هذا الرد الاول
ComboFix 09-11-05.05 - Administrator 11/06/2009 22:39.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.2038.1541 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1a1dndah.exe
C:\3c.exe
C:\3n8awsyg.exe
C:\86.exe
C:\8rcahp.exe
C:\9b9w3.exe
C:\9jyhdim8.exe
C:\a2g21.exe
C:\autorun.inf
C:\b00ijwpu.exe
c:\docume~1\ADMINI~1\LOCALS~1\Temp\cvasds0.dll
c:\docume~1\ADMINI~1\LOCALS~1\Temp\cvasds1.dll
c:\documents and settings\Administrator\Application Data\tazebama
c:\documents and settings\Administrator\Application Data\tazebama\tazebama.log
c:\documents and settings\Administrator\Application Data\tazebama\zPharaoh.dat
C:\dogyx90.exe
C:\eexyv.exe
C:\hjvjte.exe
C:\mjafm.exe
C:\mranjm.exe
C:\t2hjo0.exe
C:\ucivd6xi.bat
C:\v1cbvsmq.exe
C:\wcgswa.exe
c:\windows\AhnRpta.exe
c:\windows\ktd32.atm
c:\windows\services.exe
c:\windows\system\sservice.exe
c:\windows\system32\e8main0.dll
c:\windows\system32\e8main1.dll
c:\windows\system32\fservice.exe
c:\windows\system32\kakle.dll
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
c:\windows\system32\reginv.dll
c:\windows\system32\winkey.dll
c:\windows\system32\winntue16.dll
C:\yudald.bat
D:\1a1dndah.exe
D:\3c.exe
D:\3n8awsyg.exe
D:\8rcahp.exe
D:\9b9w3.exe
D:\9jyhdim8.exe
D:\a2g21.exe
D:\autorun.inf
D:\b00ijwpu.exe
D:\dogyx90.exe
D:\eexyv.exe
D:\hjvjte.exe
D:\mjafm.exe
D:\mranjm.exe
D:\t2hjo0.exe
D:\ucivd6xi.bat
D:\v1cbvsmq.exe
D:\wcgswa.exe
D:\yudald.bat
D:\zPharaoh.exe
c:\windows\system32\ntoskrnl.exe . . . is infected!!
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_AVPsys
((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))
.
2009-11-06 18:42 . 2009-11-06 18:42 -------- d-----w- c:\program files\Trend Micro
2009-11-04 13:58 . 2009-11-04 13:57 114304 --sh--r- C:\srgo.exe
2009-11-02 17:35 . 2009-11-02 17:35 -------- d-----w- c:\documents and settings\Rehab\Application Data\HP
2009-10-31 20:30 . 2008-06-12 10:09 33088 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\
2009-10-29 21:22 . 2009-10-30 10:26 112905 --sh--r- C:\uqgvf.exe
2009-10-24 20:02 . 2009-10-24 20:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\GRETECH
2009-10-22 10:39 . 2009-11-06 19:44 888832 ----a-w- c:\documents and settings\All Users\Application Data\Okay Way Sixth Exit\Jump Pure.exe
2009-10-22 10:35 . 2009-10-22 10:35 -------- d-----w- c:\program files\KEEP BOOB BALM
2009-10-21 16:25 . 2009-10-21 16:24 113953 --sh--r- C:\qbr2q.exe
2009-10-20 06:50 . 2009-10-20 06:50 -------- d--h--w- c:\windows\PIF
2009-10-20 03:17 . 2009-10-20 14:18 116183 --sh--r- C:\nds0q.exe
2009-10-18 02:12 . 2009-10-18 16:57 115181 --sh--r- C:\se12ydam.exe
2009-10-17 09:30 . 2009-11-01 04:35 6144 ----a-w- C:\syntax.exe
2009-10-16 16:28 . 2009-10-16 16:27 115618 --sh--r- C:\vb0hsoay.exe
2009-10-16 12:32 . 2009-10-16 12:32 -------- d-----w- c:\program files\dirLock
2009-10-15 13:40 . 2009-10-15 13:40 116414 --sh--r- C:\2sm66r.exe
2009-10-14 01:11 . 2009-10-15 05:45 115522 --sh--r- C:\s3ek.exe
2009-10-13 01:47 . 2009-10-13 01:47 114400 --sh--r- C:\ycvvj.exe
2009-10-12 01:05 . 2009-10-12 01:24 114888 --sh--r- C:\mje12tni.exe
2009-10-09 17:36 . 2009-10-09 17:37 -------- d-----w- c:\program files\Throttle
2009-10-09 15:36 . 2009-10-10 16:29 114819 --sh--r- C:\vlvtdflx.exe
2009-10-09 12:01 . 2009-10-09 12:01 -------- d-----w- c:\program files\All2Chat
2009-10-08 16:02 . 2009-10-08 16:02 117508 --sh--r- C:\1di1w.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 19:45 . 2009-08-26 21:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\Orbit
2009-11-06 19:03 . 2008-04-15 18:00 40316 ----a-w- c:\windows\system32\perfc001.dat
2009-11-06 19:03 . 2008-04-15 18:00 251946 ----a-w- c:\windows\system32\perfh001.dat
2009-11-02 18:21 . 2009-08-27 03:03 -------- d-----w- c:\documents and settings\Rehab\Application Data\Orbit
2009-11-02 17:43 . 2009-08-26 21:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\KEEP BOOB BALM
2009-10-31 21:27 . 2009-08-24 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-22 10:39 . 2009-08-26 21:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Okay Way Sixth Exit
2009-10-07 16:03 . 2009-10-07 16:02 117945 --sh--r- C:\r2g20.exe
2009-10-07 13:36 . 2009-10-06 16:09 117625 --sh--r- C:\f9o8o.exe
2009-10-05 20:45 . 2009-10-05 20:45 118651 --sh--r- C:\ctu8r.exe
2009-10-04 06:22 . 2009-10-03 16:53 118696 --sh--r- C:\sp1jensi.exe
2009-10-03 16:37 . 2009-10-03 16:38 117070 --sh--r- C:\l6jj.exe
2009-09-30 19:21 . 2009-09-30 19:22 118464 --sh--r- C:\0fkk02x.exe
2009-09-29 01:13 . 2009-09-28 20:13 117960 --sh--r- C:\rg9g9bgq.exe
2009-09-26 04:06 . 2009-09-25 23:30 111956 --sh--r- C:\w9uxx92.exe
2009-09-24 01:05 . 2009-09-24 01:03 112471 --sh--r- C:\bycfht.exe
2009-09-20 17:07 . 2009-09-20 17:07 115061 --sh--r- C:\cqb6wo.exe
2009-09-19 21:56 . 2009-09-19 21:56 117220 --sh--r- C:\2o1ajagt.exe
2009-09-19 19:27 . 2009-09-19 19:05 135186 ----a-w- c:\windows\HPHins12.dat
2009-09-19 19:17 . 2009-09-19 19:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\HP
2009-09-19 19:17 . 2009-09-19 19:10 -------- d-----w- c:\program files\HP
2009-09-19 19:17 . 2009-09-19 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-09-19 19:15 . 2009-09-19 19:15 -------- d-----w- c:\program files\Common Files\HP
2009-09-19 19:14 . 2009-09-19 19:14 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-18 20:44 . 2009-09-18 20:45 116114 --sh--r- C:\wrsf.exe
2009-09-17 20:18 . 2009-08-26 21:00 -------- d-----w- c:\program files\MessengerPlus! 3
2009-09-17 20:14 . 2009-08-24 21:30 -------- d-----w- c:\program files\Messenger Plus! Live
2009-09-17 16:29 . 2009-09-17 16:29 115797 --sh--r- C:\lhh3v.exe
2009-09-16 20:55 . 2009-09-16 20:55 1175700 ----a-w- c:\windows\system32\RainySs.scr
2009-09-16 20:55 . 2009-09-16 20:55 -------- d-----w- c:\program files\Rainy Screensaver
2009-09-16 20:52 . 2009-09-16 20:52 -------- d-----w- c:\program files\Sound Pilot
2009-09-16 18:55 . 2009-09-16 18:56 116163 --sh--r- C:\qcod.exe
2009-09-15 19:33 . 2009-09-15 19:33 115942 --sh--r- C:\o8tf6l.exe
2009-09-12 19:33 . 2009-09-10 18:57 115742 --sh--r- C:\ph.exe
2009-09-08 16:55 . 2009-09-08 16:55 116142 --sh--r- C:\10nb.exe
2009-09-08 03:02 . 2009-09-07 22:13 116702 --sh--r- C:\sfkn.exe
2009-08-30 22:55 . 2009-08-30 22:55 7168 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Microsoft Text-to-Speech Engine 4.0 (English)\4000005e00002i\vcmd.exe
2009-08-27 03:34 . 2009-08-24 20:40 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-08-24 22:14 . 2009-08-24 22:14 45056 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{91057632-CA70-413C-B628-2D3CDBBB906B}\ARPPRODUCTICON.exe
2009-08-24 22:14 . 2009-08-24 22:14 45056 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe
2009-08-24 22:06 . 2009-02-15 01:39 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-08-24 22:06 . 2009-02-15 01:39 1986560 ----a-w- c:\windows\system32\akll.dll
2009-08-24 22:06 . 2009-02-15 01:39 196608 ----a-w- c:\windows\system32\maag.dll
2009-08-24 22:06 . 2009-02-15 01:39 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-08-24 22:06 . 2009-02-15 01:39 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-08-24 22:06 . 2009-02-15 01:39 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-08-24 22:06 . 2009-02-15 01:39 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-08-24 22:06 . 2009-02-15 01:39 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-08-24 22:06 . 2003-08-07 12:01 237568 ----a-w- c:\windows\system32\lame_enc.dll
2009-08-24 22:06 . 1998-05-05 21:00 40960 ----a-w- c:\windows\system32\VBAME.DLL
2009-08-24 21:31 . 2009-08-24 21:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-08-24 21:31 . 2009-08-24 21:31 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-08-24 20:48 . 2009-08-24 20:48 27264 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-24 20:37 . 2009-08-24 20:37 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2008-04-15 18:00 . 2008-04-15 18:00 164746 --sha-r- c:\windows\system32\bpskoapc.dll
.
