ComboFix 09-07-03.03 - Good 07/04/2009 4:11.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1014.644 [GMT 3:00]
Running from: c:\documents and settings\Good\سطح المكتب\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\AutoRun.inf
c:\windows\wiaserviv.log
.
((((((((((((((((((((((((( Files Created from 2009-06-04 to 2009-07-04 )))))))))))))))))))))))))))))))
.
2009-07-03 22:24 . 2009-07-03 22:26 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-03 22:23 . 2009-07-03 22:23 -------- d-----w- c:\documents and settings\Good\Application Data\Malwarebytes
2009-07-03 22:23 . 2009-06-17 08:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-03 22:23 . 2009-06-17 08:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-03 22:23 . 2009-07-03 22:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-03 22:23 . 2009-07-03 22:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-03 21:40 . 2009-07-03 21:40 -------- d-----w- c:\program files\Trend Micro
2009-07-03 21:01 . 2009-07-04 01:17 -------- d-----w- c:\documents and settings\Good\Tracing
2009-07-03 20:56 . 2009-07-03 20:56 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-03 20:56 . 2009-07-03 20:56 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-07-03 20:56 . 2009-02-06 15:08 55152 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-07-03 20:55 . 2009-07-03 20:55 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-07-03 20:53 . 2009-07-03 20:56 -------- d-----w- c:\program files\Microsoft
2009-07-03 20:52 . 2009-07-03 20:52 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-07-03 20:18 . 2009-07-03 20:18 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-03 15:09 . 2006-11-29 10:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-07-03 15:09 . 2009-07-03 15:09 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-07-03 15:03 . 2009-07-03 15:04 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-07-03 15:03 . 2009-07-03 15:03 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-04 00:49 . 2002-08-29 06:30 60112 ----a-w- c:\windows\system32\perfc001.dat
2009-07-04 00:49 . 2002-08-29 06:30 331926 ----a-w- c:\windows\system32\perfh001.dat
2009-07-03 22:17 . 2008-09-28 19:48 -------- d-----w- c:\program files\Google
2009-07-03 20:56 . 2008-08-31 07:15 -------- d-----w- c:\program files\Windows Live
2009-06-30 21:36 . 2009-02-22 16:31 -------- d-----w- c:\documents and settings\Good\Application Data\ZoomBrowser EX
2009-06-30 21:36 . 2009-03-20 14:32 -------- d-----w- c:\documents and settings\Good\Application Data\CameraWindowDC
2009-05-22 08:50 . 2008-08-30 17:37 95032 ----a-w- c:\documents and settings\Good\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 10:36 . 2008-08-31 07:01 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-21 10:35 . 2008-08-30 18:43 -------- d--h--w- c:\program files\InstallShield Installation Information
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-07 185872]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-5-21 113664]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Bluetooth.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 WINSEC;WINSEC;c:\windows\system32\drivers\winsec.sys [19/04/2005 12:57 ص 20352]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21/12/2007 08:21 ص 33800]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21/12/2007 08:21 ص 468224]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [03/07/2009 11:56 م 55152]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [31/08/2008 09:29 ص 108032]
R3 OEM02Afx;Provides a software interface to control audio effects of OEM002 camera.;c:\windows\system32\drivers\OEM02Afx.sys [31/08/2008 09:30 ص 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [31/08/2008 09:30 ص 235520]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [31/08/2008 09:30 ص 7424]
S2 SQQQRTRR;SQQQRTRR;\??\c:\windows\system32\drivers\SQQQRTRR.sys --> c:\windows\system32\drivers\SQQQRTRR.sys [?]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 06:08 م 533360]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [28/09/2008 11:10 م 29744]
S4 winser;winser;c:\windows\system32\winsersec.exe [14/04/2005 01:37 ص 53248]
.
Contents of the 'Scheduled Tasks' folder
2009-07-04 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 19:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-04 04:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-73586283-926492609-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="ba"
"b"="NOTEPAD.EXE"
[HKEY_USERS\S-1-5-21-73586283-926492609-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithProgids]
"ctt_auto_file"=hex(0):
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3672)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\SigmaTel\C-Major Audio\WDM\stacsv.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2009-07-04 4:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-04 01:20
Pre-Run: 45,623,242,752 bytes free
Post-Run: 45,828,333,568 bytes free
148 --- E O F --- 2009-05-21 08:27
ياااربي سهل
