ComboFix 09-07-01.04 - user 07/02/2009 23:28.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.2046.1560 [GMT -12:00]
Running from: c:\documents and settings\user\سطح المكتب\ComboFix.exe
Command switches used :: c:\documents and settings\user\سطح المكتب\CFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-06-03 to 2009-07-03 )))))))))))))))))))))))))))))))
.
2009-07-02 11:11 . 2009-07-02 11:49 -------- d-----w- c:\documents and settings\user\Application Data\Desktopicon
2009-06-30 19:29 . 2009-06-30 19:29 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-30 19:24 . 2009-06-30 19:29 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-30 19:24 . 2009-06-30 19:29 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-30 14:28 . 2009-06-30 14:28 10240 ----a-w- c:\documents and settings\user\Application Data\GRETECH\GomPlayer\GrLauncherTempSetup.exe
2009-06-30 14:28 . 2007-03-22 10:46 126976 ----a-w- c:\documents and settings\user\Application Data\GRETECH\GomPlayer\GrLauncher.exe
2009-06-30 09:56 . 2001-09-19 01:38 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2009-06-30 09:56 . 2001-09-19 01:38 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-06-30 09:56 . 2008-04-14 12:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-06-30 09:56 . 2008-04-14 12:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-06-29 10:05 . 2009-06-29 10:05 -------- d-----w- c:\program files\CCleaner
2009-06-29 10:02 . 2009-06-29 10:04 2714784 ----a-w- c:\program files\ccsetup139.exe
2009-06-27 15:09 . 2009-06-30 00:14 -------- d-----w- c:\documents and settings\user\Contacts
2009-06-27 12:15 . 2009-06-27 12:15 -------- d-----w- c:\program files\MSN Messenger
2009-06-26 16:41 . 2009-06-27 07:57 -------- d-----w- c:\program files\MSECACHE
2009-06-26 09:39 . 2009-06-26 09:39 -------- d-s---w- c:\documents and settings\user\UserData
2009-06-25 10:45 . 2009-07-03 11:10 117760 ----a-w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-25 02:40 . 2009-06-25 02:40 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-25 02:40 . 2009-06-25 02:40 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-25 02:40 . 2009-06-25 02:40 -------- d-----w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com
2009-06-25 02:38 . 2009-06-25 02:38 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-23 00:41 . 2008-04-14 12:15 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-06-22 19:08 . 2009-06-22 19:08 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-06-22 19:08 . 2009-06-22 19:08 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-22 19:07 . 2009-06-22 19:08 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-06-22 18:33 . 2009-06-22 19:08 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-22 18:33 . 2009-06-22 19:08 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-22 18:32 . 2009-07-03 11:28 319520 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-22 18:32 . 2009-07-03 11:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-22 18:32 . 2009-07-03 11:08 1892384 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-22 18:32 . 2009-06-22 18:32 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-22 18:31 . 2009-06-22 18:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-22 13:32 . 2009-06-22 13:32 -------- d-----w- c:\program files\Trend Micro
2009-06-22 13:28 . 2009-06-22 13:28 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Runscanner.net
2009-06-21 20:15 . 2009-06-21 20:15 -------- d-----w- c:\program files\Synaptics
2009-06-21 20:15 . 2008-06-02 22:04 220032 ----a-w- c:\windows\system32\drivers\SynTP.sys
2009-06-21 20:15 . 2008-06-02 22:04 147456 ----a-w- c:\windows\system32\SynTPAPI.dll
2009-06-21 20:15 . 2008-06-02 22:04 110592 ----a-w- c:\windows\system32\SynTPCo4.dll
2009-06-21 20:15 . 2008-06-02 22:04 196608 ----a-w- c:\windows\system32\SynCtrl.dll
2009-06-21 20:15 . 2008-06-02 22:04 163840 ----a-w- c:\windows\system32\SynCOM.dll
2009-06-21 20:12 . 2009-06-21 20:12 -------- d-----w- c:\program files\Intel
2009-06-21 20:12 . 2009-06-21 20:12 -------- d-----w- C:\Intel
2009-06-21 20:11 . 2008-06-02 22:03 105856 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys
2009-06-21 20:09 . 2008-04-14 10:09 142592 -c--a-w- c:\windows\system32\dllcache\aec.sys
2009-06-21 20:08 . 2009-06-26 14:16 -------- d-----w- c:\program files\Camera Assistant Software for Toshiba
2009-06-21 20:08 . 2009-06-26 14:15 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-21 20:07 . 2009-06-21 20:07 -------- d-----w- c:\program files\DIFX
2009-06-21 20:07 . 2008-09-25 22:57 659456 ----a-w- c:\windows\system32\NETw5c32.dll
2009-06-21 20:07 . 2008-09-25 22:57 3626112 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2009-06-21 20:07 . 2008-09-25 22:57 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2009-06-21 20:07 . 2009-06-26 14:14 -------- dc----w- c:\windows\system32\DRVSTORE
2009-06-21 13:12 . 2009-06-21 13:12 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\ATI
2009-06-21 13:12 . 2009-06-21 13:12 -------- d-----w- c:\documents and settings\user\Application Data\ATI
2009-06-21 13:12 . 2009-06-21 13:12 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2009-06-21 13:12 . 2009-06-21 13:12 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-21 12:58 . 2009-06-21 13:02 -------- d-----w- c:\program files\ATI Technologies
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-03 11:28 . 2009-06-22 18:32 2172 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-03 11:15 . 2001-09-19 14:00 59878 ----a-w- c:\windows\system32\perfc001.dat