------- Sigcheck -------
[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
[-] 2008-04-15 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
[-] 2008-04-15 . 9C1C146FA88A622FE5A7BC526E2E1289 . 24448 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
[-] 2008-04-15 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
[-] 2008-04-15 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
[-] 2009-03-05 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[-] 2008-04-15 . B5B364174F12BB281ADCFCB1D981FD2D . 77824 . . [5.1.2600.5512] . . c:\windows\system32\browser.dll
[-] 2008-04-15 . 99AE1390A271B02D752178DF9E8442A3 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[-] 2008-04-15 . 06A4ECA228EA636F4A1F6CE7542B6923 . 197632 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2008-04-15 . B2B94DB65227B0FE579E8DB3C9595E27 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-04-15 . 314D6138C9BD1775DFB5559C4DE926E4 . 399360 . . [5.1.2600.5512] . . c:\windows\system32\rpcss.dll
[-] 2008-04-15 . 940B71D9046A5356E9B5A3CD5A75B064 . 108544 . . [5.1.2600.5512] . . c:\windows\system32\services.exe
[-] 2008-04-15 . 42ECA7EA7D2E8B874BB9E4D147A5F783 . 57856 . . [5.1.2600.5512] . . c:\windows\system32\spoolsv.exe
[-] 2008-04-15 . BCEDF9DCCBC807108CE34C9834074C34 . 506880 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-04-15 . 9498CF0D334B282AA58D1DFC370738DE . 110592 . . [5.4.3790.5512] . . c:\windows\system32\wuauclt.exe
[-] 2008-04-15 . FB17595911DB63F59E44A0C49A2430A7 . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2008-04-15 . DE99DF7D8DD1E84F053CB27106DBE301 . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[-] 2009-03-05 02:08 . 055A6DFE5400C9E484A65B9E0E50F20D . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-04-15 . 437820B0DB7A11FB58660CE6C40A05F6 . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[-] 2008-04-15 . 94EBB9E7D65FDA05E515D6B70E4247E2 . 1357824 . . [5.1.2600.5512] . . c:\windows\system32\kernel32.dll
[-] 2008-04-15 . F3826CDBF19EC880750D77E0F06A7FA1 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2008-04-15 . 1E3AFE918888D6A61440F95FC24C067D . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[-] 2009-01-16 . 03FD34C7135582A7B1730EE041F023C5 . 3594752 . . [7.00.6000.16809] . . c:\windows\system32\mshtml.dll
[-] 2008-04-15 . 5BFFB45FD985BDECFD16C3E37B9C0222 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2009-03-05 . 020F56ADEF1B55F6F7B8B3F9A665DD28 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-04-15 . 108DFCB9BA32C9E6FC7343EA0924050E . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[-] 2002-12-31 . 20ACA3981D8A2CF0EE26691B4C9C4107 . 2306560 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe
[-] 2008-04-15 . DC4CD0AAD9A26C4FB63D75FB54FDFDA7 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[-] 2008-04-15 . 11873CCA8F378E6183F32B3746429ECA . 180736 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[-] 2008-04-15 . BFFB94B922D2FA05B3E7E3C9A5EF0A51 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[-] 2008-04-15 . 6B1139CA38DB1678487678C44874B80F . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[-] 2008-04-15 . 1171249B20075E2A5FF1EE09B96E505E . 249344 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2008-04-15 . F95655E872967AE2CD4C19D8914BABB7 . 578048 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2008-04-15 . B2B4E4722CAAFE109BEC13773BCB75B0 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2008-12-21 . 5B35855D3E98567AA2C85B2183EA84A7 . 826368 . . [7.00.6000.16791] . . c:\windows\system32\wininet.dll
[-] 2008-04-15 . 8A2B77E2A2F2AD328EE3A2ED91F08EBB . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[-] 2009-05-17 . F1B66AA071C8C4A4B7305AF6ED93B5F1 . 1254400 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-04-15 . 0C486E769D9F0BD558EDF1028D5B3A97 . 170496 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-04-15 . A80738EFFB8DCEEF19609FC37CB547BE . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-04-15 . A3FD2742E0AA6B637454B1B72220CBFA . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[-] 2008-04-15 . 5BA1E23C1163900A9BFA3E580BE67D20 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[-] 2008-04-15 . 6B8B7B206FA0C50B4CF99EEE2AC14BC7 . 1571328 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2008-04-15 . 252F972131EB23596C20B82CA190DC5C . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2008-04-15 . B129A14D8D0BDC9B1F4F563A17BC5FED . 135168 . . [6.00.2900.5512] . . c:\windows\system32\shsvcs.dll
[-] 2008-04-15 . 051006B621094BF89F9FB461579469B6 . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[-] 2008-04-15 . 8F97E67ECB9F450F3E0FF626641DA365 . 191488 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[-] 2008-04-15 . A7CB4B261EAC77F66ABBC3A6D67310D7 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[-] 2008-04-15 . 58E202572D3251BF2687BF841EA00CE0 . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[-] 2008-04-15 . C1E4CD9F8D48F2671FF2BF8E7944F43C . 162304 . . [5.1.2600.5512] . . c:\windows\system32\appmgmts.dll
[-] 2008-04-13 16:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
[-] 2008-04-15 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
[-] 2008-04-15 18:00 . D03CD11A00247AD7BB501127E29CC375 . 927504 . . [4.1.0.61] . . c:\windows\system32\mfc40u.dll
[-] 2008-04-15 . D12F21ED0E0D90631B2E653F6840CB9C . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[-] 2008-04-15 18:00 . 49628048583C95312D88FC768051D789 . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2006-10-18 18:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2009-03-05 . E8B69EFA0087E61428F5CB3E6C1ED036 . 2025472 . . [5.1.2600.5657] . . c:\windows\system32\ntkrnlpa.exe
[-] 2008-04-15 18:00 . F3111AEB82E09867722BF0A92742B9F6 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[-] 2008-04-15 . B87E398A9B268ED7EFFEF18107D9B0C2 . 185344 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2009-09-16 190024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-08-24 185896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-11-12 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-11-12 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-11-12 141336]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-02-12 262401]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-18 49152]
"Sixth exit vga dash"="c:\documents and settings\All Users\Application Data\Okay Way Sixth Exit\Jump Pure.exe" [2009-11-06 888832]
"combofix"="c:\combofix\CF9911.exe" [2009-11-06 389120]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-8-25 113664]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-4-14 2979144]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2003-6-12 114688]
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-1-16 1715400]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSecurityTab"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisallowRun"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= ntbackup.exe
"2"= Regedit.exe
"3"= rstrui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe c:\windows\system32\fservice.exe"
"SfcDisable"=dword:ffffff9d
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3407:TCP"= 3407:TCP:tdldq
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [8/25/2009 1:40 م 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe [8/25/2009 1:40 م 254209]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [8/25/2009 1:40 م 41217]
S2 mffjewgd;Support Network;c:\windows\system32\svchost.exe -k netsvcs [4/15/2008 9:00 م 14336]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - MBR
*Deregistered* - mbr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
mffjewgd
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}]
c:\windows\system\sservice.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: avsda.dll
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Stupid pure - c:\docume~1\ADMINI~1\APPLIC~1\KEEPBO~1\send math ooze.exe
HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
HKCU-Run-cdoosoft - c:\docume~1\ADMINI~1\LOCALS~1\Temp\herss.exe
HKLM-Run-csrss.exe - c:\windows\ctfmon.exe
HKLM-Run-Device Detector - DevDetect.exe
HKLM-Explorer_Run-DirectX For Microsoft® Windows - c:\windows\system32\fservice.exe
ShellExecuteHooks-{BB4C402F-882A-4526-8C08-51278EA437C1} - c:\windows\system32\e8main1.dll
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-11-06 22:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mffjewgd]
"ServiceDll"="c:\windows\system32\bpskoapc.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(1124)
c:\windows\system32\avsda.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Premium\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Premium\avguard.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Orbitdownloader\orbitnet.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\windows\system32\msiexec.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2009-11-06 22:48 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-06 19:48
Pre-Run: 57,063,919,616 bytes free
Post-Run: 57,278,062,592 bytes free
- - End Of File - - B89C22ABD6874363CEB89884A27B2EE3
