ComboFix 09-02-24.02 - FeToOo 02/25/2009 20:51:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.446.192 [GMT 3:00]
Running from: c:\documents and settings\FeToOo\Desktop\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\msvrc20.dll
c:\windows\system32\bn.dll
c:\windows\system32\drivers\RKHit.sys
c:\windows\system32\FOLESVR.DLL
c:\windows\system32\kakle.dll
c:\windows\system32\mpg4c32.dll
c:\windows\system32\Ultra.dll
c:\windows\system32\vbxtct32.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_RKHIT
((((((((((((((((((((((((( Files Created from 2009-01-25 to 2009-02-25 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-25 17:55 25,255 ----a-w c:\documents and settings\FeToOo\Application Data\Vbcn.dat
2009-02-25 14:38 --------- d-----w c:\documents and settings\FeToOo\Application Data\Business Logic
2009-02-25 14:27 --------- d-----w c:\documents and settings\Administrator\Application Data\Business Logic
2009-02-25 14:26 --------- d-----w c:\program files\blcorp
2009-02-25 14:06 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-25 13:13 --------- d-----w c:\documents and settings\FeToOo\Application Data\Lavasoft
2009-02-25 12:50 --------- d-----w c:\program files\ESET
2009-02-25 09:45 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-25 09:41 --------- d-----w c:\documents and settings\FeToOo\Application Data\Malwarebytes
2009-02-25 09:41 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-25 08:55 512,096 ----a-w c:\windows\system32\drivers\amon.sys
2009-02-25 08:55 298,104 ----a-w c:\windows\system32\imon.dll
2009-02-25 08:55 15,424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2009-02-24 17:27 --------- d-----w c:\documents and settings\FeToOo\Application Data\DMCache
2009-02-24 16:39 --------- d-----w c:\program files\Crystal Player
2009-02-24 13:11 --------- d-----w c:\program files\Windows Media Connect 2
2009-02-24 13:11 --------- d-----w c:\program files\Real Alternative
2009-02-24 13:09 --------- d-----w c:\program files\DivX
2009-02-24 12:18 --------- d-----w c:\program files\Playae
2009-02-23 20:13 --------- d-----w c:\program files\DietMP3
2009-02-20 23:12 --------- d-----w c:\program files\WinAVI Video Converter
2009-02-20 20:06 81,920 ----a-w c:\documents and settings\FeToOo\Application Data\ezpinst.exe
2009-02-20 20:06 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-02-20 20:06 47,360 ----a-w c:\documents and settings\FeToOo\Application Data\pcouffin.sys
2009-02-20 20:06 --------- d-----w c:\program files\Video Convert Premier
2009-02-20 20:06 --------- d-----w c:\documents and settings\FeToOo\Application Data\Vso
2009-02-20 19:32 --------- d-----w c:\program files\MP3 Player Utilities 3.57
2009-02-19 07:22 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-02-19 01:34 --------- d-----w c:\documents and settings\FeToOo\Application Data\CyberLink
2009-02-19 01:34 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-02-19 01:33 --------- d-----w c:\program files\CyberLink
2009-02-19 01:32 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-18 11:26 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-02-18 09:49 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-18 09:43 --------- d-----w c:\documents and settings\NetworkService\Application Data\SACore
2009-02-18 09:25 --------- d-----w c:\documents and settings\FeToOo\Application Data\Uniblue
2009-02-18 09:13 --------- d-----w c:\program files\Reference Assemblies
2009-02-17 19:05 --------- d-----w c:\documents and settings\FeToOo\Application Data\System Tweaker
2009-02-17 17:28 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2009-02-17 16:47 --------- d-----w c:\program files\Real_SC
2009-02-17 16:18 --------- d-----w c:\program files\SiteAdvisor
2009-02-17 16:18 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-02-17 14:02 --------- d-----w c:\program files\CCleaner
2009-02-17 11:45 --------- d-----w c:\program files\GoldWave
2009-02-17 10:36 --------- d-----w c:\program files\GRETECH
2009-02-17 10:35 --------- d-----w c:\program files\K-Lite Codec Pack
2009-02-16 20:35 --------- d-----w c:\documents and settings\FeToOo\Application Data\MxBoost
2009-02-15 12:41 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-14 14:02 --------- d-----w c:\documents and settings\FeToOo\Application Data\DivX
2009-02-12 18:51 --------- d-----w c:\program files\GlobFX
2009-02-11 07:51 --------- d-----w c:\program files\Common Files\Ahead
2009-02-11 07:51 --------- d-----w c:\documents and settings\FeToOo\Application Data\Ahead
2009-02-11 07:44 --------- d-----w c:\program files\Nero
2009-02-11 07:44 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-02-11 07:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 07:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-10 22:41 90,112 ----a-w c:\windows\system32\agsaami.dll
2009-02-10 22:41 610,304 ----a-w c:\windows\system32\agsaamg.dll
2009-02-10 22:41 372,736 ----a-w c:\windows\system32\agsaamc.dll
2009-02-10 22:41 2,535,424 ----a-w c:\windows\system32\agsaamj.dll
2009-02-10 22:41 196,608 ----a-w c:\windows\system32\maag.dll
2009-02-10 22:41 1,986,560 ----a-w c:\windows\system32\akll.dll
2009-02-10 22:41 1,245,184 ----a-w c:\windows\system32\bkll.dll
2009-02-10 22:41 1,212,416 ----a-w c:\windows\system32\ckll.dll
2009-02-09 10:46 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-06 22:08 --------- d-----w c:\documents and settings\FeToOo\Application Data\Crystal Player
2009-02-06 15:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 12:07 --------- d-----w c:\program files\Fantasysoft-Studio