2009-07-03 11:15 . 2001-09-19 14:00 331342 ----a-w- c:\windows\system32\perfh001.dat
2009-07-03 11:08 . 2009-06-22 18:32 17960 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-30 19:29 . 2009-06-21 06:49 -------- d-----w- c:\program files\Common Files\Real
2009-06-22 19:08 . 2008-01-30 05:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-22 18:44 . 2009-06-21 06:15 -------- d-----w- c:\documents and settings\user\Application Data\IDM
2009-06-22 18:41 . 2009-06-21 06:14 -------- d-----w- c:\documents and settings\user\Application Data\DMCache
2009-06-21 20:10 . 2009-06-21 20:10 -------- d-----w- c:\program files\ltmoh
2009-06-21 20:09 . 2009-06-21 20:09 -------- d-----w- c:\program files\Realtek
2009-06-21 20:09 . 2009-06-21 20:09 315392 ----a-w- c:\windows\HideWin.exe
2009-06-21 17:48 . 2009-06-21 06:48 -------- d-----w- c:\program files\mpegable
2009-06-21 17:39 . 2009-06-21 10:35 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-21 17:01 . 2009-06-21 07:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-21 10:39 . 2009-06-21 10:39 -------- d-----w- c:\program files\microsoft frontpage
2009-06-21 10:32 . 2009-06-21 10:32 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-21 07:30 . 2009-06-21 07:30 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-06-21 07:26 . 2009-06-21 07:26 -------- d-----w- c:\program files\ESET
2009-06-21 07:26 . 2009-06-21 07:26 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-06-21 07:24 . 2009-06-21 07:23 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-06-21 07:23 . 2009-06-21 07:23 172032 ------w- c:\windows\Setup1.exe
2009-06-21 07:23 . 2009-06-21 07:23 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-21 07:14 . 2009-06-21 07:14 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-21 07:14 . 2009-06-21 07:14 -------- d-----w- c:\program files\Ahead
2009-06-21 07:11 . 2009-06-21 07:11 -------- d-----w- c:\program files\GRETECH
2009-06-21 07:11 . 2009-06-21 07:11 -------- d-----w- c:\program files\VideoLAN
2009-06-21 07:07 . 2009-06-21 10:43 94632 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-21 07:06 . 2009-06-21 07:05 -------- d-----w- c:\program files\CyberLink
2009-06-21 06:50 . 2009-06-21 06:50 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-06-21 06:49 . 2009-06-21 06:49 -------- d-----w- c:\program files\Real
2009-06-21 06:48 . 2009-06-21 06:48 47104 ------w- c:\windows\AKDeInstall.exe
2009-06-21 06:47 . 2009-06-21 06:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-21 06:47 . 2009-06-21 06:46 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-21 06:33 . 2009-06-21 06:33 -------- d-----w- c:\program files\Nokia
2009-06-21 06:33 . 2009-06-21 06:33 -------- d-----w- c:\program files\Common Files\Nokia
2009-06-21 06:33 . 2009-06-21 20:09 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-21 06:32 . 2009-06-21 06:32 2232 ----a-w- c:\windows\java\Packages\Data\JPV537Z5.DAT
2009-06-21 06:32 . 2009-06-21 06:32 155995 ----a-w- c:\windows\java\Packages\ZP7RRPRT.ZIP
2009-06-21 06:32 . 2009-06-21 06:32 2678 ----a-w- c:\windows\java\Packages\Data\0MOMEYHB.DAT
2009-06-21 06:32 . 2009-06-21 06:32 2678 ----a-w- c:\windows\java\Packages\Data\BTR53FFD.DAT
2009-06-21 06:32 . 2009-06-21 06:32 2678 ----a-w- c:\windows\java\Packages\Data\5FLVXZNZ.DAT
2009-06-21 06:32 . 2009-06-21 06:32 2678 ----a-w- c:\windows\java\Packages\Data\060EJXJF.DAT
2009-06-21 06:32 . 2009-06-21 06:32 2678 ----a-w- c:\windows\java\Packages\Data\CJZNV1V1.DAT
2009-06-21 06:24 . 2009-06-21 06:24 -------- d-----w- c:\program files\Microsoft.NET
2009-06-21 06:23 . 2009-06-21 06:23 -------- d-----w- c:\program files\Microsoft Works
2009-06-21 06:16 . 2009-06-21 20:14 -------- d-----w- c:\program files\TOSHIBA
2009-04-09 11:32 . 2009-04-09 11:32 89088 ----a-w- c:\documents and settings\user\Application Data\Desktopicon\eBayShortcuts.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2008-03-05 360448]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-06-02 1024000]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-29 75136]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-08 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-08 54832]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-22 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-30 198160]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-06-02 16859648]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-21 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-4-14 2979144]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 23:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22/12/2008 11:06 ص 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [22/12/2008 11:05 ص 55024]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [21/06/2009 08:14 ص 5888]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [22/12/2008 11:06 ص 7408]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [19/09/2001 02:00 ص 3584]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-UnlockerAssistant - c:\documents and settings\user\سطح المكتب\Unlocker\UnlockerAssistant.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: إضافة إلى حاجب إعلان الشعار - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-02 23:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1940)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\documents and settings\user\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-03 23:32
ComboFix-quarantined-files.txt 2009-07-03 11:32
Pre-Run: 96,475,062,272 bytes free
Post-Run: 96,457,990,144 bytes free
206
وبعدين اذا دخلت الى السيف مود كيف احذف المجلد وكيف ارجع للوضع السابق :er: