ComboFix 08-08-25.01 - HAMZA 2008-08-26 16:24:21.3 -
FAT32x86Microsoft Windows XP Professional 5.1.2600.0.1256.1.1025.18.32 [GMT 3:00]Running from: C:\Documents and Settings\HAMZA\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))).2008-08-26 16:15 . 2008-08-26 16:15 d-------- C:\Documents and Settings\HAMZA\Application Data\CyberScrub2008-08-26 15:58 . 2008-08-26 15:58 d-------- C:\Documents and Settings\HAMZA\Application Data\cleaner2008-08-26 03:52 . 2001-09-18 13:49 907,456 --a------ C:\WINDOWS\system32\dllcache\hcf_msft.sys2008-08-26 03:52 . 2001-09-18 13:49 82,432 --a------ C:\WINDOWS\system32\dllcache\grclass.sys2008-08-26 03:52 . 2001-09-18 13:49 25,856 --a------ C:\WINDOWS\system32\dllcache\grserial.sys2008-08-26 03:52 . 2001-09-18 13:49 17,408 --a------ C:\WINDOWS\system32\dllcache\gpr400.sys2008-08-26 03:50 . 2001-09-18 13:44 634,134 --a------ C:\WINDOWS\system32\dllcache\el656ct5.sys2008-08-26 03:49 . 2001-08-17 12:20 334,208 --a------ C:\WINDOWS\system32\dllcache\ds1wdm.sys2008-08-26 03:49 . 2001-09-18 13:44 117,760 --a------ C:\WINDOWS\system32\dllcache\e100b325.sys2008-08-26 03:49 . 2001-08-17 12:10 69,692 --a------ C:\WINDOWS\system32\dllcache\el575nd5.sys2008-08-26 03:49 . 2001-08-17 12:10 55,999 --a------ C:\WINDOWS\system32\dllcache\el556nd5.sys2008-08-26 03:49 . 2001-09-18 13:44 50,719 --a------ C:\WINDOWS\system32\dllcache\e1000nt5.sys2008-08-26 03:49 . 2001-09-18 13:44 44,103 --a------ C:\WINDOWS\system32\dllcache\el515.sys2008-08-26 03:49 . 2001-08-17 12:10 26,141 --a------ C:\WINDOWS\system32\dllcache\el589nd5.sys2008-08-26 03:49 . 2001-08-17 12:10 24,653 --a------ C:\WINDOWS\system32\dllcache\el574nd4.sys2008-08-26 03:49 . 2001-08-17 12:12 19,594 --a------ C:\WINDOWS\system32\dllcache\e100isa4.sys2008-08-26 03:49 . 2001-09-18 14:06 18,944 --a------ C:\WINDOWS\system32\dllcache\dshowext.ax2008-08-26 03:47 . 2001-09-18 14:03 419,357 --a------ C:\WINDOWS\system32\dllcache\dgconfig.dll2008-08-26 03:46 . 2001-08-17 13:52 14,976 --a------ C:\WINDOWS\system32\dllcache\cpqarray.sys2008-08-26 03:42 . 2001-09-18 13:33 980,034 --a------ C:\WINDOWS\system32\dllcache\cicap.sys2008-08-26 03:42 . 2001-09-18 13:33 272,640 --a------ C:\WINDOWS\system32\dllcache\cinemclc.sys2008-08-26 03:42 . 2001-08-17 13:53 7,296 --a------ C:\WINDOWS\system32\dllcache\changer.sys2008-08-26 03:40 . 2001-09-18 14:03 382,592 --a------ C:\WINDOWS\system32\dllcache\atidrab.dll2008-08-26 03:39 . 2001-08-17 13:28 762,780 --a------ C:\WINDOWS\system32\dllcache\3cwmcru.sys2008-08-26 03:37 . 2001-09-18 13:47 1,900,032 --a------ C:\WINDOWS\system32\dllcache\ntkrnlmp.exe2008-08-26 03:37 . 2001-09-18 14:03 66,048 --a------ C:\WINDOWS\system32\dllcache\s3legacy.dll2008-08-26 00:29 . 2001-08-17 12:12 23,070 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys2008-08-26 00:29 . 2001-08-17 12:12 23,070 --a------ C:\WINDOWS\system32\dllcache\rtl8139.sys2008-08-25 23:14 . 2008-08-25 23:14 d--hs---- C:\FOUND.0042008-08-25 22:59 . 