هذا تقريري الثاني
ComboFix 08-11-19.08 - حمودة 11/30/2008 17:13:57.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1256.1.1033.18.351 [GMT 3:00]
Running from: c:\users\حمودة\Desktop\ComboFix.exe
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-30 13:41 335,904 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-30 13:40 --------- d-----w c:\programdata\Kaspersky Lab
2008-11-30 13:16 --------- d-----w c:\program files\SWiSH Max2
2008-11-30 12:51 6,352,832 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-30 12:51 541,927,456 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-30 12:51 2,200 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-30 12:40 --------- d-----w c:\program files\Common Files\SWiSHzone.com
2008-11-30 12:37 32,624,593 ----a-w c:\users\حمودة\SetupSwishmax2.exe
2008-11-30 12:37 32,624,593 ----a-w c:\users\حمودة\SetupSwishmax2.exe
2008-11-30 09:32 --------- d-----w c:\programdata\WindowsSearch
2008-11-30 01:41 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-11-29 22:19 --------- d-----w c:\program files\Microsoft Works
2008-11-29 22:07 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-11-29 22:05 --------- d-----w c:\program files\Kaspersky Lab
2008-11-21 00:53 --------- d-----w c:\users\حمودة\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-21 00:49 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-11-21 00:48 --------- d-----w c:\program files\Common Files\Adobe
2008-11-20 09:59 --------- d-----w c:\users\حمودة\AppData\Roaming\Skype
2008-11-14 11:41 --------- d-----w c:\program files\Magentic
2008-11-14 11:31 596,384 ----a-w c:\users\حمودة\magentic_install.exe
2008-11-14 11:31 596,384 ----a-w c:\users\حمودة\magentic_install.exe
2008-11-13 22:33 --------- d-----w c:\programdata\Microsoft Help
2008-11-07 23:39 --------- d-----w c:\users\حمودة\AppData\Roaming\ACD Systems
2008-11-07 23:37 --------- d-----w c:\programdata\ACD Systems
2008-11-07 23:37 --------- d-----w c:\program files\Common Files\ACD Systems
2008-11-07 23:37 --------- d-----w c:\program files\ACD Systems
2008-11-06 10:14 --------- d-----w c:\users\حمودة\AppData\Roaming\skypePM
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 11:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 10:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-11 05:47 --------- d-----w c:\programdata\Dell
2008-10-04 04:02 1,506 ----a-w c:\users\حمودة\AppData\Roaming\wklnhst.dat
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-09-29 22:40 --------- d-----w c:\program files\Internet Download Manager
2008-09-29 22:37 --------- d-----w c:\users\حمودة\AppData\Roaming\DMCache
2008-09-24 03:59 38,507,080 ----a-w c:\users\حمودة\kis8.0.0.454en.exe
2008-09-24 03:59 38,507,080 ----a-w c:\users\حمودة\kis8.0.0.454en.exe
2008-09-20 01:52 26,691,480 ----a-w c:\users\حمودة\setup_7.0.0.242_20.09.2008_03-50.exe
2008-09-20 01:52 26,691,480 ----a-w c:\users\حمودة\setup_7.0.0.242_20.09.2008_03-50.exe
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-09-10 03:40 1,334,272 ----a-w c:\windows\System32\msxml6.dll
2008-09-05 05:14 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-08-29 01:12 174 --sha-w c:\program files\desktop.ini
2008-08-29 00:17 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-08-29 00:17 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-08-28 15:44 56 ---ha-w c:\users\All Users\ezsidmv.dat
2008-08-28 15:44 56 ---ha-w c:\programdata\ezsidmv.dat
2008-08-12 03:39 443,392 ----a-w c:\windows\System32\win32spl.dll
2008-08-04 06:51 750,984 ----a-w c:\windows\System32\Magentic Screensaver.scr
2008-08-02 03:26 36,864 ----a-w c:\windows\System32\cdd.dll
2008-03-06 15:50 76 --sh--r c:\windows\CT4CET.bin
.
