جزاك الله كل خيـــــــر وهذا التقرير
ComboFix 09-06-26.02 - ADEL 06/27/2009 5:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.20.1033.18.3326.2797 [GMT 3:00]
Running from: c:\documents and settings\ADEL\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\ADEL\Application Data\.#
C:\temp.temp
c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe
c:\windows\system32\BReWErS.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.
2009-06-27 02:03 . 2009-06-27 02:03 -------- d--h--w- c:\windows\$hf_mig$
2009-06-27 01:52 . 2009-06-27 01:52 -------- d-----w- c:\documents and settings\ADEL\Application Data\CyberScrub
2009-06-27 00:50 . 2009-06-27 00:50 -------- d-----w- c:\documents and settings\ADEL\dwhelper
2009-06-26 13:18 . 2009-06-26 13:31 -------- d-----w- c:\documents and settings\ADEL\Application Data\dvdcss
2009-06-26 13:18 . 2009-06-26 13:18 -------- d-----w- c:\documents and settings\ADEL\Application Data\vlc
2009-06-26 13:17 . 2009-06-26 13:17 -------- d-----w- c:\program files\VideoLAN
2009-06-26 02:38 . 2009-06-26 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Merscom
2009-06-23 23:01 . 2009-06-23 23:01 -------- d-----w- c:\documents and settings\All Users\Application Data\XSign
2009-06-20 20:35 . 2009-02-05 21:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-06-20 20:34 . 2009-05-07 10:07 -------- d-----w- c:\program files\zAlwil Software
2009-06-20 11:19 . 2009-06-20 11:19 -------- d-----w- c:\program files\PicaView32
2009-06-20 11:19 . 1995-07-31 11:44 212480 ----a-w- c:\windows\system32\Pcdlib32.dll
2009-06-20 10:40 . 2009-06-20 10:40 -------- d-----w- c:\program files\Common Files\PCSuite
2009-06-20 10:40 . 2009-06-20 10:40 -------- d-----w- c:\program files\PC Connectivity Solution
2009-06-20 10:39 . 2009-02-09 05:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-06-20 10:39 . 2009-02-09 05:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll
2009-06-20 10:39 . 2009-02-09 05:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2009-06-20 10:39 . 2009-02-09 05:37 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2009-06-20 10:39 . 2009-02-09 05:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2009-06-20 10:39 . 2009-02-09 05:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll
2009-06-20 10:39 . 2009-06-20 10:38 33775224 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Nokia_PC_Suite_7_1_30_8_eng_web.exe
2009-06-20 10:39 . 2009-06-20 10:39 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\pcswpcsi.exe
2009-06-20 10:39 . 2009-06-20 10:39 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstCCD.exe
2009-06-20 10:39 . 2009-06-20 10:39 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-06-20 10:39 . 2009-06-20 10:39 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{55495E65-7C5B-48E4-BC7D-DE54F3DE5ED6}\Installer\CommonCustomActions\UninstPCS.exe
2009-06-20 00:34 . 2009-06-20 00:34 -------- d-----w- c:\documents and settings\All Users\Application Data\NevoSoft Games
2009-06-19 03:28 . 2009-06-19 03:28 -------- d-----w- c:\documents and settings\ADEL\Application Data\YoudaGames
2009-06-18 01:46 . 2009-06-18 01:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Fugazo
2009-06-18 01:45 . 2009-06-18 04:31 -------- d-----w- c:\program files\Cooking Academy
2009-06-17 03:30 . 2009-06-17 04:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Sprouts Adventure
2009-06-15 02:25 . 2009-06-15 03:13 -------- d-----w- c:\program files\The Dark Legions
2009-06-15 01:04 . 2009-06-15 01:04 -------- d-----w- c:\documents and settings\ADEL\Application Data\Pi Eye Games
2009-06-13 15:47 . 2009-06-13 15:47 -------- d-----w- c:\documents and settings\ADEL\Local Settings\Application Data\Yahoo
2009-06-13 15:47 . 2009-05-21 18:31 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-06-13 04:01 . 2009-06-13 04:01 -------- d-----w- c:\documents and settings\ADEL\Application Data\Boolat Games
2009-06-13 03:43 . 2009-06-13 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\TikGames
2009-06-13 03:43 . 2009-06-13 03:43 -------- d-----w- c:\documents and settings\ADEL\Application Data\TikGames
2009-06-13 00:39 . 2009-06-13 00:39 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-06-13 00:39 . 2009-06-13 00:39 -------- d-----w- c:\program files\UltraISO
