ComboFix 09-02-25.02 - pmp 02/26/2009 19:09:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.502.205 [GMT 3:00]
Running from: c:\documents and settings\pmp\My Documents\Downloads\Programs\ComboFix.exe
AV: AVG Internet Security 3-pack *On-access scanning enabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\digeste.dll
c:\windows\system32\drivers\npf.sys
c:\windows\system32\kakle.dll
c:\windows\system32\packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\system32\wpv551234083759.cpx
c:\windows\wiaserviv.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 16:26 --------- d-----w c:\documents and settings\pmp\Application Data\DMCache
2009-02-26 15:37 --------- d-----w c:\program files\Enigma Software Group
2009-02-25 00:23 --------- d-----w c:\program files\Internet Download Manager
2009-02-24 23:29 --------- d-----w c:\program files\FTP Commander Pro
2009-02-23 16:17 --------- d-----w c:\program files\WinWatermark 2.2
2009-02-23 13:21 662,488 ----a-w c:\windows\system32\360x180° Mekan.scr
2009-02-20 17:13 --------- d-----w c:\documents and settings\pmp\Application Data\Nokia Multimedia Player
2009-02-20 12:44 --------- d-----w c:\documents and settings\pmp\Application Data\Leadertech
2009-02-19 23:35 --------- d-----w c:\documents and settings\pmp\Application Data\IDM
2009-02-19 20:59 --------- d-----w c:\program files\10TACLE STUDIOS
2009-02-18 16:47 --------- d-----w c:\program files\Common Files\PCSuite
2009-02-18 16:43 56 --sha-w c:\documents and settings\All Users\Application Data\dc64vg9.sys
2009-02-18 16:42 --------- d-----w c:\program files\Common Files\MainConcept
2009-02-18 16:05 --------- d-----w c:\program files\Common Files\Adobe
2009-02-18 15:38 --------- d-----w c:\documents and settings\pmp\Application Data\Nokia
2009-02-18 15:37 --------- d-----w c:\documents and settings\pmp\Application Data\AdobeUM
2009-02-18 15:37 --------- d-----w c:\documents and settings\pmp\Application Data\AdobeAUM
2009-02-18 15:18 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-02-18 15:06 --------- d-----w c:\program files\Nokia
2009-02-18 15:06 --------- d-----w c:\documents and settings\All Users\Application Data\Nokia
2009-02-18 15:05 --------- d-----w c:\program files\SimpleCenter
2009-02-18 15:05 --------- d-----w c:\program files\Common Files\i4j_jres
2009-02-18 15:01 --------- d-----w c:\program files\PC Connectivity Solution
2009-02-18 15:01 --------- d-----w c:\program files\DIFX
2009-02-18 15:01 --------- d-----w c:\documents and settings\pmp\Application Data\PC Suite
2009-02-16 23:46 --------- d-----w c:\program files\BF1939
2009-02-16 17:24 --------- d-----w c:\program files\ArtIcons Pro
2009-02-16 10:01 --------- d-----w c:\program files\D-Tools
2009-02-16 09:58 --------- d-----w c:\program files\Game-Cloner
2009-02-11 17:51 --------- d-----w c:\program files\Pcsx2_0.9.4
2009-02-09 19:59 --------- d-----w c:\program files\mpegable
2009-02-09 19:59 --------- d-----w c:\program files\Hotspot Shield
2009-02-09 19:59 --------- d-----w c:\program files\Athan
2009-02-09 15:48 90,112 ----a-w c:\windows\system32\agsaami.dll
2009-02-09 15:48 610,304 ----a-w c:\windows\system32\agsaamg.dll
2009-02-09 15:48 372,736 ----a-w c:\windows\system32\agsaamc.dll
2009-02-09 15:48 2,535,424 ----a-w c:\windows\system32\agsaamj.dll
2009-02-09 15:48 196,608 ----a-w c:\windows\system32\maag.dll
2009-02-09 15:48 1,986,560 ----a-w c:\windows\system32\akll.dll
2009-02-09 15:48 1,245,184 ----a-w c:\windows\system32\bkll.dll
2009-02-09 15:48 1,212,416 ----a-w c:\windows\system32\ckll.dll
2009-02-09 15:48 --------- d-----w c:\program files\Real_SC
2009-02-08 13:36 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-08 13:36 --------- d-----w c:\program files\NextSecurity.NET
2009-02-04 15:06 --------- d-----w c:\program files\Ancient Quest of Saqqarah
2009-02-01 18:40 --------- d-----w c:\program files\Video Convert Master
2009-01-25 20:04 --------- d-----w c:\documents and settings\pmp\Application Data\Thinstall
2009-01-25 20:04 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-22 22:37 --------- d-----w c:\documents and settings\pmp\Application Data\Ancient Quest of Saqqarah__cminion
2009-01-22 22:28 --------- d-----w c:\documents and settings\pmp\Application Data\StoneLoops!
