ComboFix 08-09-28.05 - Albaroon-Pc 09/30/2008 21:50:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.58 [GMT 3:00]
Running from: C:\Documents and Settings\Albaroon-Pc\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\sexit.dat
C:\WINDOWS\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-30 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 07:42 --------- d-----w C:\Program Files\Real_SC
2008-09-30 18:53 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-30 18:53 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-30 18:53 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-30 18:53 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-30 18:52 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\Skype
2008-09-30 18:43 --------- d-----w C:\Program Files\CrossLoop
2008-09-30 18:37 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\skypePM
2008-09-30 08:52 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-29 06:24 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-09-29 06:24 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-09-29 06:22 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-29 06:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-09-29 06:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-12 22:00 --------- d-----w C:\Program Files\oovooToolbar
2008-08-25 08:03 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-24 02:49 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\oovooToolbar
2008-08-23 13:34 104 --sh--w C:\Program Files\dld.dat
2008-08-22 02:18 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\Creative
2008-08-22 02:04 --------- d-----w C:\Program Files\Creative
2008-08-22 02:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-20 19:28 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\ooVoo Details
2008-08-20 19:21 --------- d-----w C:\Program Files\ooVoo
2008-08-20 03:50 --------- d-----w C:\Program Files\SWiSHvideo
2008-08-16 21:03 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\Nokia Multimedia Player
2008-08-16 21:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-09 22:29 13 ---h--w C:\Documents and Settings\All Users\Application Data\1جط13.sys
2008-08-09 22:29 --------- d-----w C:\Program Files\CoffeeCup Software
2008-08-09 22:19 --------- d-----w C:\Program Files\Photo-Colorizer 2
2008-08-09 22:01 --------- d-----w C:\Program Files\Invention Pilot
2008-08-09 22:00 72,192 ----a-w C:\WINDOWS\cadkasdeinst01e.exe
2008-08-05 22:39 --------- d-----w C:\Program Files\Webshots
2008-08-05 01:55 --------- d-----w C:\Program Files\TeamViewer3
2008-08-05 01:55 --------- d-----w C:\Documents and Settings\Albaroon-Pc\Application Data\TeamViewer
2008-07-29 17:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-07-22 19:20 47,104 ------w C:\WINDOWS\AKDeInstall.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [08/16/2007 04:19 PM 5728112]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:09 AM 1667584]
"oovoo.exe"="C:\Program Files\ooVoo\ooVoo.exe" [08/17/2008 04:42 PM 13498160]
"Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [10/27/2005 01:00 PM 299008]
"RegistryMechanic"="C:\Program Files\Registry Mechanic\RegMech.exe" [07/08/2008 04:41 PM 2828184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [07/19/2006 04:41 AM 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [06/13/2006 04:57 AM 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [06/13/2006 04:57 AM 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [06/13/2006 04:57 AM 118784]
"Samsung Common SM"="C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" [07/21/2004 11:23 AM 372736]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/22/2008 10:22 PM 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM 132496]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [06/18/2007 03:10 PM 271360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"RTHDCPL"="RTHDCPL.EXE" [07/19/2006 04:42 AM 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [07/19/2006 04:42 AM 2879488 C:\WINDOWS\SkyTel.exe]
"AGRSMMSG"="AGRSMMSG.exe" [12/13/2005 04:50 PM 88204 C:\WINDOWS\AGRSMMSG.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [06/19/2007 10:17 AM 1241088]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\ooVoo\\ooVoo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP

oVoo TCP port 443
"443:UDP"= 443:UDP

oVoo UDP port 443
"37674:TCP"= 37674:TCP

oVoo TCP port 37674
"37674:UDP"= 37674:UDP

oVoo UDP port 37674
"37675:UDP"= 37675:UDP

oVoo UDP port 37675
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM 24592]
S3 V0330VID;WebCam Vista;C:\WINDOWS\system32\DRIVERS\V0330Vid.sys [09/12/2006 08:00 PM 173632]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{153c8c62-5b92-11dd-a37c-001636a5906e}]
\Shell\AutoRun\command - H:\adgiygu.exe
\Shell\explore\Command - H:\adgiygu.exe
\Shell\open\Command - H:\adgiygu.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33692618-60d5-11dd-a38f-001636a5906e}]
\Shell\AutoRun\command - adgiygu.exe
\Shell\explore\Command - adgiygu.exe
\Shell\open\Command - adgiygu.exe
.
- - - - ORPHANS REMOVED - - - -
BHO-{A057A204-BACC-4D26-8087-36EE87E26986} - C:\PROGRA~1\OOVOOT~1\OOVOOT~1.DLL
Toolbar-{A057A204-BACC-4D26-8087-36EE87E26986} - C:\PROGRA~1\OOVOOT~1\OOVOOT~1.DLL
WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - C:\PROGRA~1\OOVOOT~1\OOVOOT~1.DLL
HKCU-Run-swg - C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
HKLM-Run-INPROCOMMWireless - C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe
HKLM-Run-gsvlnlo - C:\Program Files\Common Files\System\nluoyvq.exe
HKLM-Run-adgiygu - C:\Program Files\Common Files\Microsoft Shared\apgefvc.exe
HKU-Default-RunOnce-IETI - C:\Program Files\Skype\Phone\IEPlugin\unins000.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.webshots.com/r/internal/start/client/RAND
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-30 21:55:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Ela-Salaty\Salaty.exe
C:\DOCUME~1\ALBARO~1\LOCALS~1\temp\RtkBtMnt.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 09/30/2008 22:06:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-30 19:06:01
Pre-Run: 12,090,454,016 bytes free
Post-Run: 12,028,628,992 bytes free
157 --- E O F --- 2008-09-29 07:37:41