2009-06-10 01:44 . 2009-06-10 01:45 -------- d-----w- c:\program files\Peggle
2009-06-10 00:21 . 2009-06-10 00:21 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2009-06-10 00:16 . 2009-06-10 00:16 -------- d-----w- C:\ATI
2009-06-06 21:41 . 2009-06-06 21:41 -------- d-----w- c:\documents and settings\ADE
2009-06-06 16:57 . 2009-06-06 16:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-06-06 16:56 . 2009-06-06 16:56 -------- d-----w- c:\documents and settings\ADEL\Local Settings\Application Data\Criterion Games
2009-06-06 16:56 . 2009-06-18 22:07 2130 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2009-06-06 09:25 . 2009-06-06 09:25 -------- d-sh--w- c:\windows\ftpcache
2009-06-05 12:56 . 2009-06-05 12:56 -------- d-----w- c:\documents and settings\ADEL\Local Settings\Application Data\Activision
2009-06-05 12:33 . 2009-06-05 12:33 -------- d-----w- c:\program files\DAEMON Tools
2009-06-05 00:45 . 2009-06-05 00:45 -------- d-----w- c:\program files\DAMN NFO Viewer
2009-06-04 23:12 . 2009-06-04 23:12 -------- d-----w- C:\Downloads
2009-06-04 23:12 . 2009-06-04 23:12 1048576 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
2009-06-04 23:12 . 2009-06-27 02:28 -------- d-----w- c:\program files\BitComet
2009-06-03 22:54 . 2009-06-06 10:13 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-06-03 22:54 . 2009-06-06 10:13 22328 ----a-w- c:\documents and settings\ADEL\Application Data\PnkBstrK.sys
2009-06-03 22:54 . 2009-06-06 10:12 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-03 22:54 . 2009-06-06 10:12 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-03 22:54 . 2009-06-03 22:54 2250024 ----a-w- c:\windows\system32\pbsvc.exe
2009-06-03 01:42 . 2009-06-03 01:42 -------- d-----w- c:\documents and settings\All Users\Application Data\GameHouse
2009-06-02 20:35 . 2009-06-02 20:35 682232 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-02 19:35 . 2009-06-06 04:26 -------- d-----w- c:\program files\LeeGTs Games
2009-06-02 04:39 . 2009-06-02 04:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Gogii
2009-05-30 23:16 . 2009-05-30 23:16 32768 ----a-w- c:\documents and settings\ADEL\Application Data\Pogo Games\operation_cdl\Cache\Patch.exe
2009-05-30 23:16 . 2009-05-30 23:16 -------- d-----w- c:\documents and settings\ADEL\Application Data\Pogo Games
2009-05-30 04:44 . 2009-05-30 04:44 -------- d-----w- c:\documents and settings\ADEL\Application Data\SulusGames
2009-05-30 04:44 . 2009-05-30 04:44 -------- d-----w- c:\program files\Jewelleria
2009-05-30 02:32 . 2009-05-30 02:32 -------- d-----w- c:\documents and settings\ADEL\Application Data\EleFun Games
2009-05-30 02:12 . 2009-05-30 02:12 -------- d-----w- c:\documents and settings\ADEL\Application Data\HuruBeachParty
2009-05-29 11:39 . 2009-06-02 20:04 -------- d-----w- c:\program files\HD Tune
2009-05-29 11:30 . 2009-05-29 11:30 63 ----a-w- c:\windows\AlfaStart.CMD
2009-05-29 11:29 . 2009-05-29 11:29 -------- d-----w- c:\program files\Alfa Autorun Killer 2
2009-05-29 11:15 . 2009-05-29 11:15 -------- d-----w- c:\program files\Muslim Bag
2009-05-29 11:15 . 2009-05-29 11:15 -------- d-----w- c:\windows\Muslim Bag
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 02:28 . 2009-04-15 21:35 -------- d-----w- c:\documents and settings\ADEL\Application Data\DMCache
2009-06-27 02:28 . 2009-04-15 21:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-27 02:28 . 2009-04-16 02:09 16608 ----a-w- c:\windows\gdrv.sys
2009-06-27 02:27 . 2009-04-15 21:51 901152 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-27 02:27 . 2009-04-15 21:51 8352 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-27 02:27 . 2009-04-15 21:51 6608928 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-27 02:27 . 2009-04-15 21:51 62144 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-27 02:14 . 2009-04-17 01:42 -------- d-----w- c:\program files\ARP
2009-06-27 01:51 . 2009-06-27 01:51 -------- d-----w- c:\documents and settings\ADEL\Application Data\cleaner
2009-06-27 01:51 . 2009-04-15 21:33 -------- d-----w- c:\program files\Google
2009-06-27 00:38 . 2009-04-15 23:08 -------- d-----w- c:\documents and settings\ADEL\Application Data\Skype