(((((((((((((((((((((((((((((
snapshot@Thu 11-20-2008_22.30.47.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-15 22:54:47 7,962 ----a-w c:\windows\bthservsdp.dat
+ 2008-11-30 12:51:10 7,962 ----a-w c:\windows\bthservsdp.dat
- 2008-10-13 05:17:48 51,200 ----a-w c:\windows\inf\infpub.dat
+ 2008-11-29 22:06:32 51,200 ----a-w c:\windows\inf\infpub.dat
- 2008-10-13 05:17:48 86,016 ----a-w c:\windows\inf\infstor.dat
+ 2008-11-29 22:06:32 86,016 ----a-w c:\windows\inf\infstor.dat
- 2008-10-13 05:17:48 143,360 ----a-w c:\windows\inf\infstrng.dat
+ 2008-11-29 22:06:31 143,360 ----a-w c:\windows\inf\infstrng.dat
+ 2007-12-12 12:06:42 295,606 ----a-r c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe
- 2008-11-16 17:11:47 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-11-30 12:52:15 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-11-16 17:11:47 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-11-30 12:52:15 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-09-25 03:31:21 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-24 21:35:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-09-25 03:31:21 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
+ 2008-11-24 21:35:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
- 2008-09-25 03:31:21 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\s\index.dat
+ 2008-11-24 21:35:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\s\index.dat
- 2008-11-20 19:26:14 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-30 14:14:30 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-30 14:14:30 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-11-20 19:26:08 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-30 14:15:40 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-30 14:15:40 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-07-18 19:08:20 72,256 ------w c:\windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe
+ 2008-10-16 11:08:00 70,416 ------w c:\windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe
- 2008-11-16 17:11:48 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-30 13:36:24 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-11-16 17:11:48 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
+ 2008-11-30 13:36:24 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
- 2008-11-16 17:11:48 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
+ 2008-11-30 13:36:24 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
+ 2008-07-21 15:34:36 121,872 ----a-w c:\windows\System32\drivers\kl1.sys
+ 2008-01-29 15:29:38 32,784 ----a-w c:\windows\System32\drivers\klbg.sys
+ 2008-03-13 16:02:46 26,640 ----a-w c:\windows\System32\drivers\klfltdev.sys
+ 2008-11-29 22:05:13 216,080 ----a-w c:\windows\System32\drivers\klif.sys
+ 2008-07-09 15:28:26 20,496 ----a-w c:\windows\System32\drivers\klim6.sys
+ 2008-07-29 17:20:00 24,774 ----a-w c:\windows\System32\drivers\klopp.dat
+ 2008-07-09 15:28:26 20,496 ----a-w c:\windows\System32\DriverStore\FileRepository\klim6.inf_bd3b4907\klim6.sys
+ 2008-07-29 17:21:42 218,376 ----a-w c:\windows\System32\klogon.dll
+ 2008-06-26 20:52:02 229,888 ----a-w c:\windows\System32\Macromed\Flash\FlashUtil10.exe
- 2008-03-06 15:47:02 74,137 ----a-w c:\windows\System32\Macromed\Flash\uninstall_activeX.exe
+ 2008-11-28 16:30:30 88,353 ----a-w c:\windows\System32\Macromed\Flash\uninstall_activeX.exe
- 2008-11-07 12:57:47 101,250 ----a-w c:\windows\System32\perfc009.dat
+ 2008-11-28 19:04:33 101,250 ----a-w c:\windows\System32\perfc009.dat
- 2008-11-07 12:57:47 587,178 ----a-w c:\windows\System32\perfh009.dat
+ 2008-11-28 19:04:33 587,178 ----a-w c:\windows\System32\perfh009.dat
- 2008-11-13 23:08:06 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2008-11-26 05:54:00 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat
- 2008-11-16 17:13:49 8,900 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1084989127-3419597925-788771253-1000_UserData.bin
+ 2008-11-30 12:54:26 9,044 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1084989127-3419597925-788771253-1000_UserData.bin
- 2008-11-16 17:13:48 66,558 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-30 12:54:25 71,192 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-11-13 23:07:39 7,188 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-11-29 22:11:06 7,188 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-11-16 17:13:45 43,872 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-11-30 12:54:23 44,386 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-11-08 19:11:39 257,564 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-11-30 09:33:03 288,744 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2008-11-20 16:50:16 306,940 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2008-11-30 09:14:10 312,968 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2004-03-29 12:23:44 90,112 ----a-w c:\windows\unvise32.exe
+ 2008-10-16 21:12:19 561,688 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.2.6001.788_none_107673f57a433d77\wuapi.dll
+ 2008-10-16 20:55:59 83,456 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.2.6001.788_none_107673f57a433d77\wudriver.dll
+ 2008-10-16 21:08:57 34,328 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.2.6001.788_none_107673f57a433d77\wups.dll
+ 2008-10-16 10:56:04 31,232 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.2.6001.788_none_ba8134361ffa6f73\wuapp.exe
+ 2008-10-16 11:08:00 162,064 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.2.6001.788_none_ba8134361ffa6f73\wuwebv.dll
+ 2008-10-16 21:09:43 51,224 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.2.6001.788_none_2a6539a96682e474\wuauclt.exe
+ 2008-10-16 21:13:38 1,809,944 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.2.6001.788_none_2a6539a96682e474\wuaueng.dll
+ 2008-10-16 21:09:43 43,544 ----a-w c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.2.6001.788_none_2a6539a96682e474\wups2.dll
