تم عمل جميع الخطوات احي الكريم
ComboFix 10-02-01.01 - ميثم 02/01/2010 16:01:42.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.3326.2752 [GMT 3:00]
Running from: c:\documents and settings\ميثم\My Documents\Downloads\Programs\ComboFix.exe
AV: برنامج Kaspersky لأمان الإنترنت *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: برنامج Kaspersky لأمان الإنترنت *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\ميثم\Application Data\inst.exe
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\program files\Common Files\Real\WeatherBug\MiniBugTransporter.dll
c:\program files\FunWebProducts
C:\Thumbs.db
c:\windows\Fonts\MyriadPro-Regular.otf
c:\windows\system32\Data
c:\windows\system32\ieuinit.inf
c:\windows\system32\lsprst7.dll
c:\windows\system32\ssprs.dll
c:\windows\system32\Thumbs.db
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SKYNET
-------\Service_SKYNET
((((((((((((((((((((((((( Files Created from 2010-01-01 to 2010-02-01 )))))))))))))))))))))))))))))))
.
2010-02-01 06:06 . 2010-02-01 06:06 198064 ----a-w- c:\documents and settings\ميثم\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2010-02-01 05:28 . 2008-04-15 12:00 139264 -c--a-w- c:\windows\system32\dllcache\sndvol32.exe
2010-02-01 05:28 . 2008-04-15 12:00 139264 ----a-w- c:\windows\system32\sndvol32.exe
2010-02-01 04:48 . 2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
2010-02-01 04:04 . 2010-02-01 04:04 -------- d-----w- c:\program files\Trend Micro
2010-02-01 03:58 . 2010-02-01 12:44 -------- d-----w- c:\documents and settings\ميثم\Local Settings\Application Data\Runscanner.net
2010-01-30 14:53 . 2009-08-05 19:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2010-01-30 14:53 . 2010-01-30 14:53 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-01-30 14:52 . 2010-01-30 14:52 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-01-30 10:38 . 2010-01-30 10:38 -------- d-----w- c:\program files\AnyBizSoft
2010-01-29 20:05 . 2010-01-29 20:05 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2010-01-28 21:43 . 2010-01-31 15:46 -------- d-----w- c:\program files\Windows Live
2010-01-28 21:19 . 2010-02-01 04:36 -------- d-----w- c:\program files\AskBarDis
2010-01-28 21:19 . 2010-02-01 09:32 -------- d-----w- c:\documents and settings\ميثم\Application Data\uTorrent
2010-01-28 16:39 . 2010-01-28 21:40 -------- d-----w- c:\program files\Waseet3
2010-01-28 07:31 . 2010-01-28 07:31 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2010-01-27 10:24 . 2010-01-27 10:24 0 ----a-w- c:\windows\nsreg.dat
2010-01-27 10:24 . 2010-01-27 10:24 -------- d-----w- c:\documents and settings\ميثم\Local Settings\Application Data\Mozilla
2010-01-27 07:48 . 2010-01-27 07:48 3584 ----a-r- c:\documents and settings\ميثم\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2010-01-27 07:48 . 2010-01-27 07:48 -------- d-----w- c:\program files\Windows Installer Clean Up
2010-01-27 03:49 . 2010-01-27 03:49 -------- d-----w- c:\documents and settings\ميثم\Application Data\Moyea
2010-01-27 03:49 . 2010-01-27 03:49 -------- d-----w- c:\program files\Moyea
2010-01-26 20:23 . 2010-01-26 20:23 932368 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2010-01-26 20:23 . 2010-01-26 20:23 678416 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2010-01-26 20:23 . 2010-01-26 20:23 604688 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2010-01-26 20:23 . 2010-01-26 20:23 522768 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2010-01-26 20:23 . 2010-01-26 20:23 1096208 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2010-01-26 20:22 . 2010-01-26 20:22 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2010-01-26 20:22 . 2010-01-26 20:22 80400 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2010-01-26 20:22 . 2010-01-26 20:22 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2010-01-26 20:22 . 2010-01-26 20:22 109072 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2010-01-26 20:22 . 2010-01-26 20:22 59920 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2010-01-26 20:22 . 2010-01-26 20:22 264720 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2010-01-26 20:01 . 2010-01-26 20:01 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2010-01-26 19:55 . 2010-01-26 20:22 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-01-26 19:55 . 2010-01-26 20:22 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-01-26 19:54 . 2010-02-01 13:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-01-26 19:54 . 2010-01-26 19:54 -------- d-----w- c:\program files\Kaspersky Lab
