ComboFix 08-07-21.1 - WwW 07/31/2008 13:46:58.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.345 [GMT 2:00]
Running from: C:\Documents and Settings\WwW\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-31 11:52 9,628,448 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-31 11:51 455,712 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-31 11:42 --------- d-----w C:\Documents and Settings\WwW\Application Data\vlc
2008-07-31 11:00 --------- d-----w C:\Documents and Settings\WwW\Application Data\DMCache
2008-07-31 10:35 467,383 ----a-w C:\Program Files\server.rar
2008-07-31 10:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-31 09:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-07-31 09:27 --------- d-----w C:\Program Files\VideoLAN
2008-07-31 08:33 --------- d-----w C:\Documents and Settings\WwW\Application Data\Skype
2008-07-31 08:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\skypePM
2008-07-31 08:13 17,396 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-31 08:13 131,072 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-31 08:11 --------- d-----w C:\Program Files\vnd
2008-07-31 08:05 --------- d-----w C:\Documents and Settings\WwW\Application Data\Grisoft
2008-07-31 08:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-31 08:02 2,258 ----a-w C:\WINDOWS\system32\tmp.reg
2008-07-31 07:36 --------- d-----w C:\Documents and Settings\WwW\Application Data\Media Player Classic
2008-07-30 10:33 --------- d-----w C:\Program Files\WinAVIVideoConverter
2008-07-29 06:51 --------- d-----w C:\Documents and Settings\WwW\Application Data\cleaner
2008-07-28 12:13 --------- d-----w C:\Program Files\Common Files\xing shared
2008-07-27 12:30 --------- d-----w C:\Program Files\Gabest
2008-07-26 19:09 --------- d-----w C:\Program Files\Cain
2008-07-26 13:22 --------- d-----w C:\Program Files\ONSPEED
2008-07-26 09:26 --------- d-----w C:\Program Files\VistaDrives
2008-07-26 08:54 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-25 13:53 --------- d-----w C:\Documents and Settings\WwW\Application Data\TeamViewer
2008-07-24 19:56 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-24 19:54 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-24 19:54 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-24 11:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-22 20:51 --------- d-----w C:\Program Files\Virtual Earth 3D
2008-07-19 12:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\CyberScrub
2008-07-19 11:35 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-19 10:59 --------- d-----w C:\Documents and Settings\WwW\Application Data\IDM
2008-07-19 08:48 --------- d-----w C:\Documents and Settings\WwW\Application Data\MegauploadToolbar
2008-07-18 19:18 --------- d-----w C:\Documents and Settings\WwW\Application Data\uTorrent
2008-07-18 17:53 --------- d-----w C:\Program Files\MegauploadToolbar
2008-07-16 20:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-15 21:54 635,175 ----a-w C:\WINDOWS\system32\Easyriders 2003 vol. 2.scr
2008-07-15 11:42 --------- d-----w C:\Documents and Settings\WwW\Application Data\Apple Computer
2008-07-15 08:30 --------- d-----w C:\Documents and Settings\WwW\Application Data\Ahead
2008-07-15 06:35 --------- d-----w C:\Program Files\Safari
2008-07-15 06:21 --------- d-----w C:\Program Files\QuickTime
2008-07-15 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-14 07:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\NASA
2008-07-13 16:46 --------- d-----w C:\Program Files\NASA
2008-07-09 20:58 --------- d-----w C:\Program Files\Java
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-07-07 20:07 --------- d-----w C:\Program Files\'Full Speed' Internet Booster + Performance Tests
2008-07-07 19:52 --------- d-----w C:\Documents and Settings\WwW\Application Data\MozillaControl
2008-07-07 19:38 --------- d-----w C:\Documents and Settings\WwW\Application Data\SlipStream
2008-07-07 19:25 --------- d-----w C:\Program Files\Unlocker
2008-07-06 14:19 --------- d-----w C:\Program Files\Flock
2008-07-06 14:19 --------- d-----w C:\Documents and Settings\WwW\Application Data\Flock
2008-07-05 12:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-04 03:16 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-03 17:49 --------- d-----w C:\Program Files\IntelliAdmin
2008-07-02 11:30 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-07-01 16:09 1,700,352 ----a-w C:\WINDOWS\system32\gdiplus.dll
2008-06-30 05:24 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-30 05:24 --------- d-----w C:\Program Files\Spyware Doctor
2008-06-29 15:29 81,920 ----a-w C:\Documents and Settings\WwW\Application Data\ezpinst.exe
2008-06-29 15:29 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-06-29 15:29 47,360 ----a-w C:\Documents and Settings\WwW\Application Data\pcouffin.sys
2008-06-28 18:53 98,304 ----a-w C:\WINDOWS\system32\SoftAheadCert.dll
2008-06-28 18:52 --------- d-----w C:\Program Files\NextSecurity.NET
2008-06-28 14:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-27 18:02 --------- d-----w C:\Program Files\Apple Software Update
2008-06-27 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-06-27 10:43 --------- d-----w C:\Program Files\Google