2009-06-27 00:37 . 2009-04-15 23:08 -------- d-----w- c:\documents and settings\ADEL\Application Data\skypePM
2009-06-26 13:09 . 2009-04-18 21:34 -------- d-----w- c:\program files\ReadyToPrint Organizer
2009-06-26 12:46 . 2009-04-15 21:35 -------- d-----w- c:\documents and settings\ADEL\Application Data\IDM
2009-06-26 02:44 . 2009-04-18 11:01 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-06-26 02:44 . 2009-04-18 11:01 -------- d-----w- c:\documents and settings\ADEL\Application Data\PlayFirst
2009-06-20 20:28 . 2009-04-15 21:42 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-20 11:50 . 2009-04-15 21:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-20 11:05 . 2009-05-22 09:28 -------- d-----w- c:\program files\NSS
2009-06-20 10:45 . 2009-04-15 20:14 -------- d-----w- c:\documents and settings\ADEL\Application Data\Nokia
2009-06-20 10:45 . 2009-06-20 10:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-06-20 10:45 . 2009-06-20 10:45 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-06-20 10:40 . 2009-04-15 20:14 -------- d-----w- c:\program files\Common Files\Nokia
2009-06-20 10:40 . 2009-04-15 20:11 -------- d-----w- c:\program files\Nokia
2009-06-20 10:40 . 2009-04-15 20:14 -------- d-----w- c:\program files\DIFX
2009-06-20 10:39 . 2009-04-15 20:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-06-20 10:23 . 2009-04-15 21:45 -------- d-----w- c:\program files\BuddyCheck
2009-06-13 15:47 . 2009-04-15 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-13 00:37 . 2009-04-20 06:27 -------- d-----w- c:\program files\WinISO
2009-06-12 23:49 . 2009-04-23 00:26 -------- d-----w- c:\program files\ATI
2009-06-10 00:18 . 2009-04-15 08:16 -------- d-----w- c:\program files\ATI Technologies
2009-06-08 03:23 . 2009-04-26 01:43 -------- d-----w- c:\program files\Ice Cream Craze Tycoon Takeover
2009-06-06 21:40 . 2009-04-15 21:35 -------- d-----w- c:\program files\Internet Download Manager
2009-06-06 20:33 . 2009-05-23 10:31 -------- d-----w- c:\program files\GVR
2009-06-06 16:56 . 2009-04-16 02:10 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-06 11:07 . 2009-05-05 23:48 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-06 10:12 . 2009-04-16 02:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-03 22:56 . 2009-06-03 22:56 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-01 23:47 . 2009-04-15 19:54 -------- d-----w- c:\documents and settings\ADEL\Application Data\Sony
2009-05-26 19:47 . 2009-04-15 20:15 -------- d-----w- c:\documents and settings\ADEL\Application Data\PC Suite
2009-05-26 00:30 . 2009-05-26 00:29 -------- d-----w- c:\program files\Common Files\WildPackets
2009-05-26 00:29 . 2009-05-26 00:29 -------- d-----w- c:\program files\WildPackets
2009-05-26 00:27 . 2009-04-15 23:08 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-05-25 01:41 . 2009-05-25 01:41 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.459\English\setup.exe
2009-05-24 20:54 . 2009-05-24 20:54 -------- d-----w- c:\program files\Supermarket Mania
2009-05-24 20:45 . 2009-05-24 20:34 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy2
2009-05-24 20:44 . 2009-05-24 20:34 -------- d-----w- c:\program files\Farm Frenzy 2
2009-05-24 20:44 . 2009-05-24 20:22 -------- d-----w- c:\program files\Alice Greenfingers 2
2009-05-24 20:22 . 2009-05-24 20:03 -------- d-----w- c:\program files\Restaurant Rush
2009-05-23 09:54 . 2009-04-18 23:51 -------- d-----w- c:\documents and settings\ADEL\Application Data\Thinstall
2009-05-23 07:52 . 2009-05-23 07:52 43008 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
2009-05-23 07:52 . 2009-05-23 07:52 43008 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-05-23 07:52 . 2009-05-23 07:52 345088 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-05-23 07:52 . 2009-05-23 07:52 338432 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-05-23 07:52 . 2009-05-23 07:52 235520 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff2.dll
2009-05-23 07:52 . 2009-05-23 07:52 235008 ----a-w- c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\metrics-ff3.dll
2009-05-22 09:34 . 2009-05-22 09:34 -------- d-----w- c:\program files\ODEON
