13:34 . 2009-02-21 13:15 1004 --sha-w c:\windows\system32\sys_drv.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="c:\program files\Ares\Ares.exe" [2009-01-27 983040]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-28 2745776]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-06 206088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
"twister"="c:\program files\Filseclab\Twister\twister.exe" [2009-01-22 565248]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-02 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-30 32768]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Filseclab Messenger.lnk]
backup=c:\windows\pss\Filseclab Messenger.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SnagIt 9.lnk]
backup=c:\windows\pss\SnagIt 9.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 5:29 PM 33808]
R1 filar;Filseclab Dynamic Defense System Driver;c:\progra~1\COMMON~1\FILSEC~1\filar.sys [5/3/2009 4:38 PM 10896]
R3 filpp;Filseclab Process Protection Driver;c:\progra~1\COMMON~1\FILSEC~1\filpp.sys [5/3/2009 4:38 PM 9776]
R3 IMMDRV;Filseclab Twister Kernel Module;c:\progra~1\FILSEC~1\Twister\immdrv.sys [5/3/2009 4:38 PM 151984]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/13/2008 6:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 5:06 PM 24592]
S4 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [1/29/2009 2:09 PM 164097]
S4 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe [1/29/2009 2:09 PM 258305]
S4 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [1/29/2009 2:09 PM 41217]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder
2009-05-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = 127.0.0.1:8118
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Mr\Start Menu\Programs\IMVU\Run IMVU.lnk
DPF: {3C8E8DD8-D86A-4E6D-AF37-AB3CA7FDF8CD} - hxxp://75.126.208.164/imscp/talkc38.cab
DPF: {8C159DFD-DC9C-4077-B3B6-114A8D64B6D2} - hxxp://arabsgate.emkanat.com:1998/cp/files/talk55.cab
DPF: {9E45BE3C-DE06-4492-AB7D-E51447CF2ED0} - hxxp://75.126.208.166/imscp/talka.cab
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://76.76.19.77/imscp/talks3n.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-30 07:25
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2b94d04c-9d4d-4136-b36d-fc3ffee79e9c}]
@Denied: (Full) (Everyone)
"Model"=dword:0000005b
"Therad"=dword:0000000a
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,66,03,ae,b0,9e,
75,8b,ba,05,98,32,02,34,2b,da,61,65,40,21,41,e0,bd,2f,f9,fd,86,0b,27,65,93,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b4,a8,c8,12,c8,de,ba,e3,fc,4a,93,38,e3,5c,49,21,a5,37,a5,3a,24,
9f,3a,05,62,63,52,09,c6,6b,ac,68,6e,9a,49,d8,7a,4c,0a,cc,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1348)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2808)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Avira\AntiVir PersonalEdition Premium\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Premium\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-30 7:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-30 04:29
Pre-Run: 4,767,502,336 bytes free
Post-Run: 5,127,122,944 bytes free
222 --- E O F --- 2009-05-29 00:55