2008-08-25 22:59 d-------- C:\Documents and Settings\All Users\قائمة ابدأ2008-08-25 20:13 . 2008-08-25 20:13 15,781 --a------ C:\WINDOWS\system32\drivers\mdc8021x.sys2008-08-25 20:04 . 2008-08-25 20:04 d-------- C:\Documents and Settings\HAMZA\قائمة ابدأ2008-08-25 20:04 . 2008-08-25 20:04 d-------- C:\Documents and Settings\HAMZA\سطح المكتب2008-08-24 21:13 . 2008-08-24 21:13 d-------- C:\log2008-08-24 20:45 . 2008-08-24 20:45 d-------- C:\Program Files\Alwil Software2008-08-24 20:45 . 2003-03-18 23:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll2008-08-24 20:16 . 2008-08-24 20:16 d--hs---- C:\FOUND.003.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-08-25 14:24 66,048 ----a-w C:\WINDOWS\notepad.exe2008-08-25 14:24 267,264 ----a-w C:\WINDOWS\winhlp32.exe2008-08-25 14:24 26,647 ----a-w C:\WINDOWS\hh.exe2008-08-25 14:24 25,600 ----a-w C:\WINDOWS\twunk_32.exe2008-08-25 14:24 134,656 ----a-w C:\WINDOWS\regedit.exe2008-08-25 14:22 99,840 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\HelpHost.exe2008-08-25 14:22 694,272 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\HelpSvc.exe2008-08-25 14:22 692,224 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe2008-08-25 14:22 145,408 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msconfig.exe2008-08-25 14:22 1,000,960 ----a-w C:\WINDOWS\explorer.exe2008-08-25 14:20 3,374,640 ----a-w C:\WINDOWS\Help\Tours\mmTour\tour.exe2008-08-25 14:18 98,816 ----a-w C:\WINDOWS\system32\clipbrd.exe2008-08-25 14:18 77,824 ----a-w C:\WINDOWS\system32\wmpstub.exe2008-08-25 14:18 40,448 ----a-w C:\WINDOWS\system32\tscupgrd.exe2008-08-25 14:18 35,328 ----a-w C:\WINDOWS\system32\winchat.exe2008-08-25 14:18 32,768 ----a-w C:\WINDOWS\system32\mnmsrvc.exe2008-08-25 14:18 135,680 ----a-w C:\WINDOWS\system32\mobsync.exe2008-08-25 14:18 130,048 ----a-w C:\WINDOWS\system32\sessmgr.exe2008-08-25 14:18 118,834 ----a-w C:\WINDOWS\system32\wscript.exe2008-08-25 14:17 81,408 ----a-w C:\WINDOWS\system32\logagent.exe2008-08-25 14:17 60,416 ----a-w C:\WINDOWS\system32\wextract.exe2008-08-25 14:17 31,744 ----a-w C:\WINDOWS\system32\tracert6.exe2008-08-25 14:16 70,144 ----a-w C:\WINDOWS\system32\tlntsess.exe2008-08-25 14:16 70,144 ----a-w C:\WINDOWS\system32\telnet.exe2008-08-25 14:16 38,160 ----a-w C:\WINDOWS\system32\MAPISRVR.EXE2008-08-25 14:16 231,936 ----a-w C:\WINDOWS\system32\tracerpt.exe2008-08-25 14:16 19,456 ----a-w C:\WINDOWS\system32\tcpsvcs.exe2008-08-25 14:15 86,016 ----a-w C:\WINDOWS\system32\smlogsvc.exe2008-08-25 14:15 667,648 ----a-w C:\WINDOWS\system32\ss3dfo.scr2008-08-25 14:15 638,976 ----a-w C:\WINDOWS\system32\sstext3d.scr2008-08-25 14:15 569,344 ----a-w C:\WINDOWS\system32\sspipes.scr2008-08-25 14:15 51,200 ----a-w C:\WINDOWS\system32\syncapp.exe2008-08-25 14:15 37,888 ----a-w C:\WINDOWS\system32\sdbinst.exe2008-08-25 14:15 364,544 ----a-w C:\WINDOWS\system32\ssflwbox.scr2008-08-25 14:15 29,696 ----a-w C:\WINDOWS\system32\sethc.exe2008-08-25 14:15 20,992 ----a-w C:\WINDOWS\system32\setup.exe2008-08-25 14:15 132,096 ----a-w C:\WINDOWS\system32\taskmgr.exe2008-08-25 14:15 103,936 ----a-w C:\WINDOWS\system32\sysocmgr.exe2008-08-25 14:13 46,080 ----a-w C:\WINDOWS\system32\drwtsn32.exe2008-08-25 14:13 45,056 ----a-w C:\WINDOWS\system32\cipher.exe2008-08-25 14:13 39,424 ----a-w C:\WINDOWS\system32\net.exe2008-08-25 14:13 27,136 ----a-w C:\WINDOWS\system32\ddeshare.exe2008-08-25 14:13 204,800 ----a-w C:\WINDOWS\system32\dmadmin.exe2008-08-25 14:13 19,456 ----a-w C:\WINDOWS\system32\arp.exe2008-08-25 14:13 145,920 ----a-w C:\WINDOWS\system32\diskpart.exe2008-08-25 14:13 118,784 ----a-w C:\WINDOWS\system32\imapi.exe2008-08-25 14:13 102,450 ----a-w C:\WINDOWS\system32\cscript.exe2008-08-25 14:11 80,384 ----a-w C:\WINDOWS\system32\charmap.exe2008-08-25 14:11 66,048 ----a-w C:\WINDOWS\system32\notepad.exe2008-08-25 14:11 55,808 ----a-w C:\WINDOWS\system32\freecell.exe2008-08-25 14:11 385,536 ----a-w C:\WINDOWS\system32\mstsc.exe2008-08-25 14:11 339,968 ----a-w C:\WINDOWS\system32\mspaint.exe2008-08-25 14:11 32,768 ----a-w C:\WINDOWS\system32\odbcad32.exe2008-08-25 14:11 28,160 ----a-w C:\WINDOWS\system32\dplaysvr.exe2008-08-25 14:11 139,264 ----a-w C:\WINDOWS\system32\sndvol32.exe2008-08-25 14:11 124,416 ----a-w C:\WINDOWS\system32\sndrec32.exe2008-08-25 14:11 116,736 ----a-w C:\WINDOWS\system32\mplay32.exe2008-08-25 14:11 114,688 ----a-w C:\WINDOWS\system32\calc.exe2008-08-25 14:11 1,139,200 ----a-w C:\WINDOWS\system32\ntbackup.exe2008-08-25 14:10 130,048 ----a-w C:\WINDOWS\system32\dllcache\sessmgr.exe2008-08-25 14:10 116,736 ----a-w C:\WINDOWS\system32\dllcache\mplay32.exe2008-08-25 14:09 77,824 ----a-w C:\WINDOWS\system32\dllcache\wmpstub.exe2008-08-25 14:09 66,048 ----a-w C:\WINDOWS\system32\dllcache\notepad.exe2008-08-25 14:09 61,508 ----a-w C:\WINDOWS\system32\dllcache\usrprbda.exe2008-08-25 14:09 534,016 ----a-w C:\WINDOWS\system32\dllcache\spider.exe2008-08-25 14:09 40,448 ----a-w C:\WINDOWS\system32\dllcache\tscupgrd.exe2008-08-25 14:09 36,937 ----a-w C:\WINDOWS\system32\dllcache\zclientm.exe2008-08-25 14:09 27,648 ----a-w C:\WINDOWS\system32\dllcache\wabmig.exe2008-08-25 14:09 158,720 ----a-w C:\WINDOWS\system32\dllcache\wbemtest.exe2008-08-25 14:09 118,834 ----a-w C:\WINDOWS\system32\dllcache\wscript.exe2008-08-25 14:08 737,360 ----a-w C:\WINDOWS\system32\dllcache\tintsetp.exe2008-08-25 14:08 60,416 ----a-w C:\WINDOWS\system32\dllcache\wextract.exe2008-08-25 14:08 49,152 ----a-w C:\WINDOWS\system32\dllcache\rsmui.exe2008-08-25 14:08 339,968 ----a-w C:\WINDOWS\system32\dllcache\mspaint.exe2008-08-25 14:08 32,768 ----a-w C:\WINDOWS\system32\dllcache\mnmsrvc.exe2008-08-25 14:08 31,744 ----a-w C:\WINDOWS\system32\dllcache\tracert6.exe2008-08-25 14:08 3,374,640 ----a-w C:\WINDOWS\system32\dllcache\tourW.exe2008-08-25 14:08 118,784 ----a-w C:\WINDOWS\system32\dllcache\imapi.exe2008-08-25 14:07 70,144 ----a-w C:\WINDOWS\system32\dllcache\tlntsess.exe2008-08-25 14:07 70,144 ----a-w C:\WINDOWS\system32\dllcache\telnet.exe2008-08-25 14:07 67,584 ----a-w