ComboFix 09-05-30.03 - faris 05/31/2009 6:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1014.587 [GMT 3:00]
Running from: c:\documents and settings\faris\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\faris\Application Data\addons.dat
c:\documents and settings\faris\Application Data\QUAD Backups
c:\documents and settings\faris\Start Menu\Programs\QUAD Utilities
c:\documents and settings\faris\Start Menu\Programs\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner website.lnk
c:\documents and settings\faris\Start Menu\Programs\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.lnk
c:\documents and settings\faris\Start Menu\Programs\QUAD Utilities\QUAD Registry Cleaner\Uninstall QUAD Registry Cleaner.lnk
c:\program files\Bifrost
c:\program files\Bifrost\logg.dat
c:\program files\bifrost\server.exe
c:\program files\QUAD Utilities
c:\program files\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner website.url
c:\program files\QUAD Utilities\QUAD Registry Cleaner\QUAD Registry Cleaner.exe
c:\program files\QUAD Utilities\QUAD Registry Cleaner\QUAD Scheduler.exe
c:\program files\QUAD Utilities\QUAD Registry Cleaner\Styles\Vista.cjstyles
c:\program files\QUAD Utilities\QUAD Registry Cleaner\uninst.exe
c:\program files\QUAD Utilities\QUAD Registry Cleaner\Vista Scheduler.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-31 )))))))))))))))))))))))))))))))
.
2009-05-31 03:42 . 2008-04-14 12:00 41600 -c--a-w c:\windows\system32\dllcache\weitekp9.dll
2009-05-31 03:41 . 2008-04-14 12:00 46592 -c--a-w c:\windows\system32\dllcache\svcext51.dll
2009-05-31 03:40 . 2008-04-14 12:00 32256 -c--a-w c:\windows\system32\dllcache\gzip.dll
2009-05-31 03:35 . 2008-04-14 02:42 151552 ----a-w c:\windows\system32\irftp.exe
2009-05-31 03:35 . 2008-04-14 02:41 28160 ----a-w c:\windows\system32\irmon.dll
2009-05-31 03:35 . 2008-04-14 02:42 8192 ----a-w c:\windows\system32\wshirda.dll
2009-05-31 02:46 . 2008-04-14 12:00 56320 -c--a-w c:\windows\system32\dllcache\chtskdic.dll
2009-05-31 02:46 . 2008-04-14 12:00 480256 -c--a-w c:\windows\system32\dllcache\cintsetp.exe
2009-05-31 02:46 . 2008-04-14 12:00 198656 -c--a-w c:\windows\system32\dllcache\cintime.dll
2009-05-31 02:46 . 2008-04-14 12:00 173568 -c--a-w c:\windows\system32\dllcache\chtskf.dll
2009-05-31 02:46 . 2008-04-14 12:00 97792 -c--a-w c:\windows\system32\dllcache\chtmbx.dll
2009-05-31 02:46 . 2008-04-14 12:00 455168 -c--a-w c:\windows\system32\dllcache\tintsetp.exe
2009-05-31 02:46 . 2008-04-14 12:00 44032 -c--a-w c:\windows\system32\dllcache\tintlphr.exe
2009-05-31 02:46 . 2008-04-14 12:00 10240 -c--a-w c:\windows\system32\dllcache\tmigrate.dll
2009-05-31 02:45 . 2008-04-14 12:00 70144 -c--a-w c:\windows\system32\dllcache\pintlphr.exe
2009-05-31 02:45 . 2008-04-14 12:00 67584 -c--a-w c:\windows\system32\dllcache\pmigrate.dll
2009-05-31 02:45 . 2008-04-14 12:00 59392 -c--a-w c:\windows\system32\dllcache\imscinst.exe
2009-05-31 02:45 . 2008-04-14 12:00 10096640 -c--a-w c:\windows\system32\dllcache\hwxcht.dll
2009-05-31 02:45 . 2008-04-14 12:00 24661 -c--a-w c:\windows\system32\dllcache\spxcoins.dll
2009-05-31 02:45 . 2008-04-14 12:00 24661 ----a-w c:\windows\system32\spxcoins.dll
2009-05-31 02:45 . 2008-04-14 12:00 13312 -c--a-w c:\windows\system32\dllcache\irclass.dll
