هذا تقرير الأداة تفضل:
ComboFix 09-07-13.01 - home user 07/14/2009 13:28.10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1023.681 [GMT 3:00]
Running from: c:\documents and settings\home user\سطح المكتب\ComboFix.exe
AV: AVG 7.5.516 *On-access scanning disabled* (Outdated) {41564737-3200-1071-989B-0000E87B4FB1}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\f4584.msp
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-06-14 to 2009-07-14 )))))))))))))))))))))))))))))))
.
2009-07-14 03:02 . 2009-07-14 03:02 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-14 03:00 . 2009-07-13 10:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-14 03:00 . 2009-07-14 05:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-14 03:00 . 2009-07-13 10:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-13 11:51 . 2009-07-14 10:32 27299872 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-10 01:25 . 2009-07-02 17:21 3561744 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\setup\mbam-setup.exe
2009-07-07 22:32 . 2009-07-08 05:07 152576 ----a-w- c:\documents and settings\home user\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-05 18:02 . 2009-07-05 18:02 -------- d-----w- c:\program files\Real_SC
2009-07-05 04:49 . 2009-07-05 04:49 -------- d-----w- c:\documents and settings\home user\Application Data\QuickScan
2009-07-05 04:08 . 2009-07-05 04:08 -------- d-----w- c:\program files\LtUcx
2009-07-04 14:56 . 2009-07-04 14:56 -------- d-----w- c:\documents and settings\home user\Local Settings\Application Data\Ares
2009-07-02 02:17 . 2009-07-02 02:17 61440 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%SystemSystem%\drivers\lyqpxgq.sys
2009-07-02 02:17 . 2009-07-02 02:17 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\10000006600002h\regedit.exe
2009-06-26 10:58 . 2009-06-26 11:00 -------- dc-h--w- c:\windows\ie8
2009-06-26 09:41 . 2009-06-26 09:41 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\1000000b00002h\rundll32.exe
2009-06-26 09:41 . 2009-06-26 09:41 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\4000009c00002h\IEXPLORE.EXE
2009-06-26 09:39 . 2009-06-26 09:39 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\40000013d00002h\mbam.exe
2009-06-23 22:32 . 2009-06-23 22:32 -------- d-----w- c:\program files\aseel
2009-06-23 16:04 . 2009-06-23 16:04 7168 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\eTeSoft Video Converter 1.00.8.115\300000003400002i\dwwin.exe
2009-06-23 11:35 . 2009-07-14 00:00 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-23 11:06 . 2009-07-01 15:49 -------- d-----w- c:\program files\Your Uninstaller 2008
2009-06-20 02:06 . 2009-07-10 15:35 -------- d-----w- c:\documents and settings\home user\Application Data\dvdcss
2009-06-20 01:40 . 2009-07-13 08:11 -------- d-----w- c:\documents and settings\home user\Application Data\vlc
2009-06-17 22:44 . 2009-06-17 22:44 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-17 15:47 . 2009-06-17 15:47 -------- d-----w- c:\documents and settings\home user\Application Data\URSoft
2009-06-17 15:29 . 2009-07-14 00:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-16 15:02 . 2009-06-16 15:02 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-16 15:02 . 2009-06-22 22:58 -------- d-----w- c:\documents and settings\home user\Application Data\skypePM
2009-06-16 14:12 . 2009-06-22 23:09 -------- d-----w- c:\documents and settings\home user\Application Data\Skype
2009-06-16 14:12 . 2009-06-16 14:12 -------- d-----w- c:\program files\Common Files\Skype
2009-06-16 14:12 . 2009-06-16 14:12 -------- d-----r- c:\program files\Skype