2008-06-26 20:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Macrovision
2008-06-26 19:58 --------- d-----w C:\Program Files\Opera
2008-06-26 19:55 --------- d-----w C:\Program Files\Common Files\Macromedia Shared
2008-06-26 19:54 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-06-24 15:31 --------- d-----w C:\Program Files\Hotspot Shield
2008-06-24 13:51 --------- d-----w C:\Program Files\Maxthon2
2008-06-22 20:42 12,464 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-06-22 19:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-22 11:27 --------- d-----w C:\Documents and Settings\WwW\Application Data\ONSPEED_TOOLBAR
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:09 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-20 11:08 --------- d-----w C:\Program Files\Windows Live
2008-06-20 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 13:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-18 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-06-18 12:50 --------- d-----w C:\Documents and Settings\WwW\Application Data\Ipswitch
2008-06-18 12:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ipswitch
2008-06-17 19:47 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-17 18:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-17 18:02 --------- d-----w C:\Program Files\Bonjour
2008-06-17 17:51 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-17 15:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-06-17 15:31 --------- d-----w C:\Program Files\Skype
2008-06-17 15:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-17 15:24 --------- d-----w C:\Program Files\Common Files\Java
2008-06-17 15:14 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-17 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [05/30/2008 03:54 PM 21718312]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:09 AM 1667584]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/15/2008 08:39 AM 931248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM 144784]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM 413696]
"Vistadrv"="C:\Program Files\VistaDrives\vsdrv.exe" [07/30/2006 03:37 AM 121089]
"SlipStream"="C:\Program Files\ONSPEED\onspeedcore.exe" [10/19/2007 05:50 AM 344064]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [08/04/2004 12:56 AM 158208]
"VTTimer"="VTTimer.exe" [03/07/2005 09:33 PM 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [03/11/2005 11:33 AM 147456 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [06/10/2003 01:12 PM 55296 C:\WINDOWS\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^ONSPEED.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\ONSPEED.lnk
backup=C:\WINDOWS\pss\ONSPEED.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 11/11/2005 07:47 AM 7311360 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 11/11/2005 07:47 AM 86016 C:\WINDOWS\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pdfFactory Pro Dispatcher v3]
--a------ 09/26/2006 10:33 PM 503808 C:\WINDOWS\system32\spool\drivers\w32x86\3\fppdis3a.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 11/06/2006 10:27 AM 200704 d:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 05/27/2008 10:50 AM 413696 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 06/17/2008 05:24 PM 77824 C:\Program Files\Java\jre1.6.0\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemManagerV1]
--a------ 11/12/2007 12:50 AM 1357312 C:\WINDOWS\SystemManagerV1.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 11/11/2005 07:47 AM 1519616 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"=
"C:\\AppServ\\Apache2.2\\bin\\httpd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\uTorrent\\utorrent.exe"=
"D:\\Program Files\\Ipswitch\\WS_FTP Professional\\wsftpgui.exe"=
"D:\\Program Files\\Valve\\hlds.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"C:\\AppServ\\MySQL\\bin\\mysqld-nt.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 AntiArpNdisProt;AntiARP NDIS Protocol Driver;C:\WINDOWS\system32\DRIVERS\AntiArpNdisProt.sys [10/17/2007 01:33 PM]
R2 Apache2.2;Apache2.2;C:\AppServ\Apache2.2\bin\httpd.exe [01/09/2007 06:17 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [01/23/2008 11:25 PM]
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys []
S2 AntiARPClientLoader;AntiARP Client Loader;C:\Program Files\ColorSoft\AntiARP\AntiARPClientLoader.exe []
S3 cpuz;cpuz;C:\DOCUME~1\WwW\LOCALS~1\Temp\cpuz.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [08/03/2005 06:10 AM]
S3 xAntiArp;xAntiArpSpoof Service;C:\WINDOWS\system32\DRIVERS\xAntiArp.sys [12/06/2007 02:16 PM]
.
s of the 'Scheduled Tasks' folder
"2008-07-29 06:01:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: &تصدير إلى Microsoft Excel - D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-31 13:52:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mysql]
"ImagePath"="C:\AppServ\MySQL\bin\mysqld-nt --defaults-file=C:\AppServ\MySQL\my.ini mysql"
.
Completion time: 07/31/2008 13:54:51
ComboFix-quarantined-files.txt 2008-07-31 11:54:18
Pre-Run: 11,469,795,328 bytes free
Post-Run: 11,491,368,960 bytes free
234 --- E O F --- 2008-07-25 05:42:24