2010-01-26 19:46 . 2010-01-26 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-01-25 17:03 . 2010-01-28 11:46 -------- d-----w- c:\program files\MSECACHE
2010-01-25 16:53 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-01-25 16:53 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-01-25 16:52 . 2009-11-21 15:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-25 16:47 . 2010-01-25 16:47 -------- d-s---w- c:\documents and settings\ميثم\UserData
2010-01-25 14:48 . 2009-09-09 10:43 210352 ----a-w- c:\windows\system32\idmmbc.dll
2010-01-22 19:17 . 2010-01-22 19:18 -------- d-----w- c:\windows\speech
2010-01-22 19:17 . 2010-01-22 19:17 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2010-01-22 19:17 . 2010-01-22 19:17 172032 ------w- c:\windows\Setup1.exe
2010-01-22 19:17 . 2010-01-22 19:17 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-01-22 19:17 . 2010-01-22 19:17 -------- d-----w- C:\Al-Moheet
2010-01-19 09:41 . 2010-01-22 04:28 -------- d-----w- c:\program files\Red Cross Emergency Response Unit
2010-01-19 09:41 . 2010-01-19 09:41 -------- d-----w- c:\windows\Red Cross Emergency Response Unit
2010-01-19 08:09 . 2010-01-19 08:09 -------- d-----w- c:\documents and settings\ميثم\Application Data\PetShowCraze
2010-01-19 07:08 . 2010-01-19 07:08 -------- d-----w- c:\program files\Pet Show Craze
2010-01-19 07:08 . 2010-01-19 07:08 -------- d-----w- c:\windows\Pet Show Craze
2010-01-19 07:04 . 2010-01-22 04:28 -------- d-----w- c:\program files\Magic Encyclopedia First Story
2010-01-19 07:04 . 2010-01-19 07:04 -------- d-----w- c:\windows\Magic Encyclopedia First Story
2010-01-19 07:03 . 2010-01-19 07:03 -------- d-----w- c:\documents and settings\ميثم\Application Data\PlayFirst
2010-01-19 07:03 . 2010-01-19 07:03 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2010-01-19 07:03 . 2010-01-19 07:03 -------- d-----w- c:\program files\Gourmania
2010-01-19 07:03 . 2010-01-19 07:03 -------- d-----w- c:\windows\Gourmania
2010-01-16 11:37 . 2010-01-22 04:28 -------- d-----w- c:\program files\AdorageI-SAL
2010-01-16 11:37 . 2010-01-16 11:37 -------- d-----w- c:\program files\AdorageI-GfxDatas
2010-01-16 11:37 . 2009-03-17 19:22 520192 ----a-w- c:\windows\system32\prodad-codec.dll
2010-01-16 11:37 . 2009-03-17 19:22 321088 ----a-w- c:\windows\system32\proDAD-PA-Support.dll
2010-01-16 11:37 . 2010-01-16 11:37 -------- d-----w- c:\documents and settings\All Users\Application Data\proDAD
2010-01-14 08:52 . 2010-01-31 15:07 -------- d-----w- c:\program files\Hot Coffee
2010-01-12 23:03 . 2010-01-12 23:03 1025 ----a-w- c:\windows\system32\sysprs7.dll
2010-01-12 23:03 . 2010-01-12 23:03 1025 ----a-w- c:\windows\system32\clauth2.dll
2010-01-12 23:03 . 2010-01-12 23:03 1025 ----a-w- c:\windows\system32\clauth1.dll
2010-01-12 23:03 . 2010-01-12 23:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Minnetonka Audio Software
2010-01-12 05:41 . 2008-05-29 06:03 37176 ----a-w- c:\documents and settings\ميثم\Application Data\Macromedia\Flash Player\
2010-01-12 05:16 . 2010-01-12 05:16 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-01-12 05:11 . 2010-01-12 05:11 -------- d-----w- c:\program files\Adobe Media Player
2010-01-12 05:09 . 2010-01-12 05:09 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-12 05:05 . 2010-01-12 05:05 -------- d-----w- c:\program files\Common Files\Macrovision Shared
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-01 13:07 . 2009-10-16 10:34 -------- d-----w- c:\documents and settings\ميثم\Application Data\DMCache
2010-02-01 12:57 . 2008-04-15 12:00 71476 ----a-w- c:\windows\system32\perfc001.dat
2010-02-01 12:57 . 2008-04-15 12:00 375338 ----a-w- c:\windows\system32\perfh001.dat
2010-02-01 06:06 . 2009-10-16 10:34 -------- d-----w- c:\documents and settings\ميثم\Application Data\IDM
2010-02-01 04:36 . 2009-10-15 06:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-01 03:40 . 2009-10-16 10:34 -------- d-----w- c:\program files\Internet Download Manager
2010-02-01 03:38 . 2009-11-03 14:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Zbshareware Lab
2010-02-01 03:38 . 2009-11-03 11:57 -------- d-----w- c:\program files\USB Disk Security
2010-01-30 15:41 . 2009-12-09 21:10 -------- d-----w- c:\program files\QuickTime
2010-01-30 14:37 . 2009-10-16 18:27 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-30 09:54 . 2009-10-15 11:45 -------- d-----w- c:\documents and settings\ميثم\Application Data\dvdcss
2010-01-28 21:19 . 2009-10-15 06:24 -------- d-----w- c:\program files\uTorrent
