ComboFix 09-07-09.08 - مستخدم جديد 07/10/2009 17:29.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.2037.1552 [GMT 3:00]
Running from: c:\documents and settings\مستخدم جديد\سطح المكتب\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Internet Saving Optimizer
c:\program files\Internet Saving Optimizer\3.3.0.4160\adwpx.exe
c:\program files\Internet Saving Optimizer\3.3.0.4160\Data\config.md
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\chrome.manifest
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\chrome\content\NPAddOn.js
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\chrome\content\NPAddOn.xul
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\chrome\NPAddOn.jar
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\components\NPFFAddOn.dll
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\components\NPFFAddOn.xpt
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\components\NPFFHelperComponent.js
c:\program files\Internet Saving Optimizer\3.3.0.4160\FF\install.rdf
c:\program files\Internet Saving Optimizer\3.3.0.4160\NPCommon.dll
c:\program files\Internet Saving Optimizer\3.3.0.4160\NPIEAddOn.dll
c:\program files\Internet Saving Optimizer\3.3.0.4160\unins000.dat
c:\program files\Internet Saving Optimizer\3.3.0.4160\unins000.exe
c:\program files\Media Access Startup
c:\program files\Media Access Startup\1.3.0.790\Data\config.md
c:\program files\Media Access Startup\1.3.0.790\FF\chrome.manifest
c:\program files\Media Access Startup\1.3.0.790\FF\chrome\content\HPAddOn.js
c:\program files\Media Access Startup\1.3.0.790\FF\chrome\content\HPAddOn.xul
c:\program files\Media Access Startup\1.3.0.790\FF\chrome\HPAddOn.jar
c:\program files\Media Access Startup\1.3.0.790\FF\components\HPFFAddOn.dll
c:\program files\Media Access Startup\1.3.0.790\FF\components\HPFFAddOn.xpt
c:\program files\Media Access Startup\1.3.0.790\FF\components\HPFFHelperComponent.js
c:\program files\Media Access Startup\1.3.0.790\FF\install.rdf
c:\program files\Media Access Startup\1.3.0.790\HPCommon.dll
c:\program files\Media Access Startup\1.3.0.790\HPIEAddOn.dll
c:\program files\Media Access Startup\1.3.0.790\hppx.exe
c:\program files\Media Access Startup\1.3.0.790\MAHelper.exe
c:\program files\Media Access Startup\1.3.0.790\unins000.dat
c:\program files\Media Access Startup\1.3.0.790\unins000.exe
c:\program files\System Search Dispatcher\1.2.0.750\ssd.dll
C:\temp.temp
.
((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))
.
2009-07-10 14:20 . 2009-07-10 14:20 -------- d-----w- c:\documents and settings\All Users\Application Data\CrystalIdea Software
2009-07-09 10:24 . 2009-07-09 10:24 -------- d-----w- c:\program files\Trend Micro
2009-07-09 09:17 . 2009-07-10 14:14 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\IDM
2009-07-09 09:17 . 2009-07-10 14:14 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\DMCache
2009-07-09 09:17 . 2009-07-10 14:15 -------- d-----w- c:\program files\Internet Download Manager
2009-07-09 09:10 . 2009-07-09 09:10 -------- d-----w- c:\program files\FormatFactory
2009-07-07 16:44 . 2009-07-07 16:44 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-07-07 15:05 . 2009-07-07 15:05 -------- d-sh--w- c:\documents and settings\مستخدم جديد\PrivacIE
2009-07-07 15:03 . 2009-07-07 15:03 -------- d-sh--w- c:\documents and settings\مستخدم جديد\IETldCache
2009-07-07 14:56 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-07-07 14:56 . 2009-07-07 14:56 -------- d-----w- c:\windows\ie8updates
2009-07-07 14:56 . 2009-04-30 21:13 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-07-07 14:56 . 2009-04-30 21:13 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-07-07 14:56 . 2009-04-30 21:13 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-07-07 14:56 . 2009-04-30 21:13 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-07 14:55 . 2009-07-07 14:56 -------- d-----w- c:\windows\system32\ar-SA
2009-07-07 14:55 . 2009-07-07 14:55 -------- dc-h--w- c:\windows\ie8
2009-07-06 19:38 . 2009-07-06 19:38 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\TeamViewer
2009-07-06 19:38 . 2009-07-06 19:38 -------- d-----w- c:\documents and settings\مستخدم جديد\temp
2009-07-06 19:11 . 2009-07-06 19:11 -------- d-----w- c:\program files\Windows Live Safety Center
2009-07-06 18:53 . 2009-07-06 18:53 -------- d-----w- c:\documents and settings\مستخدم جديد\Local Settings\Application Data\ESET