2009-06-16 14:12 . 2009-06-16 14:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-14 10:22 . 2009-02-16 14:36 92816 -c--a-w- c:\documents and settings\home user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-14 10:20 . 2009-07-13 11:51 305480 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-14 10:19 . 2009-03-16 16:34 -------- d-----w- c:\documents and settings\home user\Application Data\cleaner
2009-07-14 03:00 . 2009-03-15 12:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-13 11:57 . 2009-02-16 19:07 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-13 11:57 . 2009-02-16 19:07 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-13 11:51 . 2009-03-12 17:45 117760 ----a-w- c:\documents and settings\home user\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-13 11:49 . 2009-02-16 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-07-13 08:11 . 2009-05-26 12:23 -------- d-----w- c:\program files\MPlayer for Windows
2009-07-10 15:35 . 2009-05-15 15:09 -------- d-----w- c:\documents and settings\home user\Application Data\Spider Player
2009-07-08 02:05 . 2009-07-08 02:05 2232 ----a-w- c:\windows\Java\Packages\Data\VX3B7H77.DAT
2009-07-08 02:05 . 2009-07-08 02:05 155995 ----a-w- c:\windows\Java\Packages\85NR797V.ZIP
2009-07-08 02:05 . 2009-07-08 02:05 2678 ----a-w- c:\windows\Java\Packages\Data\SJFR7TVR.DAT
2009-07-08 02:05 . 2009-07-08 02:05 2678 ----a-w- c:\windows\Java\Packages\Data\465VVB3H.DAT
2009-07-08 02:05 . 2009-07-08 02:05 2678 ----a-w- c:\windows\Java\Packages\Data\YR1JH3Z5.DAT
2009-07-08 02:05 . 2009-07-08 02:05 2678 ----a-w- c:\windows\Java\Packages\Data\AUDZ3BNH.DAT
2009-07-08 02:05 . 2009-07-08 02:05 2678 ----a-w- c:\windows\Java\Packages\Data\2ENZ57TV.DAT
2009-07-07 16:13 . 2009-03-20 13:23 6076920 -c--a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\t3.dll
2009-06-28 12:57 . 2009-02-25 13:53 -------- d-----w- c:\documents and settings\home user\Application Data\Thinstall
2009-06-26 09:39 . 2009-04-24 08:54 692496 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%ProgramFilesDir%\Malwarebytes' Anti-Malware\unins000.exe
2009-06-26 09:33 . 2009-04-24 08:53 3561743 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%Common AppData%\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-23 22:32 . 2008-04-14 15:59 1388544 -c--a-w- c:\windows\system32\msvbvm60.dll
2009-06-19 17:41 . 2001-09-19 12:00 66028 ----a-w- c:\windows\system32\perfc001.dat
2009-06-19 17:41 . 2001-09-19 12:00 364174 ----a-w- c:\windows\system32\perfh001.dat
2009-06-19 15:59 . 2009-05-24 21:59 -------- d-----w- c:\program files\temp
2009-06-17 22:44 . 2009-02-16 15:33 -------- d-----w- c:\program files\Common Files\Real
2009-06-17 08:27 . 2009-04-24 08:54 38160 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%SystemSystem%\drivers\mbamswissarmy.sys
2009-06-17 08:27 . 2009-04-24 08:54 79632 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%ProgramFilesDir%\Malwarebytes' Anti-Malware\zlib.dll
2009-06-17 08:27 . 2009-04-24 08:54 195856 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%ProgramFilesDir%\Malwarebytes' Anti-Malware\mbamservice.exe
2009-06-17 08:27 . 2009-04-24 08:54 414992 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%ProgramFilesDir%\Malwarebytes' Anti-Malware\mbamgui.exe
2009-06-17 08:27 . 2009-04-24 08:54 1287440 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%ProgramFilesDir%\Malwarebytes' Anti-Malware\mbam.exe
2009-06-17 08:27 . 2009-04-24 08:54 19096 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%SystemSystem%\drivers\mbam.sys