2010-01-28 09:45 . 2009-10-15 05:12 345912 ----a-w- c:\documents and settings\ميثم\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-28 08:02 . 2009-10-22 00:29 -------- d-----w- c:\program files\VstPlugins
2010-01-27 14:14 . 2009-10-17 13:36 -------- d-----w- c:\program files\NewBlue
2010-01-27 03:55 . 2009-10-16 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-27 03:54 . 2009-10-16 13:36 -------- d-----w- c:\program files\Microsoft Works
2010-01-16 23:22 . 2009-11-05 16:24 -------- d-----w- c:\documents and settings\ميثم\Application Data\cleaner
2010-01-12 20:20 . 2009-10-15 14:45 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-01-12 20:15 . 2010-01-12 20:15 -------- d-----w- c:\program files\AviSynth 2.5
2010-01-12 20:15 . 2010-01-12 20:15 -------- d-----w- c:\program files\Real Alternative
2010-01-12 20:15 . 2010-01-12 20:13 -------- d-----w- c:\program files\OZOMEDIA9
2010-01-12 14:43 . 2009-10-16 20:59 -------- d-----w- c:\documents and settings\ميثم\Application Data\Ahead
2010-01-12 05:13 . 2009-10-17 12:08 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-29 11:11 . 2009-12-29 11:07 -------- d-----w- c:\program files\LooksBuilder
2009-12-28 21:01 . 2009-11-22 09:45 -------- d-----w- c:\program files\Your Uninstaller 2008
2009-12-28 00:10 . 2009-12-28 00:10 -------- d-----w- c:\documents and settings\ميثم\Application Data\proDAD
2009-12-28 00:10 . 2009-12-28 00:10 -------- d-----w- c:\program files\proDAD
2009-12-27 06:04 . 2009-10-20 17:51 12288 ----a-w- c:\windows\impborl.dll
2009-12-27 05:18 . 2009-12-10 08:01 -------- d-----w- c:\program files\Waseet303
2009-12-26 21:31 . 2009-12-14 06:52 -------- d-----w- c:\documents and settings\ميثم\Application Data\U3
2009-12-26 13:27 . 2009-12-26 13:27 -------- d-----w- c:\documents and settings\ميثم\Application Data\COWON
2009-12-26 13:27 . 2009-12-26 13:27 -------- d-----w- c:\program files\JetAudio
2009-12-26 13:27 . 2009-12-26 13:27 -------- d-----w- c:\program files\Common Files\COWON
2009-12-26 13:27 . 2009-10-15 05:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-22 05:08 . 2008-04-15 12:00 665600 ----a-w- c:\windows\system32\wininet.dll
2009-12-22 05:08 . 2008-04-15 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-12-09 21:08 . 2009-10-15 06:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-06 13:18 . 2009-12-06 13:02 -------- d-----w- c:\program files\nLite
2009-11-25 06:37 . 2009-11-11 12:54 36864 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\PostBuild.exe
2009-11-23 10:28 . 2009-11-23 10:28 20016 ------w- c:\windows\system32\drivers\pxhelp20.sys
2009-11-21 15:54 . 2008-04-15 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-13 12:36 . 2009-11-13 12:15 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-11-04 13:44 . 2009-11-04 13:44 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-11-04 13:44 . 2009-11-04 13:44 47360 ----a-w- c:\documents and settings\ميثم\Application Data\pcouffin.sys
2009-11-04 13:44 . 2009-11-04 13:44 47360 ----a-w- c:\documents and settings\ميثم\Application Data\pcouffin.sys
2009-11-04 01:56 . 2009-10-31 02:43 720896 ----a-w- c:\windows\iun6002ev.exe
2004-03-11 10:27 . 2009-10-16 15:05 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="e:\منـــوع برامــج\IDM.5.18.8.GENIAL78.zyzoom.org\normal install with crack-تثبيت عادي مع الكراك\crack-كراك\IDMan.exe" [2010-01-25 3179952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-10 16384000]
"SkyTel"="SkyTel.EXE" [2007-08-03 1826816]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
c:\documents and settings\êï£ê\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-17 113664]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-10-17 113664]
[HKLM\~\startupfolder\C:^Documents and Settings^ميثم^قائمة ابدأ^البرامج^بدء التشغيل^Error Messages for Windows.lnk]
path=c:\documents and settings\ميثم\قائمة ابدأ\البرامج\بدء التشغيل\Error Messages for Windows.lnk
backup=c:\windows\pss\Error Messages for Windows.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-12-09 21:10 155648 ----a-w- c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-10-15 06:39 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Adobe\\Adobe Premiere Pro 2.0\\Adobe Premiere Pro.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 08:41 م 33808]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [30/01/2010 05:53 م 54752]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 05:46 م 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 08:59 م 19472]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [17/12/2009 02:28 م 332928]
S3 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [15/11/2009 10:34 م 12672]
.
