ComboFix 08-07-01.5 - Abu.Nersian 07/02/2008 23:56:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.618 [GMT 3:00]
Running from: C:\Documents and Settings\Abu.Nersian\My Documents\Downloads\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\pskill.exe
C:\WINDOWS\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-02 21:02 19,217,440 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-02 21:02 1,008,160 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-02 20:54 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\DMCache
2008-07-02 20:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-02 17:51 --------- d-----w C:\Program Files\Uniblue
2008-07-02 17:51 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\Uniblue
2008-07-02 02:26 96,320 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-02 02:26 258,728 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-01 09:11 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-29 03:08 --------- d-----w C:\Program Files\Hotspot Shield
2008-06-25 14:33 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\Thinstall
2008-06-25 13:59 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\progeSOFT
2008-06-25 13:56 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-06-25 13:55 --------- d-----w C:\Program Files\Autodesk
2008-06-25 13:31 --------- d-----w C:\Program Files\progeSOFT
2008-06-25 04:46 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\YFSoftware
2008-06-25 04:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-25 04:45 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\IDM
2008-06-25 03:42 --------- d-----w C:\Program Files\Gogago
2008-06-24 04:39 --------- d-----w C:\Program Files\Photo-Brush
2008-06-24 04:38 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-23 14:20 --------- d-----w C:\Program Files\TechSmith
2008-06-23 14:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith
2008-06-23 14:13 --------- d-----w C:\Program Files\Google
2008-06-22 19:06 --------- d-----w C:\Program Files\BitDefender
2008-06-22 19:05 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-06-22 04:37 --------- d-----w C:\Program Files\Kelk 2000
2008-06-22 04:37 --------- d-----w C:\Program Files\7-Zip
2008-06-22 04:37 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\ErrorSweeper
2008-06-22 04:35 --------- d-----w C:\Program Files\QuickTime
2008-06-22 04:35 --------- d-----w C:\Program Files\Hide IP Platinum
2008-06-18 02:21 14,037 ----a-w C:\WINDOWS\system32\drivers\mdc8021x.sys
2008-06-17 20:39 --------- d-----w C:\Program Files\Intel
2008-06-17 17:14 501,248 ----a-w C:\WINDOWS\system32\winlogon.exe
2008-06-16 23:43 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\CyberScrub
2008-06-16 23:38 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\cleaner
2008-06-14 17:59 271,616 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 23:24 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-11 17:13 --------- d-----w C:\Program Files\Internet Download Manager
2008-06-07 17:09 --------- d-----w C:\Program Files\Microsoft Works
2008-06-07 10:08 --------- d-----w C:\Program Files\Xara
2008-06-07 10:08 --------- d-----w C:\Program Files\Common Files\Xara
2008-06-05 16:11 --------- d-----w C:\Program Files\SWFText
2008-06-05 13:52 --------- d-----w C:\Program Files\Ariss
2008-06-05 10:01 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\ViStart
2008-06-05 07:21 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-03 18:00 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\HP
2008-06-03 17:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-06-03 17:09 --------- d-----w C:\Program Files\Common Files\HP
2008-06-03 17:06 --------- d-----w C:\Program Files\HP
2008-06-03 17:04 --------- d-----w C:\Program Files\Hewlett-Packard
2008-06-03 17:03 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-06-01 18:46 --------- d-----w C:\Program Files\security
2008-05-30 03:14 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-05-29 04:12 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\Apple Computer
2008-05-28 16:20 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-05-28 16:19 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-05-27 16:06 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\AutoDWG
2008-05-23 02:36 --------- d-----w C:\Program Files\PumpLoad
2008-05-20 12:05 --------- d-----w C:\Program Files\Common Files\L&H
2008-05-20 12:04 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-19 10:57 --------- d-----w C:\Program Files\Magellass
2008-05-16 13:22 --------- d-----w C:\Documents and Settings\Abu.Nersian\Application Data\Alien Skin
2008-05-16 13:05 --------- d-----w C:\Program Files\Alien Skin
2008-05-15 14:50 9,974,784 ----a-w C:\WINDOWS\system32\MioPlayer2.dll
2008-05-14 05:59 --------- d-----w C:\Program Files\WMV9_VCM
2008-05-08 12:14 203,008 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 04:55 1,286,144 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-04 03:24 --------- d-----w C:\Program Files\SWiSHmax
2008-04-24 20:20 662,488 ----a-w C:\WINDOWS\system32\360x180° Mekan.scr
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-18 11:26 94,208 ----a-w C:\WINDOWS\system32\viscomaudiodata.dll
2008-04-17 03:41 218,624 ----a-w C:\WINDOWS\system32\uxtheme(2)(2).dll
2008-04-14 16:14 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 16:00 7,680 ----a-w C:\WINDOWS\system32\spdwnwxp.exe
2008-04-14 16:00 220,672 ----a-w C:\WINDOWS\system32\logon.scr
2008-04-14 03:23 155,995 ----a-w C:\WINDOWS\java\Packages\fpblbfp7.zip
2008-04-10 11:09 6,294,528 ----a-w C:\WINDOWS\system32\MioEncoder1.dll
.
