اوكي يالغاالي هذا اللي طلع مع . .
ComboFix 09-12-28.06 - Home 12/29/2009 21:33:10.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1256.973.1033.18.1247.884 [GMT 3:00]
Running from: c:\documents and settings\Home\Desktop\ComboFix.exe
AV: برنامج Kaspersky لأمان الإنترنت *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: برنامج Kaspersky لأمان الإنترنت *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Ultra.dll
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-29 )))))))))))))))))))))))))))))))
.
2009-12-29 14:15 . 2008-04-13 18:47 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-12-29 14:15 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-12-26 19:23 . 2009-12-26 19:23 -------- d-----w- c:\windows\system32\LogFiles
2009-12-26 10:43 . 2009-08-06 16:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-12-26 10:43 . 2009-08-06 16:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-12-25 15:21 . 2009-12-25 15:21 -------- d-sh--w- c:\documents and settings\Home\IECompatCache
2009-12-25 15:20 . 2009-12-25 15:20 -------- d-sh--w- c:\documents and settings\Home\PrivacIE
2009-12-25 14:50 . 2009-12-25 14:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-12-25 14:48 . 2009-12-25 14:48 -------- d-sh--w- c:\documents and settings\Home\IETldCache
2009-12-25 14:44 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-25 14:44 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-25 14:44 . 2009-12-26 14:03 -------- d-----w- c:\windows\ie8updates
2009-12-25 14:43 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-12-25 14:35 . 2009-12-25 14:43 -------- dc-h--w- c:\windows\ie8
2009-12-25 13:37 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-12-25 13:37 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-12-25 13:37 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-12-25 13:37 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-12-25 13:37 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-12-25 13:37 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-12-25 13:37 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-12-25 13:37 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-12-25 13:21 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-12-25 13:17 . 2009-12-29 18:41 -------- d-----w- c:\documents and settings\Home\Tracing
2009-12-25 13:15 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-12-25 13:15 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-12-25 13:11 . 2009-12-25 13:11 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-12-25 13:10 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-12-25 13:10 . 2006-11-29 10:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-12-25 13:09 . 2009-12-25 13:09 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-12-25 13:04 . 2009-12-25 13:04 -------- d-----w- c:\program files\Microsoft
2009-12-25 13:04 . 2009-12-25 13:04 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-12-25 13:01 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-12-25 12:52 . 2009-08-04 15:13 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-12-25 12:51 . 2009-08-04 14:20 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-12-25 12:51 . 2009-08-04 14:20 2066048 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-12-25 12:23 . 2009-07-31 04:35 1172480 -c----w- c:\windows\system32\dllcache\msxml3.dll
2009-12-25 12:22 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-12-25 12:20 . 2009-12-25 12:20 -------- d-----w- c:\program files\Common Files\Windows Live
2009-12-25 09:45 . 2009-12-25 09:45 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2009-12-25 09:44 . 2009-12-25 09:44 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2009-12-24 23:52 . 2009-12-24 23:52 932368 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2009-12-24 23:52 . 2009-12-24 23:52 678416 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2009-12-24 23:52 . 2009-12-24 23:52 604688 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2009-12-24 23:52 . 2009-12-24 23:52 1096208 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2009-12-24 23:52 . 2009-12-24 23:52 522768 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2009-12-24 22:26 . 2009-12-24 22:26 109072 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-12-24 22:26 . 2009-12-24 22:26 59920 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-12-24 22:26 . 2009-12-24 22:26 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-12-24 22:13 . 2009-12-24 22:13 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-12-24 22:09 . 2009-12-24 22:26 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-12-24 22:09 . 2009-12-24 22:26 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-12-24 22:07 . 2009-12-29 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-12-24 22:07 . 2009-12-24 22:07 -------- d-----w- c:\program files\Kaspersky Lab
2009-12-24 22:03 . 2009-12-25 08:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-28 02:13 . 2008-08-02 10:16 -------- d-----w- c:\program files\Messenger Plus! Live
2009-12-26 14:28 . 2003-03-10 21:03 86464 ----a-w- c:\documents and settings\Home\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-26 14:10 . 2003-03-19 22:12 -------- d-----w- c:\program files\Microsoft Works
2009-12-25 14:00 . 2008-09-16 10:04 -------- d-----w- c:\program files\Paltalk Messenger
2009-12-25 13:27 . 2008-08-02 10:16 -------- d-----w- c:\program files\Circle Developement
2009-12-25 13:25 . 2003-03-19 22:05 -------- d-----w- c:\program files\MSN Messenger
2009-12-25 13:12 . 2008-08-02 10:16 -------- d-----w- c:\program files\Windows Live
2009-12-25 02:57 . 2008-09-27 13:16 -------- d-----w- c:\documents and settings\Home\Application Data\Math Close Keep
2009-12-25 02:47 . 2008-09-27 13:18 -------- d-----w- c:\documents and settings\All Users\Application Data\burn spam ping upload
2009-12-25 02:38 . 2008-09-09 23:46 -------- d-----w- c:\program files\PremierOpinion
2009-12-24 16:30 . 2008-10-06 03:42 -------- d-----w- c:\program files\Bug Doctor
2009-11-26 09:13 . 2009-11-26 09:13 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.736\Arabic\setup.exe
2009-10-29 07:45 . 2004-08-03 22:56 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-03 22:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-03 22:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:34 . 2009-10-20 16:34 219664 ----a-w- c:\windows\system32\klogon.dll
2009-10-20 16:20 . 2004-08-03 21:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-14 17:18 . 2008-12-15 17:41 36880 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-10-13 10:30 . 2004-08-03 22:56 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-03 22:56 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-03 22:56 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-02 15:39 . 2009-05-16 17:59 19472 ----a-w- c:\windows\system32\drivers\klmouflt.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"PremierOpinion"="c:\program files\PremierOpinion\pmropn.exe" [2008-11-08 1673728]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-12-3 11552768]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PremierOpinion]
2008-11-08 15:17 372736 ----a-w- c:\program files\PremierOpinion\pmls.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\program files\\premieropinion\\pmropn.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [12/15/2008 8:41 PM 36880]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys --> c:\windows\system32\DRIVERS\klim5.sys [?]
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://www.google.com.bh/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
- - - - ORPHANS REMOVED - - - -
AddRemove-HijackThis - c:\documents and settings\Home\Desktop\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-12-29 21:43
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1920)
c:\windows\system32\WININET.dll
c:\program files\PremierOpinion\pmls.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2009-12-29 21:51:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-29 18:51
Pre-Run: 12,956,459,008 bytes free
Post-Run: 12,990,238,720 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 0AA166CD417D3D919D67CA230A8FC53E
