ComboFix 09-03-03.01 - Administrator 03/06/2009 17:15:31.3 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.607.300 [GMT 1:00]
Running from: d:\ljtvrhj\مجلد جديد\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated)
AV: Sunbelt VIPRE *On-access scanning disabled* (Updated)
FW: AVG Firewall *enabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-02-06 to 2009-03-06 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-06 13:46 4,526 ----a-w c:\windows\system32\PerfStringBackup.TMP
2009-03-05 23:37 --------- d--h--w c:\documents and settings\All Users\Application Data\{D69E1662-EA1D-4B43-B558-40BFCC33E1FE}
2009-03-05 23:37 --------- d-----w c:\program files\WinSysClean 2009
2009-03-05 22:54 --------- d-----w c:\program files\Unlocker
2009-03-05 22:54 --------- d-----w c:\documents and settings\Administrator\Application Data\Desktopicon
2009-03-05 14:55 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-04 17:24 --------- d-----w c:\program files\Messenger Plus! Live
2009-03-04 17:24 --------- d-----w c:\program files\Circle Devlopement
2009-03-04 12:00 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-04 12:00 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-04 12:00 --------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-03-04 10:30 37,542 ----a-w c:\documents and settings\Administrator\iemultjx.exe
2009-03-04 10:20 37,542 ----a-w c:\windows\system32\iemultjx.exe
2009-03-04 09:54 --------- d-----w c:\documents and settings\Administrator\Application Data\CyberScrub
2009-03-04 09:52 --------- d-----w c:\documents and settings\Administrator\Application Data\cleaner
2009-03-04 09:26 33,050 ----a-w c:\documents and settings\Administrator\cmgrs.exe
2009-03-03 22:16 --------- d-----w c:\program files\Trend Micro
2009-03-03 16:56 --------- d-----w c:\program files\Codemonster
2009-03-03 10:33 --------- d-----w c:\documents and settings\All Users\Application Data\Martau
2009-03-03 10:32 --------- d-----w c:\program files\Total Uninstall 5
2009-03-03 00:31 --------- d-----w c:\program files\Photo To Color Sketch
2009-03-02 10:03 --------- d-----w c:\documents and settings\Administrator\Application Data\GRETECH
2009-03-02 10:02 --------- d-----w c:\program files\GRETECH
2009-03-02 09:01 --------- d-----w c:\documents and settings\Administrator\Application Data\Apple Computer
2009-03-02 08:59 --------- d-----w c:\program files\Apple Software Update
2009-03-02 08:59 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-28 18:19 --------- d-----w c:\program files\K-Lite Codec Pack
2009-02-27 15:50 --------- d-----w c:\documents and settings\Administrator\Application Data\Nitro PDF
2009-02-27 15:46 --------- d-----w c:\documents and settings\All Users\Application Data\Nitro PDF
2009-02-26 12:43 107,888 ----a-w c:\windows\system32\CmdLineExt.dll
2009-02-26 12:43 --------- d--h--r c:\documents and settings\Administrator\Application Data\SecuROM
2009-02-25 17:23 --------- d-----w c:\program files\PhotoZoom Pro 2
2009-02-25 09:46 --------- d-----w c:\program files\DownUp Utilities 2009
2009-02-23 20:15 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-02-23 20:15 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-02-23 20:15 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-02-23 20:15 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2009-02-23 20:15 --------- d-----w c:\program files\AVG
2009-02-23 20:15 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-02-23 20:02 50,968 ----a-w c:\windows\system32\avgfwdx.dll
2009-02-23 20:02 29,208 ----a-w c:\windows\system32\drivers\avgfwdx.sys
2009-02-23 14:23 --------- d-----w c:\program files\MSXML 4.0
2009-02-22 11:44 --------- d-----w c:\program files\uTorrent
2009-02-22 11:44 --------- d-----w c:\documents and settings\Administrator\Application Data\uTorrent
2009-02-22 00:48 --------- d-----w c:\documents and settings\Administrator\Application Data\TuneUp Software
2009-02-22 00:33 --------- d-----w c:\documents and settings\All Users\Application Data\Sunbelt
2009-02-22 00:33 --------- d-----w c:\documents and settings\Administrator\Application Data\Sunbelt
2009-02-22 00:22 --------- d-----w c:\program files\Sunbelt Software
2009-02-21 23:49 --------- d-----w c:\program files\IEPro
2009-02-21 23:49 --------- d-----w c:\documents and settings\Administrator\Application Data\IEPro
2009-02-19 21:13 --------- d-----w c:\documents and settings\Administrator\Application Data\MSNShell
2009-02-16 16:13 737,280 ----a-w c:\windows\iun6002.exe
2009-02-16 16:13 --------- d-----w c:\program files\المكتبة الشاملة
2009-02-15 11:09 --------- d-----w c:\program files\Lavalys
2009-02-15 01:20 720,896 ----a-w c:\windows\iun6002ev.exe
2009-02-15 01:20 --------- d-----w c:\program files\ahl_alhadeeth
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-02-06 11:25 4,543 ----a-w c:\program files\Common Files\unins000.dat
2009-02-06 11:22 732,113 ----a-w c:\program files\Common Files\unins000.exe
2009-02-06 10:59 --------- d-----w c:\program files\Siber Systems
2009-02-06 10:58 --------- d-----w c:\documents and settings\All Users\Application Data\RoboForm