C:\WINDOWS\system32\dllcache\magnify.exe2008-08-25 14:07 638,976 ----a-w C:\WINDOWS\system32\dllcache\sstext3d.scr2008-08-25 14:07 57,344 ----a-w C:\WINDOWS\system32\dllcache\msimn.exe2008-08-25 14:07 569,344 ----a-w C:\WINDOWS\system32\dllcache\sspipes.scr2008-08-25 14:07 51,200 ----a-w C:\WINDOWS\system32\dllcache\syncapp.exe2008-08-25 14:07 51,200 ----a-w C:\WINDOWS\system32\dllcache\spoolsv.exe2008-08-25 14:07 231,936 ----a-w C:\WINDOWS\system32\dllcache\tracerpt.exe2008-08-25 14:07 143,421 ----a-w C:\WINDOWS\system32\dllcache\tintlphr.exe2008-08-25 14:07 132,096 ----a-w C:\WINDOWS\system32\dllcache\taskmgr.exe2008-08-25 14:07 12,800 ----a-w C:\WINDOWS\system32\dllcache\svchost.exe2008-08-25 14:06 91,136 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe2008-08-25 14:06 86,016 ----a-w C:\WINDOWS\system32\dllcache\smlogsvc.exe2008-08-25 14:06 667,648 ----a-w C:\WINDOWS\system32\dllcache\ss3dfo.scr2008-08-25 14:06 66,560 ----a-w C:\WINDOWS\system32\dllcache\setup50.exe2008-08-25 14:06 364,544 ----a-w C:\WINDOWS\system32\dllcache\ssflwbox.scr2008-08-25 14:06 35,328 ----a-w C:\WINDOWS\system32\dllcache\winchat.exe2008-08-25 14:06 25,600 ----a-w C:\WINDOWS\system32\dllcache\routemon.exe2008-08-25 14:06 221,184 ----a-w C:\WINDOWS\system32\dllcache\setup_wm.exe2008-08-25 14:06 101,376 ----a-w C:\WINDOWS\system32\dllcache\services.exe2008-08-25 14:05 98,816 ----a-w C:\WINDOWS\system32\dllcache\migload.exe.------- Sigcheck -------2008-08-25 17:22 1000960 f5e34d584e715cdb207cba34ae1d52f3 C:\WINDOWS\explorer.exe2008-08-25 17:12 21504 03e4a9fb2bdbffbc32e89c49dfc94c34 C:\WINDOWS\system32\userinit.exe2008-08-25 17:04 21504 03e4a9fb2bdbffbc32e89c49dfc94c34 C:\WINDOWS\system32\dllcache\userinit.exe.((((((((((((((((((((((((((((( snapshot@2008-08-26_14.36.40.62 ))))))))))))))))))))))))))))))))))))))))).- 2008-08-26 10:52:48 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\s\index.dat+ 2008-08-26 13:19:44 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\s\index.dat- 2008-08-26 10:52:48 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat+ 2008-08-26 13:19:44 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat- 2008-08-26 10:52:48 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\.IE5\index.dat+ 2008-08-26 13:19:44 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\.IE5\index.dat- 2008-08-25 19:19:16 40,118 ----a-w C:\WINDOWS\system32\perfc001.dat+ 2008-08-26 13:22:34 40,118 ----a-w C:\WINDOWS\system32\perfc001.dat- 2008-08-25 19:19:18 40,128 ----a-w C:\WINDOWS\system32\perfc009.dat+ 2008-08-26 13:22:34 40,128 ----a-w C:\WINDOWS\system32\perfc009.dat- 2008-08-25 19:19:16 251,674 ----a-w C:\WINDOWS\system32\perfh001.dat+ 2008-08-26 13:22:34 251,674 ----a-w C:\WINDOWS\system32\perfh001.dat- 2008-08-25 19:19:18 311,740 ----a-w C:\WINDOWS\system32\perfh009.dat+ 2008-08-26 13:22:34 311,740 ----a-w C:\WINDOWS\system32\perfh009.dat+ 2008-08-26 13:19:00 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_5a8.dat.