2009-01-22 22:28 --------- d-----w c:\documents and settings\pmp\Application Data\Saqqarah
2009-01-22 22:28 --------- d-----w c:\documents and settings\pmp\Application Data\MagicMatch
2009-01-21 15:01 --------- d-----w c:\documents and settings\pmp\Application Data\Orbit
2009-01-21 12:54 --------- d-----w c:\documents and settings\pmp\Application Data\GrabPro
2009-01-16 11:57 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-01-15 17:39 --------- d-----w c:\program files\CollageMaker
2009-01-15 15:19 --------- d-----w c:\program files\Unlocker
2009-01-08 09:26 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-01-08 09:25 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-01-08 09:25 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-01-08 09:25 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-01-06 19:54 81,920 ----a-w c:\windows\ALCFDRTM.EXE
2009-01-04 17:40 81,920 ----a-w c:\documents and settings\pmp\Application Data\ezpinst.exe
2009-01-04 17:40 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-01-04 17:40 47,360 ----a-w c:\documents and settings\pmp\Application Data\pcouffin.sys
2009-01-04 17:40 --------- d-----w c:\documents and settings\pmp\Application Data\Vso
2008-12-17 11:03 206,256 ----a-w c:\windows\system32\idmmbc.dll
2002-07-01 14:13 224 --sha-w c:\documents and settings\pmp\Application Data\maildriver32.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [12/23/2008 02:05 PM 2745776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [06/13/2006 04:57 AM 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [06/13/2006 04:57 AM 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [06/13/2006 04:57 AM 118784]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [09/01/2008 02:51 PM 185896]
"Athan"="c:\program files\Athan\Athan.exe" [09/06/2007 09:25 PM 1003520]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [01/08/2009 12:25 PM 1601304]
"sclauncher"="c:\program files\SimpleCenter\bin\win\sclauncher.exe" [01/30/2007 10:40 AM 94208]
"RTHDCPL"="RTHDCPL.EXE" [05/08/2008 08:14 PM 16248320 c:\windows\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [05/08/2008 08:14 PM 2879488 c:\windows\SkyTel.exe]
"AGRSMMSG"="AGRSMMSG.exe" [05/06/2008 10:12 AM 88204 c:\windows\AGRSMMSG.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
01/08/2009 12:25 PM 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AFProg]
--a------ 06/26/2006 05:26 AM 118784 c:\program files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
--a------ 09/28/2006 10:21 PM 57344 c:\program files\SlySoft\CloneCD\CloneCDTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DrvIcon]
--a------ 07/04/2007 10:59 PM 45056 c:\program files\Vista Drive Icon\DrvIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 12/10/2006 09:52 PM 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 12/23/2008 02:05 PM 2745776 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 04/13/2006 11:09 AM 49152 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 08/04/2004 01:09 AM 1667584 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 10:50 AM 155648 c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
--a------ 09/07/2007 02:44 PM 3100672 c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 12/07/2005 10:57 PM 30208 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 10/29/2008 12:27 PM 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-09-01 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-09-01 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-09-01 107272]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-26 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-09-01 298264]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2d73158-faaa-11dd-bf65-00197e24e218}]
\shELL\Autoplay\CoMmaND - G:\lqyqu.cmd
\shELL\AutoRun\command - G:\lqyqu.cmd
\shELL\ExPLore\Command - G:\lqyqu.cmd
\shELL\open\ComMANd - G:\lqyqu.cmd
.
*******s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-DAEMON Tools-1033 - c:\program files\D-Tools\daemon.exe
MSConfigStartUp-Google Update - c:\documents and settings\pmp\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
MSConfigStartUp-pmp - c:\documents and settings\pmp\pmp.exe
.
------- Supplementary Scan -------
.
uStart Page = [URL="http://www.google.com.sa/"]www.google.com.sa/[/URL]
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 88.191.132:3128
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - [URL]file://c:\windows\Java\classes\xmldso.cab[/URL]
FF - ProfilePath - c:\documents and settings\pmp\Application Data\Mozilla\Firefox\Profiles\c3f9o2w3.default\
FF - prefs.js: browser.search.selectedEngine - Orbit Search (Powered By Google)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - component: c:\documents and settings\pmp\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [URL]http://www.gmer.net[/URL]
Rootkit scan 2009-02-26 19:27:34
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b8,11,b5,1d,8c,cf,46,f0,2f,7d,9c,57,e4,e7,47,e0,0c,f7,6e,dd,6f,
bf,91,40,cc,c0,2a,c4,b9,c4,be,9f,54,31,8d,09,99,20,98,67,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c942016c-8d08-497d-9d70-bb030345cea1}]
@Denied: (Full) (Everyone)
"Model"=dword:00000031
"Therad"=dword:0000001a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\msv1_0.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\docume~1\pmp\LOCALS~1\Temp\RtkBtMnt.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 02/26/2009 19:30:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-26 16:29:48
Pre-Run: 28,220,641,280 bytes free
Post-Run: 32,663,478,272 bytes free
238
.png)
.png)