2009-06-16 16:57 . 2009-03-14 01:16 -------- d-----w- c:\program files\MSECache
2009-06-16 16:45 . 2009-06-11 03:58 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-16 16:45 . 2009-06-07 16:04 -------- d-----w- c:\program files\FastStone Photo Resizer
2009-06-14 15:48 . 2009-05-18 11:12 718880 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2service.exe
2009-06-11 13:22 . 2009-06-11 13:22 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-06-11 12:37 . 2009-06-11 12:37 -------- d-----w- c:\program files\CCleaner
2009-06-09 23:47 . 2009-02-16 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-08 15:34 . 2009-06-08 15:34 152576 ----a-w- c:\documents and settings\home user\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-08 13:29 . 2009-06-08 13:29 33408 ----a-w- c:\windows\system32\drivers\fsbts.sys
2009-06-08 13:28 . 2009-06-08 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-06-08 11:38 . 2009-05-18 11:14 553600 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\engine.dll
2009-06-08 11:37 . 2009-05-18 11:13 521360 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2framework.dll
2009-06-08 11:37 . 2009-05-18 11:12 586888 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2update.dll
2009-06-07 16:05 . 2009-06-07 16:05 -------- d-----w- c:\documents and settings\home user\Application Data\FastStone
2009-06-05 11:29 . 2009-06-05 11:29 -------- d-----w- c:\program files\MSBuild
2009-06-05 11:29 . 2009-06-05 11:29 -------- d-----w- c:\program files\Reference Assemblies
2009-06-05 00:28 . 2009-06-05 00:28 -------- d-----w- c:\documents and settings\All Users\Application Data\CCTV
2009-06-05 00:05 . 2009-02-16 15:29 -------- d-----w- c:\program files\Windows Live
2009-06-05 00:05 . 2009-06-05 00:05 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-03 06:16 . 2009-02-16 15:28 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 22:14 . 2009-06-02 22:14 -------- d-----w- c:\documents and settings\home user\Application Data\Uniblue
2009-06-01 12:55 . 2009-03-08 18:22 -------- d-----w- c:\program files\Unlocker
2009-05-31 05:57 . 2009-05-31 05:57 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\40000013c00002h\mbam.exe
2009-05-31 05:57 . 2009-05-31 05:57 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\4000006e00002h\mbamgui.exe
2009-05-31 05:55 . 2009-05-31 05:54 3371384 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%Profile%\Local Settings\Temporary Internet Files\Content.IE5\G0W68B0X\mbam-setup[1].exe
2009-05-29 13:15 . 2009-05-29 13:15 203776 ----a-w- c:\windows\system32\clrviddc.dll
2009-05-27 00:30 . 2009-05-27 00:30 13824 ----a-w- c:\windows\system32\drivers\splitcam.sys
2009-05-27 00:30 . 2009-05-27 00:30 -------- d-----w- c:\program files\SplitCam
2009-05-26 16:50 . 2009-06-09 23:47 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-24 16:57 . 2009-05-24 16:57 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-24 16:57 . 2009-05-24 16:57 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-24 16:57 . 2009-05-24 16:57 -------- d-----w- c:\program files\Real
2009-05-24 16:44 . 2009-05-23 14:40 -------- d-----w- c:\program files\Common Files\delet
2009-05-24 01:48 . 2009-05-24 01:46 -------- d-----w- c:\program files\Windows Live Safety Center
2009-05-24 00:37 . 2009-05-23 23:25 -------- d-----w- c:\program files\Raptor
2009-05-23 15:34 . 2009-03-15 16:25 -------- d-----w- c:\documents and settings\home user\Application Data\IDM
2009-05-18 11:14 . 2009-05-18 11:14 224400 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2freecontmenu.dll