2009-05-22 08:42 . 2009-05-22 08:42 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-05-22 08:42 . 2009-05-22 08:42 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-05-22 08:36 . 2009-05-22 08:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-05-22 08:32 . 2009-05-22 08:32 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7169FA93-66C2-43BD-86E0-CD332A686B29}\Installer\CommonCustomActions\msxml6Exec.exe
2009-05-22 08:32 . 2009-05-22 08:32 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7169FA93-66C2-43BD-86E0-CD332A686B29}\Installer\CommonCustomActions\Sleep.exe
2009-05-22 08:32 . 2009-05-22 08:32 3181612 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7169FA93-66C2-43BD-86E0-CD332A686B29}\Installer\CommonCustomActions\vcredistExec.exe
2009-05-20 22:32 . 2009-04-15 21:52 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-20 22:32 . 2009-04-15 21:52 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-19 19:50 . 2009-05-22 08:32 24312696 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{7169FA93-66C2-43BD-86E0-CD332A686B29}\NokiaSoftwareUpdaterSetup_en.exe
2009-05-16 07:42 . 2009-04-16 02:10 -------- d-----w- c:\program files\Intel
2009-05-16 07:39 . 2009-05-11 13:54 21419 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-05-16 03:11 . 2009-05-05 23:48 -------- d-----w- c:\documents and settings\ADEL\Application Data\Ubisoft
2009-05-15 11:10 . 2009-04-15 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-05-15 10:46 . 2009-04-16 02:07 60080 ----a-w- c:\documents and settings\ADEL\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-15 09:36 . 2009-05-15 09:35 -------- d-----w- c:\program files\Common Files\muvee Technologies
2009-05-15 09:26 . 2009-05-15 09:26 133392 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-15 09:26 . 2009-05-15 09:26 -------- d-----w- c:\program files\MSBuild
2009-05-15 09:26 . 2009-05-15 09:26 -------- d-----w- c:\program files\Reference Assemblies
2009-05-12 12:07 . 2009-05-12 12:07 -------- d-----w- c:\program files\Oxygen Software
2009-05-11 20:25 . 2009-04-15 21:55 2079 ----a-w- c:\windows\system32\M1achardks.dll
2009-05-11 14:05 . 2009-05-11 14:05 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2009-05-11 14:05 . 2009-05-11 14:05 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-05-11 13:54 . 2009-05-11 13:54 -------- d-----w- c:\program files\REALTEK USB Wireless LAN Driver and Utility
2009-05-11 09:47 . 2009-05-11 09:47 1302600 ----a-w- c:\windows\system32\WUDFUpdate_01007.dll
2009-05-10 02:59 . 2009-04-19 09:38 -------- d-----w- c:\program files\Airport Mania
2009-05-10 02:38 . 2009-05-10 01:06 -------- d-----w- c:\documents and settings\ADEL\Application Data\RobinsonCrusoeREF
2009-05-09 22:18 . 2009-05-09 22:18 3584 ----a-r- c:\documents and settings\ADEL\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-05-09 22:18 . 2009-05-09 22:18 -------- d-----w- c:\program files\Windows Installer Clean Up
2009-05-09 22:18 . 2009-05-09 22:18 -------- d-----w- c:\program files\MSECACHE
2009-05-06 15:00 . 2009-05-06 15:00 -------- d-----w- c:\documents and settings\ADEL\Application Data\TeamViewer
2009-05-06 15:00 . 2009-05-06 15:00 -------- d-----w- c:\program files\TeamViewer
2009-05-06 13:43 . 2009-05-06 13:43 -------- d-----w- c:\program files\Paragon Software
2009-05-05 23:48 . 2009-05-05 23:48 -------- d-----w- c:\program files\CSI - NY the game
2009-05-03 00:03 . 2009-05-03 00:03 -------- d-----w- c:\program files\Strategy First
2009-04-29 03:30 . 2008-07-04 06:33 3643904 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-04-29 02:18 . 2009-04-15 08:16 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-04-29 02:17 . 2008-07-04 03:23 335872 ----a-w- c:\windows\system32\ati2dvag.dll
2009-04-29 02:07 . 2008-07-04 03:14 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-04-29 02:06 . 2008-07-04 03:14 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-04-29 02:06 . 2008-07-04 03:14 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2009-04-29 02:06 . 2008-07-04 03:13 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-04-29 02:06 . 2008-07-04 03:13 155648 ----a-w- c:\windows\system32\ati2evxx.dll
2009-04-29 02:04 . 2008-07-04 03:12 602112 ----a-w- c:\windows\system32\ati2evxx.exe
.
------- Sigcheck -------
[-] 2008-10-13 17:37 1614848 362BC5AF8EAF712832C58CC13AE05750 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-04-03 2794928]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2008-09-24 1279216]
"BitComet"="c:\program files\BitComet\BitComet.exe" [2009-05-18 2592056]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-12 1414144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-11-19 1966080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-22 148888]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-15 206088]
"AntiARPStandalone"="c:\program files\ARP\AntiARP.exe" [2008-11-22 7979520]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-15 185896]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-28 61440]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-07-23 16804864]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SoundMan.exe [2008-06-18 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\alcwzrd.exe [2008-06-19 2808832]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2007-08-13 123904]
c:\documents and settings\ADEL\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\MSI\Bluetooth Software\BTTray.exe [2004-3-31 507965]
Nokia Ovi Suite.lnk - c:\program files\Nokia\Ovi\Suite\RunLauncher.exe [2008-7-25 951600]
REALTEK USB Wireless LAN Utility.lnk - c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2009-5-11 790528]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"g:\\العاب سيارات\\Burnout Paradise 1\\BurnoutLauncher.exe"=
"g:\\العاب سيارات\\Burnout Paradise 1\\BurnoutConfigTool.exe"=
"g:\\العاب سيارات\\Burnout Paradise 1\\BurnoutParadise.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [5/6/2009 4:43 PM 39472]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 6:29 PM 33808]
R2 AntiArpNdisProt;AntiARP NDIS Protocol Driver;c:\windows\system32\drivers\AntiArpNdisProt.sys [10/17/2007 2:33 PM 21120]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [5/11/2009 4:54 PM 38144]
R2 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\EnergySaver\GSvr.exe [4/16/2009 5:10 AM 68136]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [4/15/2009 11:17 AM 93696]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/13/2008 7:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 6:06 PM 24592]
R3 xAntiArp;xAntiArpSpoof Service;c:\windows\system32\drivers\xAntiArp.sys [11/22/2008 12:52 PM 311040]
S3 CH341SER;CH341SER;c:\windows\system32\drivers\CH341SER.SYS [4/28/2009 1:54 AM 37488]
S3 GPCIDrv;GPCIDrv;c:\program files\GIGABYTE\atBIOS\GPCIDrv.sys [7/15/2008 6:19 PM 14504]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [5/11/2009 4:54 PM 194304]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.eg/
uSearchMigratedDefaultURL = hxxp://www.google.com/custom?q={searchTerms}&sa.x=0&sa.y=0&safe=active&client=pub-3794288947762788&forid=1&channel=1975384696&ie=UTF-8&oe=UTF-8&hl=en&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\MSI\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {310CB814-B0EC-4641-BDF9-491DAAA1850B} = 163.121.128.134,163.121.128.135
FF - ProfilePath - c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\
FF - component: c:\documents and settings\ADEL\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\ADEL\Application Data\Mozilla\Firefox\Profiles\kflwkg2t.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-27 05:29
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{566c14a9-d5d6-48ae-9ce5-4965dd0c7ab6}]
@Denied: (Full) (Everyone)
"Model"=dword:000000ab
"Therad"=dword:0000000c
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,65,71,0a,bb,22,7c,75,3b,bf,7f,b2,9d,62,b2,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):8f,d5,34,bb,e8,fb,d8,f0,e0,a6,e1,86,9a,c7,c4,72,f7,9c,d1,59,6b,
3d,75,4b,68,12,f7,8a,3e,fe,0a,19,d2,bb,5e,d8,2e,55,dd,ea,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1528)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(2920)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ARP\AntiARPClientLoader.exe
c:\program files\MSI\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-27 5:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-27 02:30
Pre-Run: 24,636,833,792 bytes free
Post-Run: 24,547,958,784 bytes free
351