+ 2008-10-16 20:56:28 1,524,736 ----a-w c:\windows\winsxs\x86_microsoft-windows-windowsupdateclient-ui_31bf3856ad364e35_7.2.6001.788_none_a8125d5406872725\wucltux.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [01/19/2008 10:33 AM 1233920]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [08/13/2008 06:32 PM 206064]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"googletalk"="c:\users\حمودة\AppData\Roaming\Google\Google Talk\googletalk.exe" [01/02/2007 12:22 AM 3739648]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 10:33 AM 202240]
"Magentic"="c:\progra~1\Magentic\bin\Magentic.exe" [08/04/2008 09:51 AM 488808]
"WindowsWelcomeCenter"="oobefldr.dll" [01/19/2008 10:36 AM 2153472 c:\windows\System32\oobefldr.dll]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [09/07/2007 09:49 AM 159744]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [08/28/2007 08:51 AM 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [12/15/2007 06:54 AM 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [12/15/2007 06:53 AM 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [12/15/2007 06:53 AM 133656]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [07/27/2007 07:43 PM 118784]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [03/21/2007 04:00 PM 174872]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [12/12/2007 10:03 AM 3444736]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [11/15/2007 12:24 PM 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [11/01/2007 06:39 PM 189736]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [08/13/2008 06:32 PM 206064]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [11/12/2007 02:07 PM 405504]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM 33648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [06/12/2008 02:38 AM 34672]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [07/29/2008 08:20 PM 206088]
c:\users\¥êي§،\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 703280]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-03-06 50688]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2007-09-07 1180952]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll,c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll,c:\progra~1\KASPER~1\KASPER~1\adialhk.dll,c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{78867C79-3068-4C73-81AC-A191CA40E69E}"= c:\program files\Dell\MediaDirect\MediaDirect.exe
ell MediaDirect
"{76900125-770C-4EE9-8100-D6CD22F7F0AD}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{C6F7D818-A29C-4D5A-BA45-75F97299BFC3}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{BFA8ED70-5F88-4234-8241-642CBF8A0BCA}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{8944BE41-E9C9-467D-B399-52B57CECF7AF}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6A2362E4-43B0-4B62-9712-006EBC51AE18}"= UDP:443
oVoo TCP المنفذ 443
"{EB24A230-6688-4815-A5F2-77D18BE204EF}"= TCP:443
oVoo UDP المنفذ 443
"{B0C1EA15-69DD-494E-BB3F-E656741168A1}"= UDP:37674
oVoo TCP المنفذ 37674
"{07368AA3-D942-46EF-9AD9-2534904A3927}"= TCP:37674
oVoo UDP المنفذ 37674
"{81B2D78A-7F31-431B-812F-112478AE0061}"= TCP:37675
oVoo UDP المنفذ 37675
"{9004A8E3-2DA5-404B-8837-B326731878C5}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A68A2397-23EE-4AA1-B0A8-7A6CC7FCF467}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{D7DC0780-8711-4A88-823A-4D97D214FE3B}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{7825D35E-3DAC-45AC-B1BB-73DF08D1AA9D}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{3FF953A7-A23C-48C8-B6CC-F7BB1D35E38B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A74D8A0F-7ABC-46E0-8139-B73576AD8A8F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D0F16471-CF58-4DA5-BDF2-FBF7FAE2B8FD}"= Disabled:UDP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{68A03F9B-E8C5-411E-8135-8603312EB4C6}"= Disabled:TCP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{AF39730F-41A3-4687-BC73-C89D4E87CFF6}"= Disabled:UDP:c:\users\حمودة\AppData\Local\Temp\ImInstaller\magentic_installer.exe:IncrediMail Installer
"{D5609CFF-B5D9-494A-9D83-9F3D6CF64D26}"= Disabled:TCP:c:\users\حمودة\AppData\Local\Temp\ImInstaller\magentic_installer.exe:IncrediMail Installer
"{BE9FBCFE-2270-4EC6-886F-6EEA3840DD60}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{D7860EDF-7A1B-43BC-B56D-2E97145C810D}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{A6C2C73B-6BB3-49BD-BB9F-EDC762BAC835}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{DD9F5A0E-9210-402F-A6F4-B595F0571433}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{1D30134E-FEBB-4C11-A8BB-D9059DB1F20E}"= Disabled:UDP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{0AD96397-21A3-40E3-ACE2-B46962402084}"= Disabled:TCP:c:\program files\Magentic\bin\MgApp.exe:Magentic
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2008-03-06 73728]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-03-07 111104]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\DRIVERS\OEM02Dev.sys [2008-03-07 235520]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\DRIVERS\OEM02Vfx.sys [2008-03-07 7424]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52248c78-b8bc-11dd-a7ba-001e4ce2ed83}]
\shell\AutoRun\command - F:\sq.com
\shell\explore\Command - F:\sq.com
\shell\open\Command - F:\sq.com
.
s of the 'Scheduled Tasks' folder
2008-11-30 c:\windows\Tasks\User_Feed_Synchronization-{60EBA100-D7E0-4B5D-AD69-57E3F5D96DE8}.job
- c:\windows\system32\msfeedssync.exe [01/19/2008 10:33 AM]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\users\حمودة\AppData\Roaming\Mozilla\Firefox\Profiles\3etcts5j.default\
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF -: plugin - c:\program files\Java\jre1.6.0\bin\npoji610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-30 17:15:45
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 11/30/2008 17:22:02
ComboFix-quarantined-files.txt 2008-11-30 14:20:52
ComboFix2.txt 2008-11-20 19:33:20
Pre-Run: 70,462,201,856 bytes free
Post-Run: 70,292,783,104 bytes free
270 --- E O F --- 2008-11-19 22:47:18