2009-07-06 07:29 . 2009-07-06 07:29 -------- d-----w- c:\documents and settings\مستخدم جديد\Local Settings\Application Data\Internet Saving Optimizer
2009-07-06 07:29 . 2009-07-06 07:29 -------- d-----w- c:\documents and settings\مستخدم جديد\Local Settings\Application Data\_
2009-07-06 07:28 . 2009-07-06 07:28 -------- d-----w- c:\documents and settings\مستخدم جديد\Local Settings\Application Data\Media Access Startup
2009-07-06 07:28 . 2009-07-06 07:28 -------- d-----w- c:\program files\System Search Dispatcher
2009-07-06 07:28 . 2009-07-06 07:28 -------- d-----w- c:\documents and settings\مستخدم جديد\Local Settings\Application Data\DoubleD
2009-06-29 07:16 . 2004-08-03 21:55 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-06-29 07:16 . 2004-08-03 21:55 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-06-29 07:00 . 2009-06-29 07:00 -------- d-----w- c:\program files\MSXML 4.0
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-10 14:25 . 2001-09-19 08:00 40118 ----a-w- c:\windows\system32\perfc001.dat
2009-07-10 14:25 . 2001-09-19 08:00 251674 ----a-w- c:\windows\system32\perfh001.dat
2009-07-10 14:21 . 2009-06-29 04:18 16608 ----a-w- c:\windows\gdrv.sys
2009-07-09 08:51 . 2009-06-29 05:27 -------- d-----w- c:\program files\MSN Messenger
2009-07-06 18:53 . 2009-06-29 05:27 -------- d-----w- c:\program files\Circle Developement
2009-07-02 23:49 . 2009-06-29 05:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-06-30 07:40 . 2009-06-29 04:01 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-29 06:50 . 2009-06-29 06:50 2678 ----a-w- c:\windows\java\Packages\Data\FHBJ3JHN.DAT
2009-06-29 06:50 . 2009-06-29 06:50 2678 ----a-w- c:\windows\java\Packages\Data\YSXB9BBF.DAT
2009-06-29 06:50 . 2009-06-29 06:50 2678 ----a-w- c:\windows\java\Packages\Data\MIYO977R.DAT
2009-06-29 06:50 . 2009-06-29 06:50 2678 ----a-w- c:\windows\java\Packages\Data\LJ77RFDF.DAT
2009-06-29 06:50 . 2009-06-29 06:50 2678 ----a-w- c:\windows\java\Packages\Data\GHF57DZB.DAT
2009-06-29 06:04 . 2009-06-29 05:30 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\Apple Computer
2009-06-29 05:51 . 2009-06-29 05:51 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\ESET
2009-06-29 05:50 . 2009-06-29 05:50 -------- d-----w- c:\program files\ESET
2009-06-29 05:50 . 2009-06-29 05:50 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-06-29 05:39 . 2009-06-29 05:39 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\Ahead
2009-06-29 05:39 . 2009-06-29 05:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
2009-06-29 05:38 . 2009-06-29 05:38 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-29 05:38 . 2009-06-29 05:38 -------- d-----w- c:\program files\Nero
2009-06-29 05:38 . 2009-06-29 05:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-06-29 05:34 . 2009-06-29 05:33 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\Nokia
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\PC Suite
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\program files\Common Files\PCSuite
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\program files\Common Files\Nokia
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\program files\Nokia
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\program files\DIFX
2009-06-29 05:33 . 2009-06-29 05:33 -------- d-----w- c:\program files\PC Connectivity Solution
2009-06-29 05:33 . 2009-06-29 05:33 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{2B8BEBBF-73A0-497D-9900-8474D022AB3F}\Installer\CommonCustomActions\UninstCCD.exe
2009-06-29 05:33 . 2009-06-29 05:33 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{2B8BEBBF-73A0-497D-9900-8474D022AB3F}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-06-29 05:33 . 2009-06-29 05:33 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{2B8BEBBF-73A0-497D-9900-8474D022AB3F}\Installer\CommonCustomActions\UninstPCS.exe
2009-06-29 05:32 . 2009-06-29 05:32 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-29 05:32 . 2009-06-29 05:32 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-29 05:32 . 2009-06-29 05:32 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-29 05:32 . 2009-06-29 05:31 -------- d-----w- c:\program files\Common Files\COWON
2009-06-29 05:32 . 2009-06-29 05:31 -------- d-----w- c:\program files\JetAudio