2009-05-31 02:45 . 2008-04-14 12:00 13312 ----a-w c:\windows\system32\irclass.dll
2009-05-31 02:45 . 2009-05-31 03:42 -------- d-----r c:\documents and settings\All Users\قائمة ابدأ
2009-05-31 02:45 . 2009-05-31 02:45 -------- d-----w c:\documents and settings\Default User\سطح المكتب
2009-05-31 02:45 . 2009-05-31 02:45 -------- d-----w c:\documents and settings\All Users\سطح المكتب
2009-05-31 02:45 . 2009-05-31 02:45 -------- d-----r c:\documents and settings\Default User\قائمة ابدأ
2009-05-31 01:58 . 2009-05-31 03:48 -------- d-----w c:\program files\IEPro
2009-05-31 01:58 . 2009-05-31 01:58 -------- d-----w c:\documents and settings\
faris\Application Data\IEPro
2009-05-31 01:40 . 2009-05-31 01:46 300838 ----a-w c:\documents and settings\faris\Application Data\IDM\DwnlData\
faris\dotnetfx_211\dotnetfx.exe
2009-05-30 21:37 . 2009-05-30 21:38 105039 ----a-w c:\documents and settings\faris\Application Data\IDM\DwnlData\faris\IE7-WindowsXP-x86-ara_203\IE7-WindowsXP-x86-ara.exe
2009-05-30 18:47 . 2009-05-30 18:48 208070 ----a-w c:\documents and settings\faris\Application Data\IDM\DwnlData\
faris\dotnetfx_202\dotnetfx.exe
2009-05-29 21:37 . 2009-05-29 22:57 103260 ----a-w c:\documents and settings\faris\Application Data\IDM\DwnlData\
faris\TD-EssaiNR_198\TD-EssaiNR.exe
2009-05-29 20:14 . 2009-05-29 20:14 -------- d-----w c:\program files\Trend Micro
2009-05-29 18:23 . 2009-05-29 18:24 -------- d-----w c:\windows\timer3
2009-05-29 18:23 . 2009-05-29 18:27 -------- d-----w c:\documents and settings\faris\Application Data\MiniDm
2009-05-29 16:55 . 2009-05-29 16:55 -------- d-----w c:\program files\AmanLinks_Beta_0.0.4
2009-05-29 06:53 . 2009-05-29 06:54 -------- d-----w c:\program files\Speed4WEB
2009-05-29 00:17 . 2009-05-29 00:17 -------- d-----w c:\program files\Fotosizer
2009-05-28 23:48 . 2009-05-28 23:48 -------- d-----w c:\program files\Studio V5
2009-05-28 23:35 . 2009-05-28 23:35 -------- d-----w c:\program files\Reshade
2009-05-28 23:32 . 2009-05-28 23:32 -------- d-----w c:\documents and settings\faris\Application Data\Downloaded Installations
2009-05-27 10:22 . 2009-03-26 15:35 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-05-27 04:07 . 2009-05-27 04:07 -------- d-----w c:\program files\UltraISO
2009-05-27 04:07 . 2009-05-27 04:07 -------- d-----w c:\program files\Common Files\EZB Systems
2009-05-27 03:20 . 2009-05-27 03:20 -------- d-----w c:\windows\system32\Adobe
2009-05-27 03:05 . 2009-05-27 03:05 -------- d--h--w c:\windows\PIF
2009-05-27 02:52 . 2009-05-27 02:52 -------- d-----w c:\windows\B440D659FECA4BDDA12B5C9F05790FF3.TMP
2009-05-27 01:42 . 2009-05-29 03:03 -------- d-----w c:\documents and settings\faris\Application Data\Blueberry
2009-05-27 01:42 . 2009-05-03 01:36 4608 ----a-w c:\documents and settings\faris\Application Data\Thinstall\BB FlashBack Pro\%SystemRoot%\LastGood\system32\bbchlp.dll
2009-05-27 01:42 . 2009-05-03 01:36 4096 ----a-w c:\documents and settings\faris\Application Data\Thinstall\BB FlashBack Pro\%SystemRoot%\LastGood\system32\DRIVERS\bbcap.sys
2009-05-27 01:42 . 2009-05-03 01:36 30720 ----a-w c:\documents and settings\faris\Application Data\Thinstall\BB FlashBack Pro\%SystemRoot%\LastGood\system32\bbcap.dll
2009-05-27 01:41 . 2009-05-27 01:41 -------- d-----w c:\documents and settings\faris\Application Data\LogSys