2009-02-05 17:10 --------- d-----w c:\program files\Maxthon2
2009-02-05 14:13 603,904 ----a-w c:\windows\system32\TUProgSt.exe
2009-02-05 14:13 --------- d-----w c:\documents and settings\FeToOo\Application Data\TuneUp Software
2009-02-05 14:12 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-02-05 14:11 --------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-02-03 09:23 --------- d-----w c:\documents and settings\FeToOo\Application Data\Media Player Classic
2009-02-03 08:39 --------- d-----w c:\program files\Common Files\Adobe
2009-02-03 01:56 --------- d-----w c:\program files\%tmp%
2009-02-03 01:55 --------- d-----w c:\program files\Vortex Windows Tools
2009-02-03 01:11 --------- d-----w c:\program files\Windows Live
2009-02-03 01:11 --------- d-----w c:\program files\Microsoft
2009-02-03 01:10 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-03 00:54 --------- d-----w c:\program files\S3
2009-02-03 00:37 --------- d-----w c:\program files\Common Files\Windows Live
2009-02-03 00:36 --------- d-----w c:\program files\MSN Messenger
2009-02-03 00:25 --------- d-----w c:\program files\VIA
2009-02-03 00:10 --------- d-----w c:\program files\UltraISO
2009-02-03 00:10 --------- d-----w c:\program files\Common Files\EZB Systems
2009-02-03 00:09 155,995 ----a-w c:\windows\java\Packages\RPZN3ZZ7.ZIP
2009-02-03 00:09 --------- d-----w c:\program files\Yahoo!
2009-02-03 00:09 --------- d-----w c:\program files\Multimedia
2009-02-03 00:09 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-02-03 00:08 --------- d-----w c:\program files\microsoft frontpage
2009-02-02 23:59 --------- d-----w c:\program files\Foxit
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
.
------- Sigcheck -------
12/28/2006 01:01 PM 2156544 d4d5b4e35c037b8ff924fc2f82815cfd c:\windows\system32\ntkrnlpa.exe
12/28/2006 12:51 PM 2276864 1c7049f011f7c9e5f25725927381422d c:\windows\system32\ntoskrnl.exe
12/28/2006 10:51 AM 1423360 8730231e85c924a40b4600daf42c46d4 c:\windows\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 05:00 PM 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [02/06/2009 06:53 PM 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [02/25/2009 11:55 AM 949376]
"SoundMan"="SOUNDMAN.EXE" [03/01/2006 11:22 AM 577536 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 05:00 PM 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [02/26/2007 02:01 AM 437160]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 12/05/2006 10:55 PM 54832 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 02/06/2009 06:53 PM 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 01/12/2006 03:40 PM 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
-ra------ 11/23/2005 05:12 AM 1060864 c:\program files\VIA\RAID\raid_tool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 11/23/2006 03:10 PM 56928 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/29/2006 08:54 PM 4621816 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
-ra------ 03/07/2005 10:33 PM 53248 c:\windows\system32\VTTimer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"VTTrayp"=VTtrayp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-02-25 15424]
R2 dvdmmg;dvdmmg;c:\windows\system32\drivers\dvdmmg.sys [2007-09-06 5504]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2009-02-25 179856]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-02-25 15504]
S1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\vcdrom.sys [2009-02-03 8576]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{935AC426-9F73-D288-9D5F-26D1BD516FA3}]
c:\program files\Playae\Playae.exe s
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-IDMan - c:\program files\Internet Download Manager\IDMan.exe
MSConfigStartUp-Windows Defender - c:\program files\Windows Defender\MSASCui.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = hxxp://www.msn.com
LSP: c:\windows\system32\imon.dll
DPF: Microsoft XML Parser for Java - [URL]file:///C:/WINDOWS/Java/classes/xmldso.cab[/URL]
FF - ProfilePath - c:\documents and settings\FeToOo\Application Data\Mozilla\Firefox\Profiles\nw5mg4ny.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: *******.notify.interval - 600000
FF - user.js: *******.max.tokenizing.time - 1800000
FF - user.js: *******.switch.threshold - 600000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [URL]http://www.gmer.net[/URL]
Rootkit scan 2009-02-25 20:55:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
c:\program files\Internet Explorer\iexplore.exe [1376] 0x83FB3BD0
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1614895754-1292428093-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="ba"
"b"="NOTEPAD.EXE"
[HKEY_USERS\S-1-5-21-1614895754-1292428093-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithProgids]
"ctt_auto_file"=hex(0):
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b4,ef,0d,69,ee,aa,ae,3f,1f,31,8f,19,ba,bb,57,95,ce,9c,e2,c2,b6,
28,e9,0c,ba,49,af,c9,52,d1,20,31,de,a2,2f,3a,5d,e5,e8,3a,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{e15b5452-815b-4c8f-98cd-1fa113c73dd0}]
@Denied: (Full) (Everyone)
"Model"=dword:00000036
"Therad"=dword:00000008
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\cscui.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\ESET\nod32krn.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
.
**************************************************************************
.
Completion time: 02/25/2009 20:58:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-25 17:58:34
Pre-Run: 12,762,476,544 bytes free
Post-Run: 12,731,670,528 bytes free
381
