ComboFix 09-05-31.02 - Administrator 06/01/2009 1:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.511.170 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Memman.vxd
c:\windows\system32\skinboxer43.dll
H:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-31 )))))))))))))))))))))))))))))))
.
2009-05-31 22:28 . 2009-05-31 22:28 -------- d-----w- c:\windows\system32\wbem\snmp
2009-05-31 22:28 . 2009-05-31 22:28 -------- d-----w- c:\windows\system32\xircom
2009-05-31 22:28 . 2009-05-31 22:28 -------- d-----w- c:\program files\microsoft frontpage
2009-05-31 21:57 . 2009-05-31 21:57 -------- d-----w- c:\program files\Trend Micro
2009-05-31 16:58 . 2009-05-31 16:58 -------- d-----w- c:\program files\Unlocker
2009-05-31 15:10 . 2009-05-31 15:10 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-31 06:32 . 2009-05-31 06:32 8704 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Adobe\1000000b00002i\verclsid.exe
2009-05-30 00:04 . 2009-05-30 00:04 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2009-05-29 22:33 . 2009-05-30 07:40 -------- dc----w- c:\windows\ie8
2009-05-29 02:00 . 2009-05-29 02:01 -------- d-----w- c:\program files\Muslim Bag
2009-05-29 02:00 . 2009-05-29 02:00 -------- d-----w- c:\windows\Muslim Bag
2009-05-29 00:35 . 2009-05-29 00:35 8704 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Adobe\10000006600002i\regedit.exe
2009-05-29 00:35 . 2009-05-29 00:35 8704 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Adobe\1000000b00002i\rundll32.exe
2009-05-29 00:12 . 2009-05-29 00:12 7168 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\USB Virus Scan 2.3\40000014500002i\USBScan.exe
2009-05-29 00:12 . 2009-05-29 00:12 43560 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\USB Virus Scan 2.3\%ProgramFilesDir%\USBScan\kernel.dll
2009-05-29 00:12 . 2009-05-29 00:12 456704 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\USB Virus Scan 2.3\%ProgramFilesDir%\USBScan\USBScan.exe
2009-05-29 00:11 . 2009-05-29 00:11 7168 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\USB Virus Scan 2.3\400000d700002i\Update.exe
2009-05-27 07:35 . 2009-05-27 07:35 7168 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Adobe Photoshop CS\1000000b00002i\rundll32.exe
2009-05-27 07:35 . 2009-05-29 00:35 -------- d-----w- c:\documents and settings\Administrator\Application Data\Thinstall
2009-05-27 05:30 . 2009-05-27 05:40 63 ----a-w- c:\windows\AlfaStart.CMD
2009-05-27 05:29 . 2009-05-27 05:29 -------- d-----w- c:\program files\Alfa Autorun Killer 2
2009-05-23 09:57 . 2009-05-23 10:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Deployment
2009-05-21 02:04 . 2009-05-21 02:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-21 02:04 . 2009-05-21 02:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\Yahoo!
2009-05-21 01:55 . 2009-05-21 01:55 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ACD Systems
2009-05-21 01:55 . 2009-05-21 01:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\ACD Systems
2009-05-21 01:54 . 2009-05-21 01:54 -------- d-----w- c:\program files\Yahoo!