2009-05-27 01:41 . 2009-05-27 01:41 -------- d-----w c:\documents and settings\faris\Local Settings\Application Data\Thinstall
2009-05-27 01:41 . 2009-05-27 01:41 -------- d-----w c:\documents and settings\faris\Application Data\Thinstall
2009-05-27 01:33 . 2009-05-27 01:33 -------- d-----w c:\documents and settings\faris\Local Settings\Application Data\Adobe
2009-05-27 01:32 . 2009-05-27 01:32 -------- d-----w c:\program files\Common Files\Adobe
2009-05-26 22:39 . 2009-05-26 22:39 -------- d-----w c:\documents and settings\faris\Application Data\IndigoRose
2009-05-26 22:39 . 2009-05-26 22:39 -------- d-----w c:\program files\AutoPlay Media Studio 7.0
2009-05-26 22:39 . 2009-05-26 22:39 -------- d-----w c:\documents and settings\All Users\Application Data\IndigoRose
2009-05-26 17:42 . 2009-05-29 00:07 -------- d-----w c:\program files\3D Real Boxshot
2009-05-26 17:25 . 2009-05-26 17:25 -------- d-----w c:\program files\Easy GIF Animator
2009-05-26 06:30 . 2009-05-26 06:30 -------- d-----w c:\program files\AskSearch
2009-05-26 06:30 . 2009-05-26 16:28 -------- d-----w c:\program files\uTorrent
2009-05-26 06:30 . 2009-05-26 16:28 -------- d-----w c:\documents and settings\faris\Application Data\uTorrent
2009-05-26 06:18 . 2009-05-29 20:53 -------- d-----w c:\program files\Raptor
2009-05-26 04:32 . 2009-05-30 22:22 -------- d-----w c:\documents and settings\faris\Local Settings\Application Data\Google
2009-05-26 04:31 . 2009-05-26 04:32 -------- d-----w c:\program files\Google
2009-05-26 01:49 . 2009-05-31 03:48 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-26 01:49 . 2009-05-26 01:49 -------- d-----w c:\documents and settings\
faris\Application Data\URSoft
2009-05-26 01:49 . 2009-05-26 01:51 -------- d-----w c:\program files\Your Uninstaller 2008
2009-05-26 01:44 . 2009-05-26 01:44 -------- d-----w c:\documents and settings\faris\Local Settings\Application Data\Babylon
2009-05-26 01:43 . 2009-05-26 01:43 -------- d-----w c:\program files\Babylon
2009-05-26 01:43 . 2009-05-27 15:17 -------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2009-05-26 01:43 . 2009-05-26 21:02 -------- d-----w c:\documents and settings\faris\Application Data\Babylon
2009-05-26 00:13 . 2009-05-26 00:13 -------- d-----w c:\documents and settings\faris\Local Settings\Application Data\Iceni
2009-05-26 00:13 . 2009-05-26 00:13 -------- d-----w c:\documents and settings\faris\Application Data\Iceni
2009-05-26 00:13 . 2009-05-26 00:13 -------- d-----w c:\program files\Iceni
2009-05-26 00:13 . 2009-05-26 00:13 -------- d-----w c:\documents and settings\All Users\Application Data\Iceni
2009-05-25 16:42 . 2009-05-25 16:42 -------- d-----w c:\program files\Unlocker
2009-05-25 02:23 . 2009-05-29 17:22 -------- d-----w c:\documents and settings\faris\Application Data\IObit
2009-05-25 02:23 . 2009-05-25 02:23 -------- d-----w c:\program files\IObit
2009-05-24 23:33 . 2009-05-27 09:22 -------- d-----w C:\TEMP
2009-05-24 23:33 . 2009-05-24 23:33 -------- d-----w c:\documents and settings\faris\Application Data\GPass-3
2009-05-24 23:32 . 2009-05-24 23:32 -------- d-----w c:\documents and settings\faris\Application Data\GPass
2009-05-24 21:02 . 2009-05-24 21:02 -------- d-----w c:\program files\AAQ
2009-05-24 21:01 . 2008-07-10 10:56 107864 ----a-w c:\windows\system32\tsccvid.dll
2009-05-24 21:01 . 2009-05-27 09:09 -------- d-----w c:\windows\system32\QuickTime
