ComboFix 08-12-11.03 - ADMIN 12/14/2008 1:49:35.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.274 [GMT 3:00]
Running from: c:\documents and settings\ADMIN\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\e100bmsg.dll
c:\windows\system32\igfxres.dll
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 12:22 --------- d-----w c:\program files\MSECache
2008-11-30 17:05 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-11-30 17:05 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_HpqKbFiltr_01005.Wdf
2008-11-30 17:04 --------- d-----w c:\program files\Synaptics
2008-11-30 16:30 --------- d-----w c:\program files\NetWaiting
2008-11-30 16:29 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-30 16:29 --------- d-----w c:\program files\Hewlett-Packard
2008-11-30 16:27 --------- d-----w c:\program files\Intel
2008-11-30 15:35 --------- d-----w c:\program files\CONEXANT
2008-11-30 15:27 --------- d-----w c:\documents and settings\ADMIN\Application Data\Free Download Manager
2008-11-30 15:25 --------- d-----w c:\program files\Free Download Manager
2008-11-30 15:20 479,412 ----a-w c:\windows\system32\cdky1.reg
2008-11-08 08:19 --------- d-----w c:\program files\Avira
2008-11-08 08:19 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-11-07 22:56 --------- d-----w c:\program files\Common Files\xing shared
2008-11-07 22:56 --------- d-----w c:\documents and settings\ADMIN\Application Data\Media Player Classic
2008-11-07 22:40 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-11-07 22:40 172,032 ------w c:\windows\Setup1.exe
2008-11-07 22:34 --------- d-----w c:\documents and settings\All Users\Application Data\QuickTime
2008-10-29 03:23 10,368 ----a-w c:\windows\system32\drivers\pfc.sys
2008-10-29 03:23 --------- d-----w c:\program files\ACD Systems
2008-10-29 03:23 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-10-29 03:23 --------- d-----w c:\documents and settings\ADMIN\Application Data\ACD Systems
2008-10-29 00:21 --------- d-----w c:\documents and settings\ADMIN\Application Data\SystemGadgets
2008-10-18 11:29 --------- d-----w c:\program files\AV VCS 3.0
2008-10-18 11:17 --------- d-----w c:\program files\arabicard
2008-10-18 11:13 --------- d-----w c:\program files\GoldWave
2008-10-13 21:59 --------- d-----w c:\program files\DIFX
2008-10-13 21:59 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2008-10-13 21:59 --------- d-----w c:\documents and settings\ADMIN\Application Data\PC Suite
2008-10-13 11:13 --------- d-----w c:\program files\CyberLink
2008-10-13 11:13 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-10-13 10:51 203,776 ----a-w c:\windows\system32\clrviddc.dll
2008-06-09 00:29 16,384 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-06-09 00:29 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\.IE5\index.dat
2008-06-09 00:29 16,384 --sha-w c:\windows\system32\config\systemprofile\s\index.dat
.
------- Sigcheck -------
05/13/2008 12:31 AM 485376 590f60fbbcc32f4a4ab953b3e5f9745c c:\windows\system32\user32.dll
05/12/2008 11:06 PM 361344 68f06fe0021b01e670af37b8c5964fdf c:\windows\system32\drivers\tcpip.sys
05/13/2008 12:27 AM 2146816 eb2d98423944f4a576ab1fa6f7492ed8 c:\windows\system32\ntoskrnl.exe
05/13/2008 12:23 AM 1500672 dad6ef4cc746fba6de61d00bead6baed c:\windows\explorer.exe
05/13/2008 12:22 AM 40448 372853620778b679c89ca4feaf4c7753 c:\windows\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [03/22/2008 10:18 PM 1271808]
"RocketDock"="c:\windows\RocketDock.exe" [09/02/2007 01:58 PM 495616]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [05/13/2008 12:22 AM 40448]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [08/21/2006 12:24 AM 2068527]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [02/12/2008 10:06 AM 262401]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [09/18/2007 10:29 PM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [09/18/2007 10:29 PM 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [09/18/2007 10:29 PM 137752]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [01/18/2008 11:04 AM 1028096]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [06/03/2008 04:40 PM 177456]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/08/2008 01:56 AM 185872]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [05/13/2008 12:22 AM 40448]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [04/23/2008 07:16 AM 124928 c:\windows\system32\advpack.dll]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-29 610365]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MaxRecentDocs"= 11 (0xb)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"VIDC.ACDV"= ACDV.dll
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"msacm.imc"= imc32.acm
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 05/13/2008 12:22 AM 40448 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Long Internet Team Stupid]
--a------ 06/10/2008 02:21 PM 615936 c:\documents and settings\All Users\Application Data\comp two long internet\Dash drive.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 06/29/2008 03:48 PM 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sign tons]
--a------ 06/10/2008 02:19 PM 419840 c:\docume~1\ADMIN\APPLIC~1\GLUESU~1\Balm Grim Copy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 08/17/2007 03:45 AM 23120680 c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/30/2007 05:43 PM 4670704 c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R2 Vcs;Vcs support;\??\c:\windows\system32\Drivers\Vcs.sys [2008-10-18 6852]
R3 Com4QLBEx;Com4QLBEx;"c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe" [2008-11-30 193840]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2008-07-04 288000]
S3 slnt;RTL8139D PCI Fast Ethernet Adapter;c:\windows\system32\DRIVERS\slnt.sys [2008-06-29 18004]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9c09648-c495-11dd-8a37-001b77acd2a3}]
\Shell\AutoRun\command - 2u.com
\Shell\explore\Command - 2u.com
\Shell\open\Command - 2u.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cca81258-c481-11dd-8a34-001b77acd2a3}]
\Shell\AutoRun\command - e.cmd
\Shell\explore\Command - e.cmd
\Shell\open\Command - e.cmd
*Newly Created Service* - HELPSVC
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
- - - - ORPHANS REMOVED - - - -
HKU-Default-Run-Sonic RecordNow! - (no file)
MSConfigStartUp-IDMan - c:\documents and settings\Internet Download Manager\IDMan.exe
MSConfigStartUp-MessengerPlus3 - c:\program files\MessengerPlus! 3\MsgPlus.exe
.
------- Supplementary Scan -------
.
mWindow Title = Microsoft Internet Explorer
IE: Download all with Free Download Manager -
files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager -
files\Free Download Manager\dlselected.htm
IE: Download with Free Download Manager -
files\Free Download Manager\dllink.htm
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
.
------- File Associations -------
.
inffile=c:\windows\system32\Notepad2.exe %1
inifile=c:\windows\system32\Notepad2.exe %1
txtfile=c:\windows\system32\Notepad2.exe %1
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-14 01:51:52
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
c:\windows\EXPLORER.EXE [1836] 0x82111388
scanning hidden autostart entries ...
scanning hidden files ...
C:\sccfg.sys 16384 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(884)
c:\windows\system32\setupapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\WIDCOMM\BLUETOOTH SOFTWARE\BTSTACKSERVER.EXE
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE
c:\program files\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
.
**************************************************************************
.
Completion time: 12/14/2008 1:53:10 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-13 22:53:08
Pre-Run: 24,648,564,736 bytes free
Post-Run: 24,657,543,168 bytes free
203 --- E O F --- 2008-06-11 10:26:44
.png)
.png)