2009-05-18 11:14 . 2009-05-18 11:14 302736 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2freecontmenu64.dll
2009-05-18 11:13 . 2009-05-18 11:14 1191536 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2free.exe
2009-05-18 11:13 . 2009-05-18 11:13 101000 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2upd.exe
2009-05-18 11:13 . 2009-05-18 11:13 253072 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\a-squared Free 4.0\%ProgramFilesDir%\A-SQUARED FREE\a2cmd.exe
2009-05-15 15:09 . 2009-05-15 15:08 -------- d-----w- c:\program files\Spider Player
2009-05-13 05:02 . 2004-08-03 21:55 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2004-08-03 21:55 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-24 11:02 . 2009-04-24 11:02 61440 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%SystemSystem%\drivers\dclnv.sys
2009-04-24 11:02 . 2009-04-24 11:02 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\4000006500002h\mbam-dor.exe
2009-04-24 08:54 . 2009-04-24 08:54 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\40000013b00002h\mbam.exe
2009-04-24 08:54 . 2009-04-24 08:54 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\1000000500002h\regsvr32.exe
2009-04-24 08:54 . 2009-04-24 08:54 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\4000006a00002h\mbamgui.exe
2009-04-24 08:54 . 2009-04-24 08:54 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\40000013a00002h\mbam.exe
2009-04-24 08:53 . 2009-04-24 08:53 8704 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\4000001400002h\mbam-setup.exe
2009-04-24 08:53 . 2009-04-24 08:53 2967800 ----a-w- c:\documents and settings\home user\Application Data\Thinstall\Malwarebytes' Anti-Malware\%Profile%\Local Settings\Temporary Internet Files\Content.IE5\GFV6GXC2\mbam-setup[1].exe
2009-04-19 19:47 . 2004-08-03 21:46 1847040 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:52 . 2004-08-03 21:55 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-03 03:14 . 2009-06-20 01:50 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
((((((((((((((((((((((((((((( SnapShot_2009-07-02_04.00.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-08 02:05 . 2002-02-18 07:23 21264 c:\windows\system32\msjdbc10.dll
+ 2009-07-08 02:05 . 2002-02-18 07:23 15120 c:\windows\system32\jdbgmgr.exe
+ 2009-07-08 02:05 . 2002-02-18 07:22 63248 c:\windows\system32\javaprxy.dll
- 2009-02-16 14:27 . 2009-07-02 00:50 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-16 14:27 . 2009-07-13 11:36 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-02-16 14:27 . 2009-07-02 00:50 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-16 14:27 . 2009-07-13 11:36 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-16 14:27 . 2009-07-13 11:36 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-16 14:27 . 2009-07-02 00:50 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-07-08 02:05 . 2002-02-18 07:23 49424 c:\windows\system32\clspack.exe
- 2009-03-05 11:11 . 2009-05-26 13:39 90112 c:\windows\system32\agsaami.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 90112 c:\windows\system32\agsaami.dll
+ 2009-07-08 02:05 . 2002-02-18 07:23 46352 c:\windows\setdebug.exe
+ 2009-03-22 13:19 . 2009-03-22 13:19 23040 c:\windows\Installer\f1293.msi
+ 2009-03-22 13:18 . 2009-03-22 13:18 25088 c:\windows\Installer\f123d.msi
+ 2009-03-22 13:18 . 2009-03-22 13:18 28160 c:\windows\Installer\f1235.msi
+ 2009-03-22 13:18 . 2009-03-22 13:18 83456 c:\windows\Installer\f121c.msi
+ 2009-03-22 13:18 . 2009-03-22 13:18 59904 c:\windows\Installer\f1214.msi
+ 2008-10-22 19:20 . 2008-10-22 19:20 28160 c:\windows\Installer\9fcb11.msp