Contents of the 'Scheduled Tasks' folder
2010-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
.
.
------- Supplementary Scan -------
.
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
IE: Download all links with IDM - e:\منـــوع برامــج\IDM.5.18.8.GENIAL78.zyzoom.org\normal install with crack-تثبيت عادي مع الكراك\crack-كراك\IEGetAll.htm
IE: Download FLV video content with IDM - e:\منـــوع برامــج\IDM.5.18.8.GENIAL78.zyzoom.org\normal install with crack-تثبيت عادي مع الكراك\crack-كراك\IEGetVL.htm
IE: Download with IDM - e:\منـــوع برامــج\IDM.5.18.8.GENIAL78.zyzoom.org\normal install with crack-تثبيت عادي مع الكراك\crack-كراك\IEExt.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\ميثم\Application Data\Mozilla\Firefox\Profiles\o8ch0g0j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=
FF - component: c:\documents and settings\ميثم\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{C94E154B-1459-4A47-966B-4B843BEFC7DB} - c:\program files\AskSearch\bin\DefaultSearch.dll
BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar.dll
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
MSConfigStartUp-ares - c:\program files\Ares\Ares.exe
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
AddRemove-Air Strike II Gulf Thunder_is1 - c:\program files\Air Strike II Gulf Thunder\ReflexiveArcade\unins000.exe
AddRemove-Cheatbook 05.2009 - c:\program files\Cheatbook 05.2009\Uninstal.exe
AddRemove-Hide IP Platinum_is1 - c:\program files\Hide IP Platinum\unins000.exe
AddRemove-Internet Download Manager - c:\documents and settings\ميثم\Local Settings\Temp\Rar$EX03.828\IDM.5.18.8.GENIAL78.zyzoom.org\normal install with crack-تثبيت عادي مع الكراك\crack-كراك\Uninstall.exe
AddRemove-Tiny Toon Adventures - Buster's Hidden Treasure_is1 - c:\program files\Tiny Toon Adventures - Buster's Hidden Treasure\unins000.exe
AddRemove-VBA Password Recovery - c:\progra~1\VBAPAS~1\UNWISE.EXE
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2010-02-01 16:07
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1f471d83-ed5b-4921-9398-3193e82d762d}]
@Denied: (Full) (Everyone)
"Model"=dword:00000166
"Therad"=dword:00000010
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):6e,d1,66,a0,6a,5d,c0,01,f8,4a,10,30,3a,03,1f,37,14,fa,05,db,22,
ba,63,2e,a9,f0,06,95,6d,2d,3d,bf,c4,4e,19,85,ea,2a,32,c4,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:f2,82,87,83,32,70,3a,bf,30,f7,ae,54,b0,7b,54,de,1c,f8,f1,ab,f0,
fb,7e,6c,e4,1d,5e,3e,ab,19,e3,77,2b,a9,f0,eb,b9,56,fb,1c,97,6d,e6,59,b7,f0,\
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:f2,82,87,83,32,70,3a,bf,30,f7,ae,54,b0,7b,54,de,1c,f8,f1,ab,f0,
fb,7e,6c,e4,1d,5e,3e,ab,19,e3,77,2b,a9,f0,eb,b9,56,fb,1c,97,6d,e6,59,b7,f0,\
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wscntfy.exe
c:\\?\c:\windows\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2010-02-01 16:11:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-01 13:11
Pre-Run: 19,638,870,016 bytes free
Post-Run: 19,499,032,576 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - AC1DD6CFE97B1C91A50AE00C8FF58955
k: