ComboFix 08-12-12.02 - STC 12/13/2008 23:55:59.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1256.1.1025.18.2037.1348 [GMT 3:00]
Running from: D:\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\igfxres.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 21:01 --------- d-----w c:\programdata\Kaspersky Lab
2008-12-13 20:59 311,328 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-13 20:59 30,968 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-13 20:59 3,691,552 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-13 20:59 3,192 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-13 04:38 --------- d-----w c:\programdata\Messenger Plus!
2008-12-13 04:36 --------- d-----w c:\program files\MSN Messenger
2008-12-13 04:36 --------- d-----w c:\program files\Messenger Plus! Live
2008-12-13 03:53 --------- d-----w c:\programdata\Avira
2008-12-13 02:39 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-13 02:39 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-12-13 01:30 --------- d-----w c:\program files\GVR
2008-12-12 23:59 174 --sha-w c:\program files\desktop.ini
2008-12-12 23:57 --------- d-----w c:\program files\Windows Mail
2008-12-12 22:42 --------- d-----w c:\programdata\global pop bolt
2008-12-12 22:39 --------- d-----w c:\program files\Circle Developement
2008-12-12 22:25 --------- d-----w c:\program files\Eset
2008-12-12 22:15 --------- d-----w c:\program files\Kaspersky Lab
2008-12-12 22:13 --------- d-----w c:\programdata\Kaspersky Lab Setup Files
2008-12-12 18:22 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-11 16:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat
2008-11-01 03:33 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:33 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:33 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:33 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:33 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-31 23:23 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
2008-10-29 06:20 2,923,520 ----a-w c:\windows\explorer.exe
2008-10-24 20:21 --------- d-----w c:\users\STC\AppData\Roaming\vlc
2008-10-23 20:24 --------- d-----w c:\users\STC\AppData\Roaming\Uniblue
2008-10-23 18:20 --------- d-----w c:\program files\VideoLAN
.
(((((((((((((((((((((((((((((
snapshot@Sat 12-13-2008_ 3.28.28.41 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-12 22:16:49 51,200 ----a-w c:\windows\inf\infpub.dat
+ 2008-12-13 03:50:51 51,200 ----a-w c:\windows\inf\infpub.dat
- 2008-12-12 22:16:49 86,016 ----a-w c:\windows\inf\infstor.dat
+ 2008-12-13 03:50:51 86,016 ----a-w c:\windows\inf\infstor.dat
- 2008-12-12 22:16:49 86,016 ----a-w c:\windows\inf\infstrng.dat
+ 2008-12-13 03:50:50 86,016 ----a-w c:\windows\inf\infstrng.dat
- 2008-12-13 00:25:29 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-13 21:00:57 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-12-13 00:25:29 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-13 21:00:57 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-12-12 23:58:00 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-12-13 20:48:54 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-12-12 23:58:00 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
+ 2008-12-13 20:48:54 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
- 2008-12-12 23:58:00 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
+ 2008-12-13 20:48:54 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
- 2008-12-12 22:15:12 239,632 ----a-w c:\windows\System32\drivers\klif.sys
+ 2008-12-13 02:36:43 239,632 ----a-w c:\windows\System32\drivers\klif.sys
- 2008-10-21 04:06:42 393,792 ----a-w c:\windows\System32\FNTCACHE.DAT
+ 2008-12-13 04:04:46 393,792 ----a-w c:\windows\System32\FNTCACHE.DAT
- 2008-12-12 22:23:12 82,094 ----a-w c:\windows\System32\perfc001.dat
+ 2008-12-13 02:41:07 82,094 ----a-w c:\windows\System32\perfc001.dat
- 2008-12-12 22:23:12 104,768 ----a-w c:\windows\System32\perfc009.dat
+ 2008-12-13 02:41:07 104,768 ----a-w c:\windows\System32\perfc009.dat
- 2008-12-12 22:23:12 463,314 ----a-w c:\windows\System32\perfh001.dat
+ 2008-12-13 02:41:07 463,314 ----a-w c:\windows\System32\perfh001.dat
- 2008-12-12 22:23:12 613,046 ----a-w c:\windows\System32\perfh009.dat
+ 2008-12-13 02:41:07 613,046 ----a-w c:\windows\System32\perfh009.dat
- 2008-12-13 00:01:33 9,116 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-238623944-1884629994-451016844-1000_UserData.bin
+ 2008-12-13 20:56:22 9,982 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-238623944-1884629994-451016844-1000_UserData.bin
- 2008-12-13 00:01:33 50,810 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-12-13 20:56:15 51,866 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-12-12 22:28:40 34,810 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-12-13 20:56:11 36,560 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-10-28 14:25:46 188,184 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2008-12-13 18:07:57 189,010 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2008-12-12 23:49:37 155,663,261 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-12-13 04:18:13 157,476,184 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"exitonce"="c:\programdata\htmmp3mp3.aw5rtw" [X]
"Bags Else Hole Lite"="c:\programdata\Meet thunk cool.k2pyf7" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [05/13/2008 03:07 AM 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [11/02/2006 03:35 PM 125440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [08/28/2007 03:43 PM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [08/28/2007 03:43 PM 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [08/28/2007 03:43 PM 137752]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [06/17/2008 03:00 PM 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [05/11/2008 06:53 PM 77824]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [06/17/2008 02:59 PM 185896]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [11/11/2008 07:59 PM 206088]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~2\mzvkbd.dll,c:\progra~1\KASPER~1\KASPER~2\mzvkbd3.dll,c:\progra~1\KASPER~1\KASPER~2\adialhk.dll,c:\progra~1\KASPER~1\KASPER~2\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-238623944-1884629994-451016844-1000]
"EnableNotificationsRef"=dword:00000002
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{86BBF590-FF6E-4155-B14E-57DE0066A2ED}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{B27925A8-826A-4F10-BCA5-C69CD1850DDA}c:\\windows\\explorer.exe"= UDP:c:\windows\explorer.exe:مستكشف Windows
"UDP Query User{7E87CF0B-9AD8-41CD-8DBE-18894BF2F038}c:\\windows\\explorer.exe"= TCP:c:\windows\explorer.exe:مستكشف Windows
"TCP Query User{7F0B0C27-9099-4881-864D-AE1129B9B814}c:\\users\\stc\\appdata\\local\\temp\\msnmsgr.exe"= UDP:c:\users\stc\appdata\local\temp\msnmsgr.exe:msnmsgr.exe
"UDP Query User{F75AD897-D64A-484A-81A5-696A4751D11D}c:\\users\\stc\\appdata\\local\\temp\\msnmsgr.exe"= TCP:c:\users\stc\appdata\local\temp\msnmsgr.exe:msnmsgr.exe
"{FEE433DA-B80F-48DE-B327-A2D49DD5317F}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{F9B3177A-2ED9-4A45-BC7E-76C158D071EA}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{D1499E0F-69AB-4B56-A5D6-265BCC9AAE05}c:\\stc\\jwalk client\\jw9p.exe"= UDP:c:\stc\jwalk client\jw9p.exe:J Walk Printer Client
"UDP Query User{342BB1EF-CF14-4980-A114-D3ED33489D6D}c:\\stc\\jwalk client\\jw9p.exe"= TCP:c:\stc\jwalk client\jw9p.exe:J Walk Printer Client
"TCP Query User{01A03B2C-5D8A-492F-BE2F-A2F8E41A7C37}c:\\windows\\explorer.exe"= UDP:c:\windows\explorer.exe:مستكشف Windows
"UDP Query User{5289FD81-4F5F-420B-BA1F-4EEA5296F043}c:\\windows\\explorer.exe"= TCP:c:\windows\explorer.exe:مستكشف Windows
"{3009CE62-EA5A-4289-A815-0559460CD106}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{67A8C63F-D534-46AA-9EB2-3DF4A2EE781E}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{928EFACA-A379-4008-ADEC-090212479AB0}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{8A8C7F7E-A12F-4A6D-8B04-5DEE3A30D15F}c:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 2009\\english\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky anti-virus 2009\english\setup.exe:Kaspersky Anti-Virus 2009 Setup
"UDP Query User{8D135FDC-09CE-4DA5-999F-22B824725E3E}c:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 2009\\english\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky anti-virus 2009\english\setup.exe:Kaspersky Anti-Virus 2009 Setup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-07-09 20496]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2008-05-10 240128]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{17a817c0-30cc-11dd-9207-001b38eb394c}]
\shell\Auto\command - F:\sal.xls.exe
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\sal.xls.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35b5a779-1f62-11dd-9262-001b38eb394c}]
\shell\Auto\command - F:\sal.xls.exe
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\sal.xls.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f66357a-307c-11dd-912f-001b38eb394c}]
\shell\AutoRun\command - F:\zPharaoh.exe
\shell\explore\command - F:\zPharaoh.exe
\shell\open\command - F:\zPharaoh.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.zyzoom.org/
uInternet Settings,ProxyServer = proxy.saudi.net.sa:8080
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
LSP: c:\windows\system32\wpclsp.dll
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\users\STC\AppData\Roaming\Mozilla\Firefox\Profiles\f513600f.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-14 00:01:06
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
c:\windows\System32\drivers\XAudio.exe
c:\windows\ehome\ehmsas.exe
c:\windows\System32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 12/14/2008 0:05:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-13 21:05:46
ComboFix2.txt 2008-12-13 00:37:33
ComboFix3.txt 2008-12-13 00:30:45
Pre-Run: 78,623,518,720 bytes free
Post-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
204 --- E O F --- 2008-12-13 04:20:29