+ 2008-10-22 19:17 . 2008-10-22 19:17 98304 c:\windows\Installer\9fcb10.msp
+ 2009-06-05 11:37 . 2009-06-05 11:37 79360 c:\windows\Installer\9fcaf5.msi
+ 2008-07-29 18:07 . 2008-07-29 18:07 23040 c:\windows\Installer\9842f1.msp
+ 2009-06-05 11:26 . 2009-06-05 11:26 88576 c:\windows\Installer\936fdc.msi
+ 2009-03-13 07:07 . 2009-03-13 07:07 30720 c:\windows\Installer\4c37fe.msi
+ 2006-01-18 14:50 . 2006-01-18 14:50 57344 c:\windows\Downloaded Program Files\IMSInfo.dll
+ 2009-07-08 02:05 . 2002-02-18 04:35 6550 c:\windows\jautoexp.dat
+ 2009-07-08 02:05 . 2002-02-18 07:23 171792 c:\windows\system32\wjview.exe
+ 2009-07-08 02:05 . 2002-02-18 07:23 286992 c:\windows\system32\vmhelper.dll
+ 2009-07-08 02:05 . 2002-02-18 07:23 945936 c:\windows\system32\msjava.dll
+ 2009-07-08 02:05 . 2002-02-18 07:23 154384 c:\windows\system32\msawt.dll
- 2009-03-05 11:11 . 2009-05-26 13:39 196608 c:\windows\system32\maag.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 196608 c:\windows\system32\maag.dll
- 2009-03-05 11:11 . 2009-06-23 22:32 237568 c:\windows\system32\lame_enc.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 237568 c:\windows\system32\lame_enc.dll
+ 2009-07-08 02:05 . 2002-02-18 07:23 172304 c:\windows\system32\jview.exe
+ 2009-07-08 02:05 . 2002-02-18 07:22 171280 c:\windows\system32\jit.dll
+ 2009-07-08 02:05 . 2002-02-18 07:22 404752 c:\windows\system32\javart.dll
+ 2009-07-08 02:05 . 2002-02-18 07:22 139536 c:\windows\system32\javaee.dll
+ 2009-07-08 02:05 . 2002-02-18 07:22 187152 c:\windows\system32\javacypt.dll
+ 2009-02-16 17:11 . 2009-07-14 10:21 336256 c:\windows\system32\FNTCACHE.DAT
+ 2009-07-08 02:05 . 2002-02-18 04:34 313856 c:\windows\system32\dx3j.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 823296 c:\windows\system32\agsaamh.dll
- 2009-03-05 11:11 . 2009-06-23 22:32 823296 c:\windows\system32\agsaamh.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 610304 c:\windows\system32\agsaamg.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 671869 c:\windows\system32\agsaame.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 643072 c:\windows\system32\agsaamd.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 372736 c:\windows\system32\agsaamc.dll
- 2009-03-05 11:11 . 2009-06-23 22:32 638976 c:\windows\system32\agsaamb.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 638976 c:\windows\system32\agsaamb.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 315392 c:\windows\system32\agsaama.dll
- 2009-03-05 11:11 . 2009-06-23 22:32 315392 c:\windows\system32\agsaama.dll
+ 2009-06-05 11:30 . 2009-06-05 11:30 652800 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.msi
+ 2008-10-22 21:56 . 2008-10-22 21:56 437760 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - ara\vs_setup.msi
+ 2009-03-22 13:20 . 2009-03-22 13:20 781824 c:\windows\Installer\f12ab.msi
+ 2009-03-22 13:20 . 2009-03-22 13:20 891904 c:\windows\Installer\f12a3.msi
+ 2009-03-22 13:19 . 2009-03-22 13:19 876032 c:\windows\Installer\f129b.msi
+ 2009-03-22 13:18 . 2009-03-22 13:18 140288 c:\windows\Installer\f122d.msi
+ 2009-03-22 13:18 . 2009-03-22 13:18 202752 c:\windows\Installer\f1224.msi
+ 2009-03-22 13:17 . 2009-03-22 13:17 107008 c:\windows\Installer\f120c.msi
+ 2009-03-22 13:17 . 2009-03-22 13:17 301056 c:\windows\Installer\f1204.msi
+ 2009-06-05 00:05 . 2009-06-05 00:05 178176 c:\windows\Installer\ee235.msi
+ 2009-06-05 00:05 . 2009-06-05 00:05 727040 c:\windows\Installer\ee22f.msi
+ 2009-06-05 00:05 . 2009-06-05 00:05 483328 c:\windows\Installer\ee229.msi
+ 2009-02-18 14:46 . 2009-02-18 14:46 562176 c:\windows\Installer\dfc88.msi