2009-06-29 05:31 . 2009-06-29 04:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-29 05:31 . 2009-06-29 05:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-06-29 05:30 . 2009-06-29 05:30 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-29 05:30 . 2009-06-29 05:30 -------- d-----w- c:\program files\Real
2009-06-29 05:30 . 2009-06-29 05:30 -------- d-----w- c:\program files\Common Files\Real
2009-06-29 05:30 . 2009-06-29 05:30 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-29 05:30 . 2009-06-29 05:30 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-29 05:29 . 2009-06-29 05:29 -------- d-----w- c:\program files\QuickTime
2009-06-29 05:29 . 2009-06-29 05:29 -------- d-----w- c:\program files\iPod
2009-06-29 05:29 . 2009-06-29 05:29 -------- d-----w- c:\program files\iTunes
2009-06-29 05:29 . 2009-06-29 05:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-29 05:29 . 2009-06-29 04:21 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-29 05:28 . 2009-06-29 05:28 2232 ----a-w- c:\windows\java\Packages\Data\Z9ZT3NDN.DAT
2009-06-29 05:28 . 2009-06-29 05:28 155995 ----a-w- c:\windows\java\Packages\N133PB5V.ZIP
2009-06-29 05:27 . 2009-06-29 05:27 -------- d-----w- c:\program files\Windows Live
2009-06-29 05:27 . 2009-06-29 05:27 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-29 05:27 . 2009-06-29 04:12 94632 ----a-w- c:\documents and settings\مستخدم جديد\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 05:27 . 2009-06-29 05:22 -------- d-----w- c:\program files\برنامج مجلة الدعوة الألكتونية
2009-06-29 05:22 . 2009-06-29 05:27 720896 ----a-w- c:\windows\iun6002.exe
2009-06-29 05:21 . 2009-06-29 05:21 -------- d-----w- c:\program files\Microsoft.NET
2009-06-29 05:21 . 2009-06-29 05:21 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-06-29 05:21 . 2009-06-29 05:21 -------- d-----w- c:\program files\Microsoft Works
2009-06-29 05:21 . 2009-06-29 05:21 172032 ------w- c:\windows\Setup1.exe
2009-06-29 05:20 . 2009-06-29 05:20 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-29 04:27 . 2009-06-29 04:25 -------- d-----w- c:\program files\Realtek
2009-06-29 04:27 . 2009-06-29 04:27 -------- d-----w- c:\documents and settings\مستخدم جديد\Application Data\InstallShield
2009-06-29 04:25 . 2009-06-29 04:25 315392 ----a-w- c:\windows\HideWin.exe
2009-06-29 04:22 . 2009-06-29 04:22 -------- d-----w- c:\program files\Intel
2009-06-29 04:21 . 2009-06-29 04:21 -------- d-----w- c:\program files\Browser Configuration Utility
2009-06-29 04:21 . 2009-06-29 04:21 -------- d-----w- c:\program files\Gigabyte
2009-06-29 04:02 . 2009-06-29 04:02 -------- d-----w- c:\program files\microsoft frontpage
2009-06-29 03:59 . 2009-06-29 03:59 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-24 20:20 . 2009-06-24 20:20 1547776 ----a-w- c:\windows\system32\sfcfiles.dll
2009-05-13 05:02 . 2004-08-03 18:55 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:42 . 2004-08-03 18:55 344064 ----a-w- c:\windows\system32\localspl.dll
2009-04-19 20:08 . 2004-08-03 18:46 1846528 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:12 . 2004-08-03 18:55 584192 ----a-w- c:\windows\system32\rpcrt4.dll
.
------- Sigcheck -------
[-] 2008-04-14 15:59 1571328 6B8B7B206FA0C50B4CF99EEE2AC14BC7 c:\windows\SoftwareDistribution\Download\7ddc38335814ac754f158e6c7fa2b6cb\sfcfiles.dll
[-] 2009-06-24 20:20 1547776 6E932D21E116B51ED9D5157E31C48E33 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-06-18 1122816]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m–|\ü" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-10-06 278528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-06-29 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-29 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R0 ulsata2;ulsata2;c:\windows\system32\drivers\ulsata2.sys [07/04/2009 02:42 م 124928]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06/02/2009 02:23 م 106208]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [06/02/2009 02:23 م 727720]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [29/06/2009 07:21 ص 80392]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = hxxp://www.eset.com/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-10 17:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-07-10 17:33
ComboFix-quarantined-files.txt 2009-07-10 14:33
Pre-Run: 111,811,039,232 bytes free
Post-Run: 113,926,168,576 bytes free
223 --- E O F --- 2009-07-07 14:57