2009-05-24 21:00 . 2009-05-24 21:00 -------- d-----w c:\program files\Common Files\TechSmith Shared
2009-05-24 18:39 . 2008-06-21 15:54 11779 ----a-w c:\windows\REGTWEAK.REG
2009-05-23 19:19 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-23 19:10 . 2009-05-23 19:10 -------- d-----w c:\program files\SodaBush
2009-05-23 19:10 . 2009-05-23 19:10 -------- d-----w c:\documents and settings\faris\Application Data\SodaBush
2009-05-23 19:10 . 2009-05-23 19:10 -------- d-----w c:\windows\Downloaded Installations
2009-05-23 19:09 . 2003-06-25 13:05 266360 ----a-w c:\windows\system32\TweakUI.exe
2009-05-23 19:08 . 2009-05-23 19:08 -------- d-----w c:\program files\AST Dictionary
2009-05-23 19:01 . 2009-05-23 19:01 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-23 19:01 . 2009-05-23 19:01 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-23 17:29 . 2009-05-29 16:31 -------- d-----w c:\documents and settings\faris\Tracing
2009-05-23 16:51 . 2008-04-13 21:15 6272 ----a-w c:\windows\system32\drivers\splitter.sys
2009-05-23 16:51 . 2008-04-13 21:15 52864 ----a-w c:\windows\system32\drivers\DMusic.sys
2009-05-23 16:51 . 2008-04-02 01:27 1196032 ----a-r c:\windows\RtlUpd.exe
2009-05-23 16:51 . 2009-05-23 16:51 -------- d-----w c:\windows\system32\RTCOM
2009-05-23 16:51 . 2008-06-19 08:20 57344 ----a-r c:\windows\ALCMTR.EXE
2009-05-23 16:51 . 2008-06-19 08:42 2808832 ----a-r c:\windows\ALCWZRD.EXE
2009-05-23 16:51 . 2008-06-19 08:27 9715200 ----a-r c:\windows\RTLCPL.EXE
2009-05-23 16:51 . 2008-06-18 10:01 77824 ----a-r c:\windows\SOUNDMAN.EXE
2009-05-23 16:51 . 2007-11-20 10:15 1826816 ----a-r c:\windows\SkyTel.exe
2009-05-23 16:51 . 2007-06-28 08:44 2165760 ----a-r c:\windows\MicCal.exe
2009-05-23 16:51 . 2008-06-20 08:57 16872448 ----a-r c:\windows\RTHDCPL.EXE
2009-05-23 16:51 . 2008-06-20 08:58 4741120 ----a-r c:\windows\system32\drivers\RtkHDAud.sys
2009-05-23 16:42 . 2009-01-21 08:52 155648 ----a-w c:\windows\system32\igfxCoIn_v5029.dll
2009-05-23 16:42 . 2009-01-21 08:43 1498560 ----a-w c:\windows\system32\igkrng400.bin
2009-05-23 16:42 . 2009-05-23 16:42 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-23 16:42 . 2009-05-23 16:42 -------- d-----w c:\windows\system32\Lang
2009-05-23 16:42 . 2009-01-29 07:12 993816 ----a-w c:\windows\system32\igxpun.exe
2009-05-23 16:42 . 2006-11-10 05:25 319456 ----a-w c:\windows\system32\difxapi.dll
2009-05-23 16:42 . 2009-05-23 16:42 -------- d-----w C:\Intel
2009-05-23 16:41 . 2009-05-23 16:41 14525897 ----a-w c:\documents and settings\faris\Application Data\Uniblue\DriverScanner\Download\pci_ven_8086_dev_2a026_14_10_5029.exe
2009-05-23 15:58 . 2006-12-01 23:26 57856 -c--a-w c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}\Windows\winsxs\7z1v718o.6n8\mfcm80u.dll
2009-05-23 11:53 . 2009-05-23 11:53 -------- d-----w c:\program files\Lavalys
2009-05-23 11:15 . 2009-05-25 07:04 -------- d-----w c:\program files\Alex Gordon
2009-05-22 23:07 . 2008-07-09 07:38 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-22 23:07 . 2009-05-23 20:02 -------- d--h--w c:\windows\$hf_mig$
2009-05-22 22:44 . 2009-05-22 22:44 -------- d-----w c:\program files\Muslim Bag
2009-05-22 22:44 . 2009-05-22 22:44 -------- d-----w c:\windows\Muslim Bag
