ComboFix 08-07-21.2 - user 07/22/2008 13:17:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.552 [GMT 3:00]
Running from: C:\Documents and Settings\user\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 10:20 385,056 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-22 10:19 3,416 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-22 10:19 --------- d-----w C:\Documents and Settings\user\Application Data\uTorrent
2008-07-22 10:17 --------- d-----w C:\Documents and Settings\user\Application Data\DMCache
2008-07-22 02:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-22 01:43 28,176 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-22 01:43 2,931,744 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-17 18:43 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-12 14:08 --------- d-----w C:\Documents and Settings\user\Application Data\HP
2008-06-22 13:36 --------- d-----w C:\Documents and Settings\user\Application Data\CyberScrub
2008-06-22 13:36 --------- d-----w C:\Documents and Settings\user\Application Data\cleaner
2008-06-19 13:36 --------- d-----w C:\Program Files\Any Video Converter Professional
2008-06-17 08:37 --------- d-----w C:\Program Files\Globe7
2008-06-17 02:17 --------- d-----w C:\Program Files\Image Grabber II
2008-06-16 16:03 --------- d-----w C:\Documents and Settings\user\Application Data\Globe7
2008-06-16 10:19 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-06-16 10:19 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-06-16 09:37 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-16 09:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-15 15:57 --------- d-----w C:\Program Files\Easy RealMedia Tools
2008-06-15 12:28 81,920 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-06-15 10:27 --------- d-----w C:\Program Files\AviSynth 2.5
2008-06-15 10:26 --------- d-----w C:\Program Files\AC3Filter
2008-06-05 09:07 --------- d-----w C:\Program Files\FlashGet
2008-06-05 06:30 --------- d-----w C:\Program Files\DAP
2008-06-05 05:56 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-06-05 01:38 --------- d-----w C:\Program Files\Opera
2008-06-04 14:03 --------- d-----w C:\Documents and Settings\user\Application Data\Orbit
2008-05-29 06:35 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-05-23 15:21 81,920 ----a-w C:\WINDOWS\system32\404Fix.exe
2008-05-23 15:19 --------- d-----w C:\Program Files\Video Convert Master
2008-05-20 12:18 81,920 -c--a-w C:\Documents and Settings\user\Application Data\ezpinst.exe
2008-05-20 12:18 47,360 -c--a-w C:\Documents and Settings\user\Application Data\pcouffin.sys
2008-05-18 18:40 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-05-14 10:36 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-05-10 19:34 11,439 ----a-w C:\ihxm8m.exe
2008-05-09 15:48 1,454,080 ----a-w C:\WINDOWS\system32\viscomamrenc.dll
2008-04-25 15:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll
2005-06-27 12:28 1,436 -c--a-w C:\Program Files\Kav.28.06.2008.key
2008-06-05 05:56 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.
كود:
<pre>
----a-w 3,101,003 2008-06-22 16:20:26 C:\Documents and Settings\user\My Documents\Downloads\Programs\المجموعة الثامنة اسلامية .exe
</pre>
------- Sigcheck -------
08/04/2004 12:14 AM 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
08/04/2004 12:14 AM 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((
snapshot@Sun 06-08-2008_22.31.01.67 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 05:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 05:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe
- 2006-09-16 16:44:28 314,368 ----a-w C:\WINDOWS\system32\avisynth.dll
+ 2004-09-01 14:49:56 284,672 ----a-w C:\WINDOWS\system32\avisynth.dll
- 2008-02-29 15:45:15 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\s\index.dat
+ 2008-07-21 02:11:28 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\s\index.dat
- 2008-02-29 15:45:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-07-21 02:11:28 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-02-29 15:45:15 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\.IE5\index.dat
+ 2008-07-21 02:11:28 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\.IE5\index.dat
- 2004-05-26 18:37:34 719,872 ----a-w C:\WINDOWS\system32\devil.dll
+ 2004-02-23 13:41:30 719,872 ----a-w C:\WINDOWS\system32\devil.dll
+ 2004-08-03 23:05:44 36,992 -c--a-w C:\WINDOWS\system32\dllcache\amdk6.sys
+ 2004-08-03 23:05:44 37,376 -c--a-w C:\WINDOWS\system32\dllcache\amdk7.sys
+ 2004-08-03 23:05:44 60,800 -c--a-w C:\WINDOWS\system32\dllcache\arp1394.sys
+ 2004-08-03 23:05:44 36,480 -c--a-w C:\WINDOWS\system32\dllcache\crusoe.sys
+ 2004-08-03 23:05:44 63,744 -c--a-w C:\WINDOWS\system32\dllcache\mf.sys
+ 2004-08-03 21:15:18 451,456 -c--a-w C:\WINDOWS\system32\dllcache\mrxsmb.sys
+ 2004-08-03 23:05:44 61,824 -c--a-w C:\WINDOWS\system32\dllcache\nic1394.sys
+ 2004-08-03 23:05:44 42,496 -c--a-w C:\WINDOWS\system32\dllcache\p3.sys
+ 2004-08-03 21:07:48 119,936 -c--a-w C:\WINDOWS\system32\dllcache\pcmcia.sys
+ 2004-08-03 21:07:48 67,584 -c--a-w C:\WINDOWS\system32\dllcache\sdbus.sys
+ 2001-08-23 11:00:00 51,712 -c--a-w C:\WINDOWS\system32\dllcache\tosdvd.sys
+ 2001-08-23 11:00:00 21,376 -c--a-w C:\WINDOWS\system32\dllcache\tsbvcap.sys
+ 2001-08-23 11:00:00 23,808 -c--a-w C:\WINDOWS\system32\dllcache\usbcamd.sys
- 2006-09-28 11:36:30 104,448 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
+ 2008-04-16 11:23:44 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
+ 2008-01-29 15:29:38 32,784 ----a-w C:\WINDOWS\system32\drivers\klbg.sys
+ 2008-03-13 16:02:46 26,640 ----a-w C:\WINDOWS\system32\drivers\klfltdev.sys
- 2008-03-01 08:11:43 174,864 ----a-w C:\WINDOWS\system32\drivers\klif.sys
+ 2008-07-17 17:59:41 187,920 ----a-w C:\WINDOWS\system32\drivers\klif.sys
+ 2008-03-25 17:07:10 24,592 ----a-w C:\WINDOWS\system32\drivers\klim5.sys
+ 2008-04-25 15:21:06 26,964 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
+ 2004-07-31 15:50:36 51,200 ----a-w C:\WINDOWS\system32\dumphive.exe
+ 2003-06-05 18:13:00 53,248 ----a-w C:\WINDOWS\system32\Process.exe
+ 2006-04-27 14:49:30 288,417 ----a-w C:\WINDOWS\system32\SrchSTS.exe
+ 2007-09-05 21:22:23 289,144 ----a-w C:\WINDOWS\system32\VCCLSID.exe
+ 2007-10-03 21:36:46 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/23/2007 08:37 PM 800768]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [04/25/2008 06:21 PM 201992]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/29/2008 10:51 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"vidc.vp31"= vp31vfw.dll
"msacm.divxa32"= msaud32_divx.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^delXP.bat]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\delXP.bat
backup=C:\WINDOWS\pss\delXP.batCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
-ra--c--- 05/11/2007 10:47 AM 790528 C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a--c--- 05/11/2005 11:12 PM 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 05/15/2007 03:55 PM 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 03/01/2007 03:57 PM 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a--c--- 11/02/2004 08:24 PM 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a--c--- 05/15/2007 03:55 PM 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
--a------ 02/07/2005 05:04 AM 94037 C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3Trayp]
-ra------ 02/06/2007 02:30 AM 176128 C:\WINDOWS\system32\S3Trayp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-ra------ 09/21/2006 11:36 AM 53248 C:\WINDOWS\system32\VTTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"E:\\WESTWOOD\\westwood\\ra2\\GAME.EXE"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [03/26/2007 10:26 AM]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [03/29/2007 06:36 AM]
R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [03/26/2007 10:26 AM]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [03/25/2008 08:07 PM]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [03/05/2007 04:54 AM]
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [08/03/2004 10:31 PM]
*Newly Created Service* - CATCHME
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page =
R1 -: HKCU-Internet Settings,ProxyServer = 212.11.191.11:8080
O8 -: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 -: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 -: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 -: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 -: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O18 -: Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} -
O18 -: Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} -
O16 -: Microsoft XML Parser for Java -
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-22 13:19:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 07/22/2008 13:21:51
ComboFix-quarantined-files.txt 2008-07-22 10:21:19
ComboFix2.txt 2008-06-17 17:08:54
ComboFix3.txt 2008-06-08 19:31:24
Pre-Run: 1,183,924,224 bytes free
Post-Run: 3,407,319,040 bytes free
209
k: