ComboFix 08-11-26.03 - vista 11/27/2008 1:02:41.2 - NTFSx86
Running from: c:\users\vista\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-26 to 2008-11-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 22:08 --------- d-----w c:\users\vista\AppData\Roaming\Free Download Manager
2008-11-25 09:03 13,025 ----a-w c:\users\vista\AppData\Roaming\nvModes.dat
2008-11-23 10:15 98,440 ----a-w c:\windows\system32\drivers\avgldx86.sys
2008-11-23 10:15 90,632 ----a-w c:\windows\system32\drivers\avgtdix.sys
2008-11-23 10:15 23,832 ----a-w c:\windows\system32\drivers\avgfwd6x.sys
2008-11-23 10:15 12,936 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2008-11-23 10:15 10,520 ----a-w c:\windows\System32\avgrsstx.dll
2008-11-22 12:12 --------- d-----w c:\programdata\avg8
2008-11-22 12:12 --------- d-----w c:\program files\AVG
2008-11-22 12:07 --------- d---a-w c:\programdata\TEMP
2008-11-22 12:04 --------- d-----w c:\users\vista\AppData\Roaming\URSoft
2008-11-22 11:42 --------- d-----w c:\users\vista\AppData\Roaming\IObit
2008-11-22 11:42 --------- d-----w c:\program files\IObit
2008-11-21 11:19 --------- d-----w c:\users\vista\AppData\Roaming\SuperAdBlocker.com
2008-11-21 11:07 --------- d-----w c:\program files\NoAdware
2008-11-21 09:43 --------- d-----w c:\program files\SuperAdBlocker.com
2008-11-21 08:37 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-19 22:25 28,672 ----a-w c:\windows\system32\drivers\RKHit.sys
2008-11-15 20:32 --------- d-----w c:\program files\Common Files\Adobe
2008-11-14 21:07 --------- d-----w c:\program files\EPCTV
2008-11-14 14:17 --------- d-----w c:\users\vista\AppData\Roaming\Sammsoft
2008-11-14 14:16 193,024 ----a-w C:\ARO.exe
2008-11-14 14:05 --------- d-----w c:\users\vista\AppData\Roaming\WIPE
2008-11-13 18:41 --------- d-----w c:\program files\Real
2008-11-13 18:41 --------- d-----w c:\program files\Common Files\xing shared
2008-11-13 18:41 --------- d-----w c:\program files\Common Files\Real
2008-11-13 14:40 --------- d-----w c:\program files\JetAudio
2008-11-12 10:12 --------- d-----w c:\programdata\Microsoft Help
2008-11-11 17:35 410,976 ----a-w c:\windows\System32\deploytk.dll
2008-11-11 17:35 --------- d-----w c:\program files\Java
2008-11-09 16:58 --------- d-----w c:\program files\McAfee.com
2008-11-09 13:44 --------- d-----w c:\programdata\OPTION16DEAF
2008-11-09 12:38 --------- d-----w c:\program files\SiteAdvisor
2008-11-09 12:31 --------- d-----w c:\programdata\SiteAdvisor
2008-11-09 10:19 --------- d-----w c:\program files\Common Files\BitDefender
2008-11-05 16:10 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-03 10:36 --------- d-----w c:\programdata\WLInstaller
2008-11-03 10:36 --------- d-----w c:\program files\Windows Live
2008-10-30 21:57 --------- d-----w c:\users\vista\AppData\Roaming\BSplayer
2008-10-26 05:16 --------- d-----w c:\programdata\Roxio
2008-10-23 14:16 339,968 ----a-w c:\windows\System32\pythoncom25.dll
2008-10-23 14:16 2,117,632 ----a-w c:\windows\System32\python25.dll
2008-10-23 14:16 114,688 ----a-w c:\windows\System32\pywintypes25.dll
2008-10-22 04:09 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-10-18 13:55 --------- d-----w c:\program files\Teorex
2008-10-17 09:53 --------- d-----w c:\users\vista\AppData\Roaming\elefundesktops
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 11:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 10:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 09:47 --------- d-----w c:\program files\Windows Mail
2008-10-13 17:40 --------- d-----w c:\programdata\Yahoo!
2008-10-13 10:34 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-13 10:28 --------- d-----w c:\users\vista\AppData\Roaming\Reallusion
2008-10-04 15:52 --------- d-----w c:\program files\Microsoft Works
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-09-30 13:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-09-16 16:26 1,332,197 ----a-w c:\windows\System32\pythondll.zip
2008-09-10 03:40 1,334,272 ----a-w c:\windows\System32\msxml6.dll
2008-09-05 05:14 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-09-03 03:59 468,992 ----a-w c:\windows\System32\newdev.dll
2008-09-03 03:58 74,752 ----a-w c:\windows\System32\newdev.exe
2008-08-28 03:40 712,704 ----a-w c:\windows\System32\WindowsCodecs.dll
2008-08-28 03:40 425,472 ----a-w c:\windows\System32\PhotodataHandler.dll
2008-08-28 03:40 347,136 ----a-w c:\windows\System32\WindowsCodecsExt.dll
2008-06-13 00:24 174 --sha-w c:\program files\desktop.ini
2008-05-08 19:04 12,902,733 ----a-w c:\users\vista\ArabTV1_.EXE
2005-05-11 13:23 1 --sha-w c:\windows\fidbox.dat
2008-03-13 20:35 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-03-13 20:35 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
2008-03-13 20:35 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\s\index.dat
.
(((((((((((((((((((((((((((((
snapshot@Wed 11-26-2008_15.04.14.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-26 11:53:28 14,020 ----a-w c:\windows\bthservsdp.dat
+ 2008-11-26 22:09:16 14,020 ----a-w c:\windows\bthservsdp.dat
- 2008-11-26 11:56:09 51,200 ----a-w c:\windows\inf\infpub.dat
+ 2008-11-26 22:00:06 51,200 ----a-w c:\windows\inf\infpub.dat
- 2008-11-26 11:56:09 143,360 ----a-w c:\windows\inf\infstrng.dat
+ 2008-11-26 22:00:06 143,360 ----a-w c:\windows\inf\infstrng.dat
- 2003-04-29 20:07:38 306,688 ----a-w c:\windows\IsUninst.exe
+ 2003-04-29 18:07:38 306,688 ----a-w c:\windows\IsUninst.exe
- 2008-11-26 11:55:15 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-11-26 22:11:07 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-11-26 11:55:15 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-11-26 22:11:07 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-11-26 11:56:42 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-26 22:11:44 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-26 22:11:44 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-11-26 11:56:36 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-26 22:11:44 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-26 22:11:44 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-11-26 11:09:57 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-26 22:01:38 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-11-26 11:09:57 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
+ 2008-11-26 22:01:38 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
- 2008-11-26 11:09:57 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
+ 2008-11-26 22:01:38 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
- 2008-11-26 11:17:31 106,120 ----a-w c:\windows\System32\perfc009.dat
+ 2008-11-26 13:25:40 106,120 ----a-w c:\windows\System32\perfc009.dat
- 2008-11-26 11:17:31 598,850 ----a-w c:\windows\System32\perfh009.dat
+ 2008-11-26 13:25:40 598,850 ----a-w c:\windows\System32\perfh009.dat
- 2008-11-26 11:58:51 17,696 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1279448002-3292429204-1925273592-1000_UserData.bin
+ 2008-11-26 22:13:14 17,820 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1279448002-3292429204-1925273592-1000_UserData.bin
- 2008-11-26 11:58:51 89,852 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-26 22:13:14 89,852 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-11-26 11:03:12 2,888 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-11-26 21:54:55 2,888 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-11-26 11:13:57 64,504 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-11-26 21:58:35 64,646 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-11-26 07:48:57 291,574 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-11-26 15:47:33 292,034 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SHIM LINK FREE BALL"="c:\programdata\Dumb Settings Rect.s9sid" [X]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [01/22/2008 06:13 PM 2449455]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [10/18/2007 01:34 PM 5724184]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [01/19/2008 10:33 AM 125952]
"CollaborationHost"="c:\windows\system32\p2phost.exe" [01/19/2008 10:33 AM 192000]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 10:33 AM 202240]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [01/19/2008 10:33 AM 1233920]
