ComboFix 09-07-08.04 - pcw 07/09/2009 2:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1014.610 [GMT 3:00]
Running from: c:\documents and settings\pcw\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\pcw\LOCALS~1\Temp\Rar$EX00.688\BvT.Live.TV.3.0.0.2.Portable\BvT.Live.TV.3.0.0.2.Portable.exe
c:\documents and settings\pcw\Local Settings\Temp\Rar$EX00.688\BvT.Live.TV.3.0.0.2.Portable\BvT.Live.TV.3.0.0.2.Portable.exe
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((( Files Created from 2009-06-08 to 2009-07-08 )))))))))))))))))))))))))))))))
.
2009-07-08 22:45 . 2009-07-08 22:45 7680 ----a-w- c:\documents and settings\pcw\Application Data\Thinstall\BvT Live Tv 3.0\4000002e00002i\BvtUtility.exe
2009-07-08 22:45 . 2009-07-08 22:45 7680 ----a-w- c:\documents and settings\pcw\Application Data\Thinstall\BvT Live Tv 3.0\4000008000002i\Splash Screen.exe
2009-07-08 22:45 . 2009-07-08 22:45 -------- d-----w- c:\documents and settings\pcw\Local Settings\Application Data\Thinstall
2009-06-21 15:22 . 2009-06-21 20:58 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-06-13 15:00 . 2009-06-13 15:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle
2009-06-13 15:00 . 2002-03-19 07:29 14165 ------w- c:\windows\system32\drivers\Pclepci.sys
2009-06-09 19:55 . 2009-06-09 19:55 -------- d-----w- c:\documents and settings\LocalService\Application Data\PC Suite
2009-06-09 19:40 . 2009-06-09 19:40 -------- d-----w- c:\documents and settings\pcw\Application Data\PCSuiteMMSTemp
2009-06-09 19:36 . 2004-08-03 20:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2009-06-09 19:36 . 2004-08-03 20:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2009-06-09 19:23 . 2007-09-06 23:10 21733256 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Nokia_PC_Suite_683_rel_14_1_ara_web.exe
2009-06-09 19:23 . 2009-06-09 19:23 9728 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\CommonCustomActions\UninstPCS.exe
2009-06-09 19:23 . 2009-06-09 19:23 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\CommonCustomActions\UninstCCD.exe
2009-06-09 19:23 . 2009-06-09 19:23 15360 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\CommonCustomActions\UninstPCSFEMsi.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 23:26 . 2009-06-02 16:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-07-08 22:47 . 2008-08-15 20:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-08 22:45 . 2008-12-01 19:10 -------- d-----w- c:\documents and settings\pcw\Application Data\Thinstall
2009-07-08 18:37 . 2004-08-04 10:00 41160 ----a-w- c:\windows\system32\perfc001.dat
2009-07-08 18:37 . 2004-08-04 10:00 254850 ----a-w- c:\windows\system32\perfh001.dat
2009-07-08 18:07 . 2009-06-02 16:21 4772 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-08 18:07 . 2009-06-02 16:21 466976 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-08 18:07 . 2009-05-26 23:29 3619872 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-08 18:07 . 2009-05-26 23:29 31456 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-08 18:05 . 2009-01-19 21:42 -------- d-----w- c:\documents and settings\pcw\Application Data\cleaner
2009-06-21 19:53 . 2008-11-26 19:43 -------- d-----w- c:\program files\ABBYY FineReader 4.0 Sprint
2009-06-21 15:31 . 2008-08-14 08:07 -------- d-----w- c:\program files\DVDVideoSoft
2009-06-18 21:45 . 2008-01-24 06:55 -------- d-----w- c:\program files\Dell
2009-06-13 15:02 . 2008-01-24 11:19 -------- d-----w- c:\program files\BandRich
2009-06-09 19:55 . 2009-01-26 11:00 -------- d-----w- c:\documents and settings\pcw\Application Data\DataLayer
2009-06-09 19:53 . 2009-01-29 04:43 -------- d-----w- c:\program files\Nokia
2009-06-09 19:39 . 2009-01-26 10:58 -------- d-----w- c:\documents and settings\pcw\Application Data\PC Suite
2009-06-09 19:23 . 2009-01-26 11:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-06-08 20:27 . 2009-06-08 20:27 390664 ----a-w- c:\documents and settings\pcw\Application Data\Real\RealPlayer\setup\AU_setup.exe
2009-06-02 20:57 . 2009-06-02 20:57 390664 ----a-w- c:\documents and settings\pcw\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-06-02 16:39 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-02 16:39 . 2009-06-02 16:22 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-02 16:39 . 2009-06-02 16:22 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-02 16:39 . 2009-06-02 16:39 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-06-02 16:39 . 2009-06-02 16:39 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-02 16:39 . 2009-06-02 16:39 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-06-02 16:21 . 2009-06-02 16:21 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-02 16:19 . 2009-06-02 16:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-02 16:18 . 2009-05-31 21:29 -------- d-----w- c:\documents and settings\pcw\Application Data\TeamViewer
2009-06-01 21:30 . 2008-01-24 07:16 -------- d-----w- c:\program files\ESET
2009-06-01 21:20 . 2009-06-01 21:20 -------- d-----w- c:\documents and settings\pcw\Application Data\ESET_Smart_Security_3.0.669
2009-06-01 05:06 . 2009-06-01 04:58 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-06-01 05:00 . 2009-06-01 05:00 -------- d-----w- c:\documents and settings\pcw\Application Data\ESET
2009-05-31 21:26 . 2009-05-31 21:26 -------- d-----w- c:\program files\TeamViewer
2009-05-29 07:53 . 2009-05-29 07:53 -------- d-----w- c:\program files\Trend Micro
2009-05-26 21:20 . 2009-05-26 21:20 12800 ----a-w- c:\documents and settings\pcw\Application Data\Thinstall\Inpaint\4000002800002i\igfxsrvc.exe
2009-05-26 21:08 . 2009-05-26 21:08 -------- d-----w- c:\program files\Topaz Labs
2009-05-24 15:13 . 2009-05-24 15:13 1172 ----a-w- c:\windows\mozver.dat
2009-04-28 22:20 . 2009-04-14 22:25 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-04-19 21:35 . 2009-04-19 21:35 4096 ----a-w- c:\windows\d3dx.dat
2009-04-17 21:07 . 2009-04-17 21:07 26694 ----a-r- c:\documents and settings\pcw\Application Data\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
2009-04-17 21:07 . 2009-04-17 21:07 26694 ----a-r- c:\documents and settings\pcw\Application Data\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
2009-04-17 21:07 . 2009-04-17 21:07 26694 ----a-r- c:\documents and settings\pcw\Application Data\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
2009-04-17 21:07 . 2009-04-17 21:07 26694 ----a-r- c:\documents and settings\pcw\Application Data\Microsoft\Installer\{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}\ARPPRODUCTICON.exe
2005-08-27 12:26 . 2008-08-14 08:20 1581056 ----a-w- c:\program files\FlashPlayer8.exe
2008-04-07 07:07 . 2008-08-14 21:32 67696 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-04-07 07:07 . 2008-08-14 21:32 54376 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-04-07 07:07 . 2008-08-14 21:32 34952 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-04-07 07:07 . 2008-08-14 21:32 46720 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-04-07 07:07 . 2008-08-14 21:32 172144 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-06-22 1384448]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-24 185896]
"Vistadrv"="c:\program files\SiCoDriVeT\vsdrv.exe" [2006-07-30 121089]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-03 1032192]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-06-02 206088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= msconfig.exe
"2"= gpedit.msc
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^سرعة تشغيل Adobe Reader.lnk]
backup=c:\windows\pss\سرعة تشغيل Adobe Reader.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys --> c:\windows\system32\DRIVERS\br3gmdm.sys [?]
S3 CD-Lock;CD-Lock; [x]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\pcw\Application Data\Mozilla\Firefox\Profiles\8vrtzzw2.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?o=13166&l=dis
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-09 02:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1320)
c:\windows\System32\BCMLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-08 2:28 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-08 23:28
Pre-Run: 14,564,675,584 bytes free
Post-Run: 14,759,661,568 bytes free
181
