ComboFix 09-06-15.06 - abu abdalrahman 06/16/2009 13:56.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1247.939 [GMT 3:00]
Running from: c:\documents and settings\abu abdalrahman\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_AVPsys
((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
.
2009-06-15 09:06 . 2009-06-15 09:06 -------- d-sh--w- C:\FOUND.065
2009-06-15 05:31 . 2009-06-15 05:31 -------- d-sh--w- C:\FOUND.064
2009-06-10 14:48 . 2004-08-03 18:55 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-08 10:25 . 2009-06-08 10:25 -------- d-sh--w- C:\FOUND.063
2009-06-04 17:16 . 2004-08-03 20:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-06-04 17:16 . 2004-08-03 20:01 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2009-06-01 07:28 . 2009-06-01 07:28 -------- d-sh--w- C:\FOUND.062
2009-05-18 10:03 . 2009-05-18 10:03 -------- d-----w- c:\program files\Waves
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 10:15 . 2008-08-13 20:43 32 ----a-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-16 10:15 . 2008-08-13 20:43 32 ----a-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-16 10:15 . 2008-08-13 20:43 32 ----a-w- c:\windows\system32\drivers\fidbox.idx
2009-06-16 10:15 . 2008-08-13 20:43 32 ----a-w- c:\windows\system32\drivers\fidbox.dat
2009-05-20 22:34 . 2008-08-13 20:44 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-20 22:34 . 2008-08-13 20:44 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-12 11:58 . 2009-05-12 11:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-09 13:25 . 2009-05-09 13:25 -------- d-----w- c:\program files\Acoustica Mixcraft 4
2009-05-07 15:42 . 2004-08-03 18:55 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 19:59 . 2009-05-04 19:59 -------- d-----w- c:\program files\timeworks
2009-04-29 04:51 . 2004-08-03 18:55 657920 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:51 . 2004-08-03 18:55 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-25 19:18 . 2009-04-25 19:18 2678 ----a-w- c:\windows\java\Packages\Data\W0UUDVXN.DAT
2009-04-25 19:18 . 2009-04-25 19:18 2678 ----a-w- c:\windows\java\Packages\Data\YJNR9NDR.DAT
2009-04-25 19:18 . 2009-04-25 19:18 2678 ----a-w- c:\windows\java\Packages\Data\PZVTV93H.DAT
2009-04-25 19:18 . 2009-04-25 19:18 2678 ----a-w- c:\windows\java\Packages\Data\JTBFB5VF.DAT
2009-04-25 19:18 . 2009-04-25 19:18 2678 ----a-w- c:\windows\java\Packages\Data\Q44Y4PVX.DAT
2009-04-22 11:58 . 2009-04-22 11:58 -------- d-----w- c:\documents and settings\abu abdalrahman\Application Data\Acoustica
2009-04-22 11:58 . 2009-04-22 11:58 -------- d-----w- c:\program files\VST
2009-04-22 11:58 . 2009-04-22 11:58 -------- d-----w- c:\program files\Acoustica Shared Effects
2009-04-22 11:57 . 2009-04-22 11:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Acoustica
2009-04-22 11:57 . 2009-04-22 11:57 -------- d-----w- c:\program files\Acoustica Mixcraft 3
2009-04-21 11:37 . 2009-04-21 11:37 -------- d-----w- c:\program files\AudioRetoucher
2009-04-19 20:08 . 2004-08-03 18:46 1846528 ----a-w- c:\windows\system32\win32k.sys
2009-04-17 10:42 . 2001-09-19 09:00 39982 ----a-w- c:\windows\system32\perfc001.dat
2009-04-17 10:42 . 2001-09-19 09:00 251478 ----a-w- c:\windows\system32\perfh001.dat
2009-04-15 15:12 . 2004-08-03 18:55 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-10 13:38 . 2009-04-10 13:38 176656 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Update distribution\AutoPatches\kav8exec\8.0.0.506\x64\scrchpg.dll
2009-04-10 13:38 . 2009-04-10 13:38 176656 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Update distribution\AutoPatches\kav8exec\8.0.0.454\x64\scrchpg.dll
2009-04-10 13:38 . 2009-04-10 13:38 176656 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Update distribution\AutoPatches\kav8exec\8.0.0.357\x64\scrchpg.dll
2009-04-10 13:38 . 2009-04-10 13:38 176656 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\x64\scrchpg.dll