"SuperAdBlocker"="c:\program files\SuperAdBlocker.com\Super Ad Blocker\SAdBlock.exe" [08/01/2007 09:28 AM 1564672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [03/11/2007 02:21 PM 159744]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [02/12/2007 05:37 PM 174872]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [04/24/2007 04:11 AM 176128]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [03/12/2007 09:54 PM 50696]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [02/17/2005 09:11 AM 49152]
"CognizanceTS"="c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [12/22/2003 09:12 PM 17920]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 10:00 AM 33648]
"NvSvc"="c:\windows\system32\nvsvc.dll" [04/29/2007 01:05 PM 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [04/29/2007 01:05 PM 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [04/29/2007 01:05 PM 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [11/11/2008 08:35 PM 136600]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/13/2008 09:41 PM 185872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/15/2008 01:04 AM 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [11/23/2008 01:15 PM 1235736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [11/08/2006 03:39 AM 44128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7}"= "c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSEHB.DLL" [11/07/2006 12:58 PM 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SABWinLogon]
08/01/2007 09:28 AM 176128 c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=APSHook.dll,avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ASWLNPkg
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D5A969EC-ECAD-402D-A777-6C0B51693530}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{86C6D85B-AE63-439D-B771-7987EAD45E84}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A433D666-3D70-4224-801A-3CB323931ECB}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{B7F1F92E-6F4A-4300-8F36-0DEE8646DE0C}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{66DA871A-1825-46DF-B5AE-BBF316E688AB}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{739916D0-28B1-4449-9F14-5FB49CA2C035}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{BDDB942F-C678-4A0E-B8D0-5F9129C9ADCC}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{A872F064-1545-4A4C-8440-3C12883FF535}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{11CEC53D-BDA7-4E69-9B3F-8F8A2923BC89}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"{CD339C31-4DB4-4DDC-BEAC-C15926912220}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{AFDF178E-7831-4260-921D-435F8BD015FB}c:\\users\\vista\\appdata\\local\\temp\\temp1_sopcast3.0.3_by_sultan.zip\\sopcast3.0.3 by (sultan)\\sopcast3.0.3 by (sultan).exe"= UDP:c:\users\vista\appdata\local\temp\temp1_sopcast3.0.3_by_sultan.zip\sopcast3.0.3 by (sultan)\sopcast3.0.3 by (sultan).exe:sopcast3.0.3 by (sultan).exe
"UDP Query User{628529C0-FD21-41B1-8734-9B320A17D7BE}c:\\users\\vista\\appdata\\local\\temp\\temp1_sopcast3.0.3_by_sultan.zip\\sopcast3.0.3 by (sultan)\\sopcast3.0.3 by (sultan).exe"= TCP:c:\users\vista\appdata\local\temp\temp1_sopcast3.0.3_by_sultan.zip\sopcast3.0.3 by (sultan)\sopcast3.0.3 by (sultan).exe:sopcast3.0.3 by (sultan).exe
"TCP Query User{94F58C1C-A5F2-409B-80BA-2172156C2491}c:\\users\\vista\\sopcast3.0.3_by_sultan\\sopcast3.0.3 by (sultan)\\sopcast3.0.3 by (sultan).exe"= UDP:c:\users\vista\sopcast3.0.3_by_sultan\sopcast3.0.3 by (sultan)\sopcast3.0.3 by (sultan).exe:sopcast3.0.3 by (sultan).exe
"UDP Query User{CB4A96DC-CA0F-4B10-925D-5056996283BB}c:\\users\\vista\\sopcast3.0.3_by_sultan\\sopcast3.0.3 by (sultan)\\sopcast3.0.3 by (sultan).exe"= TCP:c:\users\vista\sopcast3.0.3_by_sultan\sopcast3.0.3 by (sultan)\sopcast3.0.3 by (sultan).exe:sopcast3.0.3 by (sultan).exe
"TCP Query User{3C1296B6-A027-4F2B-960D-387656AE0D68}c:\\users\\vista\\appdata\\roaming\\thinstall\\sopcast 3.0.3\\4000008d00003i\\sopadver.exe"= UDP:c:\users\vista\appdata\roaming\thinstall\sopcast 3.0.3\4000008d00003i\sopadver.exe:sopadver.exe
"UDP Query User{3CBC8C98-416B-4924-BC94-4FB63DBC4866}c:\\users\\vista\\appdata\\roaming\\thinstall\\sopcast 3.0.3\\4000008d00003i\\sopadver.exe"= TCP:c:\users\vista\appdata\roaming\thinstall\sopcast 3.0.3\4000008d00003i\sopadver.exe:sopadver.exe
"TCP Query User{0B75A09D-9B47-4303-B9C5-F60B30AAB04C}c:\\program files\\freewire\\freewire television\\freewire television.exe"= UDP:c:\program files\freewire\freewire television\freewire television.exe:Freewire Television