+ 2009-06-05 11:37 . 2009-06-05 11:37 433664 c:\windows\Installer\9fcb18.msi
+ 2008-10-22 19:12 . 2008-10-22 19:12 178688 c:\windows\Installer\9fcb0f.msp
+ 2008-10-22 18:59 . 2008-10-22 18:59 180224 c:\windows\Installer\9fcb0e.msp
+ 2008-10-22 19:08 . 2008-10-22 19:08 210944 c:\windows\Installer\9fcb0d.msp
+ 2008-10-22 19:02 . 2008-10-22 19:02 119808 c:\windows\Installer\9fcb0c.msp
+ 2008-10-22 18:54 . 2008-10-22 18:54 884224 c:\windows\Installer\9fcb0b.msp
+ 2009-06-05 11:37 . 2009-06-05 11:37 296448 c:\windows\Installer\9fcb0a.msi
+ 2008-10-22 17:22 . 2008-10-22 17:22 708608 c:\windows\Installer\9fcafa.msp
+ 2008-10-22 17:25 . 2008-10-22 17:25 492544 c:\windows\Installer\9fcaf9.msp
+ 2008-10-22 17:19 . 2008-10-22 17:19 248320 c:\windows\Installer\9fcaf8.msp
+ 2008-10-22 17:20 . 2008-10-22 17:20 364544 c:\windows\Installer\9fcaf7.msp
+ 2008-10-22 17:24 . 2008-10-22 17:24 358912 c:\windows\Installer\9fcaf6.msp
+ 2008-12-13 06:58 . 2008-12-13 06:58 754688 c:\windows\Installer\99cb64.msp
+ 2009-06-05 11:31 . 2009-06-05 11:31 648192 c:\windows\Installer\99cb3e.msi
+ 2008-07-29 18:23 . 2008-07-29 18:23 250880 c:\windows\Installer\9842fa.msp
+ 2008-07-29 18:28 . 2008-07-29 18:28 278016 c:\windows\Installer\9842f8.msp
+ 2008-07-29 16:40 . 2008-07-29 16:40 291840 c:\windows\Installer\9842f6.msp
+ 2009-06-05 11:30 . 2009-06-05 11:30 137728 c:\windows\Installer\9842f0.msi
+ 2008-07-29 14:35 . 2008-07-29 14:35 553472 c:\windows\Installer\936fe1.msp
+ 2008-07-29 14:33 . 2008-07-29 14:33 506368 c:\windows\Installer\936fdf.msp
+ 2008-07-29 14:37 . 2008-07-29 14:37 911360 c:\windows\Installer\936fde.msp
+ 2009-02-16 14:35 . 2009-02-16 14:35 264704 c:\windows\Installer\7cc9a.msi
+ 2009-06-05 10:50 . 2009-06-05 10:50 177664 c:\windows\Installer\743bbe.msi
+ 2009-02-16 15:30 . 2009-02-16 15:30 331264 c:\windows\Installer\69944.msi
+ 2009-03-24 23:19 . 2009-03-24 23:19 326144 c:\windows\Installer\414ce2.msi
+ 2009-02-16 16:58 . 2009-02-16 16:58 723968 c:\windows\Installer\3ed81.msi
+ 2009-04-12 12:55 . 2009-04-12 12:55 228352 c:\windows\Installer\1a19ab.msi
+ 2009-03-22 13:29 . 2009-03-22 13:29 431104 c:\windows\Installer\187caf.msi
+ 2009-03-22 13:28 . 2009-03-22 13:28 570880 c:\windows\Installer\187c95.msi
+ 2006-01-24 12:23 . 2006-01-24 12:23 397312 c:\windows\Downloaded Program Files\imcv1.dll
+ 2004-07-17 08:35 . 2004-07-17 08:35 1353216 c:\windows\system32\webfldrs.msi
+ 2009-03-05 11:11 . 2009-07-05 18:03 1212416 c:\windows\system32\ckll.dll
- 2009-03-05 11:11 . 2009-05-26 13:39 1212416 c:\windows\system32\ckll.dll
- 2009-03-05 11:11 . 2009-05-26 13:39 1245184 c:\windows\system32\bkll.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 1245184 c:\windows\system32\bkll.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 1986560 c:\windows\system32\akll.dll
- 2009-03-05 11:11 . 2009-05-26 13:39 1986560 c:\windows\system32\akll.dll
+ 2009-03-05 11:11 . 2009-07-05 18:03 2535424 c:\windows\system32\agsaamj.dll
- 2009-03-05 11:11 . 2009-05-26 13:39 2535424 c:\windows\system32\agsaamj.dll
+ 2009-02-22 17:48 . 2004-07-17 08:35 1353216 c:\windows\ServicePackFiles\i386\webfldrs.msi
+ 2009-02-24 04:08 . 2009-02-24 04:08 8584192 c:\windows\Installer\fe895.msi
+ 2008-12-13 06:57 . 2008-12-13 06:57 8397824 c:\windows\Installer\99cb4d.msp
+ 2008-07-29 16:26 . 2008-07-29 16:26 1043456 c:\windows\Installer\9842f9.msp
+ 2008-07-29 17:37 . 2008-07-29 17:37 2679808 c:\windows\Installer\9842f7.msp
+ 2008-07-29 18:15 . 2008-07-29 18:15 3697664 c:\windows\Installer\9842f5.msp
+ 2008-07-29 16:34 . 2008-07-29 16:34 1448448 c:\windows\Installer\9842f4.msp