2009-05-21 01:54 . 2009-05-21 01:54 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-05-21 01:54 . 2009-05-21 01:54 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-21 01:54 . 2009-05-21 01:54 -------- d-----w- c:\program files\ACD Systems
2009-05-21 01:52 . 2009-05-21 01:52 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Downloaded Installations
2009-05-20 16:50 . 2009-05-20 16:50 -------- d--h--w- c:\windows\PIF
2009-05-20 16:38 . 2009-05-20 16:38 -------- d-----w- C:\spoolerlogs
2009-05-18 04:09 . 2004-03-02 13:37 125184 ------w- c:\windows\system32\drivers\imagesrv.sys
2009-05-18 04:09 . 2004-03-02 13:37 5504 ------w- c:\windows\system32\drivers\imagedrv.sys
2009-05-18 04:09 . 2000-06-26 07:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2009-05-18 04:09 . 2009-05-18 04:09 -------- d-----w- c:\program files\Common Files\Ahead
2009-05-18 04:09 . 2004-07-26 13:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2009-05-18 04:09 . 2004-07-26 13:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2009-05-18 04:09 . 2004-07-26 13:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2009-05-18 04:09 . 2004-07-26 13:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2009-05-18 04:09 . 2001-07-09 07:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2009-05-14 16:04 . 2009-05-14 16:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\ThumbsPlus
2009-05-14 16:04 . 2009-05-14 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\ThumbsPlus
2009-05-14 16:04 . 2009-05-14 16:05 -------- d-----w- c:\program files\Thumbs7
2009-05-13 23:32 . 2009-05-14 16:32 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-05-13 23:32 . 2009-05-13 23:32 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-05-13 23:32 . 2009-05-14 16:32 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-05-13 23:08 . 2009-05-20 15:22 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-13 23:08 . 2009-05-20 15:22 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-13 23:07 . 2009-05-31 22:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-13 23:07 . 2009-05-31 22:27 704544 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-13 23:07 . 2009-05-31 22:27 5802528 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-13 23:07 . 2009-05-13 23:07 -------- d-----w- c:\program files\Kaspersky Lab
2009-05-13 23:05 . 2009-05-13 23:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 22:27 . 2009-05-13 23:07 5584 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-31 22:27 . 2009-05-13 23:07 48508 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-05-31 20:01 . 2008-10-26 19:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-31 19:56 . 2001-09-19 15:00 59878 ----a-w- c:\windows\system32\perfc001.dat
2009-05-31 19:56 . 2001-09-19 15:00 331338 ----a-w- c:\windows\system32\perfh001.dat
2009-05-31 12:12 . 2008-10-27 08:37 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-27 06:05 . 2009-05-27 06:05 172 ----a-w- C:\curr_ver.tmp
2009-05-25 17:06 . 2008-10-27 22:11 -------- d-----w- c:\program files\shamela library
2009-05-22 18:32 . 2008-10-27 21:38 239208 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-20 16:33 . 2009-04-13 16:35 85548 ----a-w- c:\windows\system32\GlyphInfo.bin
2009-05-20 16:33 . 2009-04-13 16:35 347908 ----a-w- c:\windows\system32\FontInfo.bin
2009-05-18 04:09 . 2009-03-11 04:07 -------- d-----w- c:\program files\Ahead
2009-05-14 16:32 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-04-29 15:52 . 2009-01-08 00:54 -------- d-----w- c:\program files\LimeWire
2009-04-29 15:51 . 2009-01-08 00:54 -------- d-----w- c:\documents and settings\Administrator\Application Data\LimeWire
2009-04-21 04:38 . 2009-01-28 14:22 -------- d-----w- c:\program files\Nokia
2009-04-19 16:40 . 2009-03-26 22:06 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-13 16:34 . 2009-04-13 16:34 -------- d-----w- c:\program files\LEAD Technologies
2009-04-09 08:27 . 2009-04-13 16:34 69632 ----a-w- c:\windows\system32\LpEmf05n.dll
2009-03-29 00:38 . 2009-03-29 00:38 1172 ----a-w- c:\windows\mozver.dat
2009-03-06 14:00 . 2004-08-04 00:55 283136 ----a-w- c:\windows\system32\pdh.dll
2009-03-03 00:06 . 2007-03-16 04:20 826368 ----a-w- c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 455968]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-23 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-11 68856]
"MyWirelessCard"="c:\program files\Popular\3G HSDPA Wireless Modem P102H-U\WirelessCard.exe" [2008-03-19 663552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-18 49152]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-05-13 206088]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-08-09 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-03-16 12451]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-02-20 124928]
c:\documents and settings\All Users\çںê، ں*§ڑ\ںé*©ںê¤\*§ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-31 113664]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\(Default)
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 5:29 م 33808]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [8/19/2008 11:38 ص 87264]
R3 bsusbser;Popular USB Device for Legacy Serial Communication;c:\windows\system32\drivers\bsusbser.sys [10/29/2008 10:40 م 99456]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 5:06 م 24592]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [12/27/2008 6:30 ص 104192]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
2009-05-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-789336058-1343024091-500.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-23 10:13]
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lmgitl90.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-01 01:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1202660629-789336058-1343024091-500\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2064)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\HPZipm12.exe
.
**************************************************************************
.
Completion time: 2009-05-31 1:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-31 22:33
Pre-Run: 14,551,924,736 bytes free
Post-Run: 14,467,985,408 bytes free
213 --- E O F --- 2009-05-31 15:15