------- Sigcheck -------
06/17/2008 08:14 PM 501248 02b900d9e95e4d560b4ee224b0bac0b6 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
06/17/2008 08:14 PM 501248 02b900d9e95e4d560b4ee224b0bac0b6 C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [06/11/2008 08:06 PM 2594224]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [05/05/2008 01:01 PM 1923352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [10/26/2004 12:01 PM 4632576]
"SigmaTel StacMon"="C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe" [04/29/2004 02:15 PM 90169]
"PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [05/28/2003 05:32 PM 86016]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/18/2008 02:07 PM 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM 413696]
C:\Documents and Settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
SnagIt 8.lnk - C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe [2007-05-01 11:11:48 6395464]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
01/12/2004 06:55 AM 110592 C:\WINDOWS\system32\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fax Machine]
[X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 10:16 PM 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DWQueuedReporting]
--a------ 08/24/2007 03:18 AM 437160 C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 08/24/2007 07:00 AM 33648 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 02/19/2006 02:41 AM 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 06/11/2008 08:06 PM 2594224 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 03/30/2008 10:36 AM 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 10/13/2004 09:21 AM 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pdfFactory Pro Dispatcher v2]
--a------ 11/10/2003 11:06 PM 385024 C:\WINDOWS\system32\spool\drivers\w32x86\3\fppdis2a.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRONoMgr.exe]
--a------ 05/28/2003 05:32 PM 86016 C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 02/22/2008 04:25 AM 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 04/18/2008 02:07 PM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCMSMMSG]
-ra------ 08/29/2003 01:59 PM 122880 C:\WINDOWS\BCMSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 08/04/2004 01:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
R0 WINSEC;WINSEC;C:\WINDOWS\system32\drivers\WINSEC.SYS [04/19/2005 12:57 AM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [01/24/2008 12:25 AM]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [11/22/2002 08:01 PM]
S4 winser;winser;C:\WINDOWS\system32\winsersec.exe [04/14/2005 01:37 AM]
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
"2008-05-24 04:23:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-07-02 00:30:00 C:\WINDOWS\Tasks\ErrorSweeper Scheduled Scan.job"
- C:\Program Files\ErrorSweeper\ErrorSweeper.ex
- C:\Program Files\ErrorSweeper
"2008-07-02 20:47:12 C:\WINDOWS\Tasks\GoogleUpdateTask.job"
- C:\Program Files\Google\Update\1.1.17.0\GoogleUpdate.exe
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
Notify-dimsntfy - (no file)
MSConfigStartUp-AFProg - C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
MSConfigStartUp-LClock - C:\Program Files\LClock\LClock.exe
MSConfigStartUp-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-TrueTransparency - C:\Program Files\TrueTransparency\TrueTransparency.exe
MSConfigStartUp-ViOrb - C:\Program Files\ViOrb\ViOrb.exe
MSConfigStartUp-Vista Sidebar - C:\Program Files\Vista Sidebar\sidebar.exe
MSConfigStartUp-ViStart - C:\Program Files\ViStart\ViStart.exe
MSConfigStartUp-WindowBlinds - C:\Documents and Settings\All Users\Documents\Stardock\WindowBlinds\WBInstall32.exe
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [URL]http://www.gmer.net[/URL]
Rootkit scan 2008-07-03 00:03:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 07/03/2008 0:06:17
ComboFix-quarantined-files.txt 2008-07-02 21:05:46
Pre-Run: 84,966,989,824 bytes free
Post-Run: 87,080,177,664 bytes free
214 --- E O F --- 2008-06-24 16:26:09