+ 2008-07-29 17:22 . 2008-07-29 17:22 4137984 c:\windows\Installer\9842f3.msp
+ 2008-07-29 16:18 . 2008-07-29 16:18 3376640 c:\windows\Installer\9842f2.msp
+ 2008-07-29 14:45 . 2008-07-29 14:45 2543616 c:\windows\Installer\936fe5.msp
+ 2008-07-29 14:29 . 2008-07-29 14:29 2926080 c:\windows\Installer\936fe4.msp
+ 2008-07-29 14:41 . 2008-07-29 14:41 6487040 c:\windows\Installer\936fe3.msp
+ 2008-07-29 14:39 . 2008-07-29 14:39 3403264 c:\windows\Installer\936fe2.msp
+ 2008-07-29 14:43 . 2008-07-29 14:43 1013248 c:\windows\Installer\936fe0.msp
+ 2008-07-29 14:31 . 2008-07-29 14:31 6083072 c:\windows\Installer\936fdd.msp
+ 2009-05-12 06:07 . 2009-05-12 06:07 1674752 c:\windows\Installer\59a75.msi
+ 2009-06-03 06:16 . 2009-06-03 06:16 4192256 c:\windows\Installer\37f9db.msi
+ 2009-06-16 14:12 . 2009-06-16 14:12 1602048 c:\windows\Installer\1c75ac.msi
+ 2008-12-13 07:21 . 2008-12-13 07:21 10473472 c:\windows\Installer\99cb58.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-07-13 414992]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBrowserOptions"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^SnagIt 8.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\SnagIt 8.lnk
backup=c:\windows\pss\SnagIt 8.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [08/06/2009 04:29 م 33408]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [02/06/2009 01:56 م 28544]
R1 is-7KMBBdrv;is-7KMBBdrv;c:\windows\system32\drivers\92716846.sys [16/03/2009 05:15 م 148496]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [30/08/2008 06:34 م 81356]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14/07/2009 06:00 ص 211216]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kXbar.sys [30/08/2008 06:36 م 9804]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [14/07/2009 06:00 ص 19096]
S2 0247401245301837mcinstcleanup;0247401245301837mcinstcleanup; [x]
S3 F-Secure Standalone Minifilter;F-Secure Standalone Minifilter;\??\c:\documents and settings\home user\Local Settings\Temp\{10BEB1C4-4E3C-4652-9836-B9814379764F}\fsgk.sys --> c:\documents and settings\home user\Local Settings\Temp\{10BEB1C4-4E3C-4652-9836-B9814379764F}\fsgk.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [11/03/2009 12:42 م 33752]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-07-14 c:\windows\Tasks\Malwarebytes' Scheduled Scan for home user.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-07-14 10:36]
2009-07-14 c:\windows\Tasks\Malwarebytes' Scheduled Update for home user.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-07-14 10:36]
2009-07-10 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-07-14 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
.
- - - - ORPHANS REMOVED - - - -
Toolbar-Locked - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = about:blank
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = proxy.sahara.com.sa:80
DPF: Microsoft XML Parser for Java -
DPF: {E001C731-5E37-4538-A5CB-8168736A2360}
FF - ProfilePath - c:\documents and settings\home user\Application Data\Mozilla\Firefox\Profiles\84k41vgv.default\
FF - component: c:\documents and settings\home user\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
vbefile\shell\edit\command=c:\windows\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-14 13:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-07-14 13:34
ComboFix-quarantined-files.txt 2009-07-14 10:34
ComboFix2.txt 2009-05-23 12:45
ComboFix3.txt 2009-04-24 20:38
ComboFix4.txt 2009-03-10 15:01
Pre-Run: 70,323,281,920 bytes free
Post-Run: 70,306,197,504 bytes free
368 --- E O F --- 2009-06-23 22:55