"UDP Query User{AC1C2F7C-5E66-4052-B3F2-664AB27B0274}c:\\program files\\freewire\\freewire television\\freewire television.exe"= TCP:c:\program files\freewire\freewire television\freewire television.exe:Freewire Television
"TCP Query User{368265B2-CC1A-4256-95A2-E95F9F231691}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.323\\english\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.323\english\setup.exe:Kaspersky Internet Security 7.0 Setup
"UDP Query User{59860ECC-918A-4010-9257-3FD2011D8431}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.323\\english\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.323\english\setup.exe:Kaspersky Internet Security 7.0 Setup
"TCP Query User{470D0D25-DFC8-4B48-817A-BD6BB306DBCF}c:\\kav\\kis7.0\\english\\setup.exe"= UDP:c:\kav\kis7.0\english\setup.exe:Kaspersky Internet Security 7.0 Setup
"UDP Query User{4BEF2169-DB57-4668-AFEF-297F81AF336D}c:\\kav\\kis7.0\\english\\setup.exe"= TCP:c:\kav\kis7.0\english\setup.exe:Kaspersky Internet Security 7.0 Setup
"{04942329-A7CC-452F-95FD-60CEDB71025F}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{5BBB2607-89FF-4F2A-BAFF-4D34BFFA9A7C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{39532FBB-670A-47DC-B614-FAC20583EECA}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{8EBE95B6-D141-4BAD-BF2A-DB50A17BDBAC}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{09B7E45E-0E76-4168-A0B1-79B6DA97FBA5}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{F498E84B-F658-41A4-AE8B-E06DB02A98CD}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{740DAC1C-4F0D-4E54-B831-45282BF05B0A}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E3815044-73E5-4B75-8CAD-BDCA5DB005B0}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{654FF5CC-E9C7-41FE-8DCF-C469B00E3D4C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{DE7267FB-B411-4B73-A0CF-3037E7AA81B0}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{C4DB0664-B34C-475F-A10C-A58D9B850634}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28ac62b7-1bf4-11dd-a526-001e3704093f}]
\shell\Auto\command - F:\setup.exe
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b80cb2bb-b87f-11dd-bb74-001e3704093f}]
\shell\explore\command - G:\explorer.exe
\shell\open\Command - G:\explorer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df5665a0-e02f-11dc-8135-001e3704093f}]
\shell\AutoRun\command - RavMon.exe
\shell\explore\Command - RavMon.exe -e
\shell\open\Command - RavMon.exe
.
s of the 'Scheduled Tasks' folder
2008-11-26 c:\windows\Tasks\User_Feed_Synchronization-{0D7898AA-F694-4F61-9E2F-FCE0D3DC7C2E}.job
- c:\windows\system32\msfeedssync.exe [01/19/2008 10:33 AM]
.
.
------- Supplementary Scan -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://www.googel.com/
mStart Page = hxxp://home.sweetim.com
IE: Free Download Manager تحميل الفيديو بواسطة -
files\Free Download Manager\dlfvideo.htm
IE: تحميل المحددة بفري داونلود مانيجر -
files\Free Download Manager\dlselected.htm
IE: تنزيل الكل بفري داونلود مانيجر -
files\Free Download Manager\dlall.htm
IE: تنزيل بفري داونلود مانيجر -
files\Free Download Manager\dllink.htm
TCP: {B700903D-5DCC-405A-B9C5-0EDE46E82203} = 212.93.192.4 212.93.192.9
c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
c:\windows\Downloaded Program Files\OSDC5.OSD
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
c:\windows\System32\msvcrt.dll - c:\windows\System32\mfc42.dll
c:\windows\System32\olepro32.dll
c:\windows\Downloaded Program Files\imcv1.dll
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413}
hxxp://66.186.63.170/talk.cab
c:\windows\Downloaded Program Files\talk.inf
c:\windows\Downloaded Program Files\ReadUid.ocx - O16 -: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA}
hxxp://66.186.63.170/ReadUid.CAB
c:\windows\Downloaded Program Files\ReadUid.INF
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-27 01:11:47
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(644)
c:\program files\Bioscrypt\VeriSoft\bin\ASWLNPkg.dll
c:\program files\Bioscrypt\VeriSoft\bin\ItMsg.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\progra~1\AVG\AVG8\avgwdsvc.exe
c:\progra~1\AVG\AVG8\avgfws8.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Microsoft Office\Office12\ONENOTEM.EXE
c:\windows\System32\rundll32.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 11/27/2008 1:21:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-26 22:21:36
ComboFix2.txt 2008-11-26 12:06:05
Pre-Run: 99,795,001,344 bytes free
Post-Run: 99,651,530,752 bytes free
323 --- E O F --- 2008-11-26 09:11:17