2009-04-10 13:38 . 2009-04-10 13:38 176656 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\x64\scrchpg.dll
2009-04-10 13:37 . 2009-04-10 13:37 176656 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\x64\scrchpg.dll
2009-04-09 11:35 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-04-09 11:35 . 2009-02-05 04:59 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-04-09 11:35 . 2009-02-05 04:59 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-04-04 20:09 . 2009-04-04 20:09 344064 ----a-w- c:\windows\system32\dkll.dll
2009-04-04 20:09 . 2009-04-04 20:09 196608 ----a-w- c:\windows\system32\maag.dll
2009-04-04 20:09 . 2002-01-01 00:12 1986560 ----a-w- c:\windows\system32\akll.dll
2009-04-04 20:09 . 2002-01-01 00:12 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-03-28 06:26 . 2009-03-28 05:17 152576 ----a-w- c:\documents and settings\abu abdalrahman\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-22 09:46 . 2009-03-22 09:46 503808 ----a-w- c:\documents and settings\abu abdalrahman\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-56be8114-n\msvcp71.dll
2009-03-22 09:46 . 2009-03-22 09:46 499712 ----a-w- c:\documents and settings\abu abdalrahman\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-56be8114-n\jmc.dll
2009-03-22 09:46 . 2009-03-22 09:46 348160 ----a-w- c:\documents and settings\abu abdalrahman\Application Data\Sun\Java\Deployment\cache\6.0\38\39ba6e6-56be8114-n\msvcr71.dll
2009-03-22 09:43 . 2009-03-22 09:43 152576 ----a-w- c:\documents and settings\abu abdalrahman\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2008-11-03 20:50 . 2008-11-03 20:50 18004 ----a-w- c:\program files\Common Files\ynugikana.vbs
2008-11-03 20:50 . 2008-11-03 20:50 16812 ----a-w- c:\program files\Common Files\ytod.bat
2008-11-03 20:50 . 2008-11-03 20:50 12293 ----a-w- c:\program files\Common Files\vevahab.lib
.
(((((((((((((((((((((((((((((
SnapShot@2009-06-16_09.27.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-16 10:16 . 2009-06-16 10:16 16384 c:\windows\Temp\Perflib_Perfdata_168.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Privacy Suite"="c:\documents and settings\abu abdalrahman\Application Data\cleaner\CSPSeraser.exe" [2007-11-20 872080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2005-02-01 1469952]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 206088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"SystemInit"="" [BU]
"Karen"="" [BU]
"raVe"="" [BU]
"Win32BaseServiceMOD"="" [BU]
"startIE"="" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Real\\RealPlayer\\REALPLAY.EXE"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R1 SD;Shunra WAN Emulator Miniport;c:\windows\system32\drivers\simdrv.sys [29/02/2004 06:43 م 88860]
R3 ip100xp;10/100Mbps Fast Ethernet Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [15/07/2008 10:27 ص 26624]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S2 Vcs;Vcs support;\??\c:\windows\system32\Drivers\Vcs.sys --> c:\windows\system32\Drivers\Vcs.sys [?]
S3 MSHUSBVideo;NX6000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [25/02/2008 10:42 م 31512]
.
Contents of the 'Scheduled Tasks' folder
2009-06-16 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-15 19:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
DPF: {7253A666-804A-1107-A4DC-00E04C504781} - hxxp://66.228.123.202/bmc.cab
DPF: {B0067CA5-2C37-4C6B-AAEC-5E2CE8635061} - hxxp://www.qurancomplex.org/Downloads/FontSmooth.cab
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://67.198.206.98:1999/ReadUid.CAB
.
.
------- File Associations -------
.
vbefile\shell\edit\command=c:\windows\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-16 14:00
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1396)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-16 14:03
ComboFix-quarantined-files.txt 2009-06-16 11:03
Pre-Run: 1,258,897,408 bytes free
Post-Run: 1,257,160,704 bytes free
183 --- E O F --- 2009-06-10 20:11