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2001-09-19 12:00 13312]"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-08-25 17:28 1077277][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]"Privacy Suite"="C:\Documents and Settings\HAMZA\Application Data\cleaner\CSPSeraser.exe" [2007-11-20 14:19 872080][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 17:38 78008][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2001-09-19 12:00 13312][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"msacm.l3acm"= l3codecp.acm"VIDC.VCR2"= ATIVCR2.DLL"VIDC.DRAW"= DVIDEO.DLL"VIDC.VCR1"= ATIVCR1.DLL"VIDC.YV12"= ATIYUV12.DLL"VIDC.YU12"= ATIYUV12.DLL [HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Microsoft Office.lnk]path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Microsoft Office.lnkbackup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]--a------ 2003-12-03 06:52 106572 C:\Program Files\ATI Multimedia\main\LaunchPd.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]--a------ 2008-08-25 17:32 188416 C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]--a------ 2008-08-25 17:31 335872 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]--------- 2001-09-19 12:00 13312 C:\WINDOWS\system32\ctfmon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]--a------ 2008-08-25 17:21 208949 C:\WINDOWS\ime\imjp8_1\imjpmig.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]--a------ 2008-08-25 17:28 1077277 C:\Program Files\Messenger\msmsgs.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]--a------ 2008-08-25 17:10 77824 C:\WINDOWS\system32\IME\PINTLGNT\IMSCINST.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]--a------ 2008-08-25 17:10 737360 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]--a------ 2008-08-25 17:10 737360 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXER1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-07-19 17:35]R3 S3SAVAGE4M;S3SAVAGE4M;C:\WINDOWS\System32\DRIVERS\s3sav4m.sys [2001-08-17 12:50]S2 TTDec;ATI WDM Teletext Decoder;C:\WINDOWS\System32\DRIVERS\ATINTTXX.sys [2003-09-19 01:31]S3 V90drv;v90drv;C:\WINDOWS\System32\DRIVERS\v90drv.sys [2001-11-29 11:10]*Newly Created Service* - ALG*Newly Created Service* - IPNAT..------- Supplementary Scan -------.R0 -: HKCU-Main,Start Page = hxxp://www.google.com/R1 -: HKCU-Internet Connection Wizard,ShellNext = iexploreO8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 -: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm.**************************************************************************catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
scan 2008-08-26 16:26:13Windows 5.1.2600 FAT NTAPIscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------PROCESS: C:\WINDOWS\system32\winlogon.exe-> C:\WINDOWS\system32\Ati2evxx.dll.Completion time: 2008-08-26 16:27:47ComboFix-quarantined-files.txt 2008-08-26 13:27:34ComboFix3.txt 2008-08-26 11:37:22ComboFix2.txt 2008-08-26 12:56:18Pre-Run: 5,056,659,456 bytes freePost-Run: 5,048,143,872 bytes free249