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 03:37 . 2009-05-22 14:12 23224 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-30 22:22 . 2009-05-03 01:36 4608 ----a-w c:\documents and settings\faris\Application Data\Thinstall\BB FlashBack Pro\%SystemSystem%\bbchlp.dll
2009-05-30 22:22 . 2009-05-03 01:36 4096 ----a-w c:\documents and settings\faris\Application Data\Thinstall\BB FlashBack Pro\%SystemSystem%\DRIVERS\bbcap.sys
2009-05-30 22:22 . 2009-05-03 01:36 30720 ----a-w c:\documents and settings\faris\Application Data\Thinstall\BB FlashBack Pro\%SystemSystem%\bbcap.dll
2009-05-25 17:34 . 2009-05-22 21:56 6574 ----a-w c:\program files\un_Internet Download Manager_16575.txt
2009-05-23 16:31 . 2009-05-23 16:04 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-05-23 16:04 . 2009-05-23 15:58 -------- dc-h--w c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-05-23 16:04 . 2009-05-23 16:04 -------- d-----w c:\program files\Uniblue
2009-05-23 16:04 . 2009-05-23 16:04 -------- d-----w c:\documents and settings\faris\Application Data\Uniblue
2009-05-22 21:13 . 2009-05-22 14:15 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-22 14:42 . 2009-05-22 14:41 -------- d-----w c:\documents and settings\faris\Application Data\Media Player Classic
2009-05-22 14:37 . 2009-05-22 14:37 -------- d-----w c:\program files\Driver-Soft
2009-05-22 14:16 . 2009-05-22 14:16 -------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F8C564CD-2FA0-4534-AF8D-52F3D054C0EF}]
2007-11-15 12:36 2293760 ----a-w c:\program files\AmanLinks_Beta_0.0.4\AmanLinks_Beta_0.0.4_Lite\untitled.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-29 2815408]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-04-30 2329936]
"Google Update"="c:\documents and settings\faris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-30 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 134656]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-06-20 16872448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2008-04-14 136704]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\
faris\\Desktop\\أسطوانة زيزوم\\أسطوانة زيزوم\\AutoPlay\\Docs\\ألعاب_3\\كرة طائرة\\volley.exe"=
R0 FSProFilter;FSPro File Filter;c:\windows\system32\drivers\FSPFltd.sys [22/05/2009 08:06 م 43792]
R2 fsproflt;FSPro Filter Service;c:\windows\system32\fsproflt.exe [22/05/2009 08:06 م 73392]
.
Contents of the 'Scheduled Tasks' folder
2009-05-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-1614895754-1606980848-1003.job
- c:\documents and settings\faris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-30 22:16]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-QUAD Scheduler - c:\program files\QUAD Utilities\QUAD Registry Cleaner\QUAD Scheduler.exe
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
FF - ProfilePath - c:\documents and settings\faris\Application Data\Mozilla\Firefox\Profiles\qqi205af.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - component: c:\documents and settings\faris\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\documents and settings\faris\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-31 06:56
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2009-05-31 6:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-31 03:58
Pre-Run: 49,545,908,224 bytes free
Post-Run: 49,567,739,904 bytes free
261 --- E O F --- 2009-05-30 21:34