2009-02-05 17:02 --------- d-----w c:\program files\Common Files\Skype
2009-02-04 14:03 --------- d-----w c:\documents and settings\Administrator\Application Data\Thinstall
2009-02-04 13:00 --------- d-----w c:\program files\WIDCOMM
2009-02-03 17:20 --------- d-----w c:\program files\Circle Deelopement
2009-02-03 09:48 --------- d-sh--w c:\program files\Common Files\WindowsLiveInstaller
2009-02-03 08:27 --------- d-----w c:\program files\Circle Develpement
2009-02-01 14:08 --------- d-----w c:\program files\Circle Dvelopement
2009-01-24 23:57 --------- d-----w c:\program files\Windows Live Toolbar
2009-01-24 23:57 --------- d-----w c:\documents and settings\All Users\Application Data\Windows Live Toolbar
2009-01-24 23:29 --------- d-----w c:\program files\Windows Installer Clean Up
2009-01-24 23:29 --------- d-----w c:\program files\MSECACHE
2009-01-24 23:23 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-01-24 21:57 --------- d-----w c:\program files\Microsoft Silverlight
2009-01-24 21:56 --------- d-----w c:\program files\Microsoft Office Outlook Connector
2009-01-24 21:50 --------- d-----w c:\program files\Microsoft Sync Framework
2009-01-24 21:46 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-01-24 21:40 --------- d-----w c:\program files\Microsoft
2009-01-24 18:30 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-20 16:41 42,752 ----a-w c:\windows\system32\drivers\ousb2hub.sys
2009-01-20 16:41 29,568 ----a-w c:\windows\system32\drivers\ousbehci.sys
2009-01-20 16:40 13,976 ----a-w c:\windows\system32\drivers\videX32.sys
2009-01-18 21:09 --------- d-----w c:\program files\Reference Assemblies
2009-01-18 21:09 --------- d-----w c:\program files\MSBuild
2009-01-18 01:21 --------- d-----w c:\program files\Common Files\Download Manager
2009-01-17 23:59 --------- d-----w c:\documents and settings\Administrator\Application Data\VitySoft
2009-01-16 20:01 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
2009-01-16 19:11 --------- d-----w c:\program files\Yahoo!
2009-01-16 19:11 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-13 23:37 --------- d-----w c:\program files\MessengerDiscovery
2009-01-12 07:44 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-20 22:30 63,488 ------w c:\windows\system32\dllcache\icardie.dll
2008-12-20 22:30 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll
2008-12-20 22:30 384,512 ----a-w c:\windows\system32\dllcache\iedkcs32.dll
2008-12-20 22:30 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll
2008-12-20 22:30 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll
2008-12-20 22:30 230,400 ----a-w c:\windows\system32\dllcache\ieaksie.dll
2008-12-20 22:30 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll
2008-12-20 22:30 153,088 ----a-w c:\windows\system32\dllcache\ieakeng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [04/14/2008 04:59 PM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [02/23/2009 09:15 PM 1601304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 04:59 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
02/23/2009 09:15 PM 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 04/14/2008 04:59 PM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 01/19/2007 12:55 PM 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:HTTP
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-23 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-23 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-23 107272]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-23 298264]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-02-23 1339600]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-02-03 43816]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2008-12-06 603904]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-02-23 29208]
S2 ousbehci;%OWC_USBEHCD.DeviceDesc%;c:\windows\system32\drivers\ousbehci.sys [2009-01-20 29568]
S2 SeaPort;SeaPort;"c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" --> c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-02-23 29208]
S3 fsssvc;Windows Live Contrôle parental; [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-03-04 38496]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39110f90-0655-11de-806e-ce96a8b54c11}]
\Shell\AutoRun\command - wscript.exe .\.vbs
\Shell\open\command - wscript.exe .\.vbs
.
*******s of the 'Scheduled Tasks' folder
2009-03-06 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [11/20/2008 04:28 PM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Add to AMV Convert Tool...
IE: E???? ??E?? ??I?? (??.??.??) EU ??E??E IC????I ?C????
IE: E???? C??? EU ??E??E IC????I ?C????
IE: E???? EU ??E??E IC????I ?C????
IE: MediaManager tool grab multimedia file
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E???? ??E?? ??I?? (??.??.??) EU ??E??E IC????I ?C???? - c:\program files\Internet Download Manager\IEGetVL.htm
IE: E???? C??? EU ??E??E IC????I ?C???? - c:\program files\Internet Download Manager\IEGetAll.htm
IE: E???? EU ??E??E IC????I ?C???? - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - c:\program files\IEPro\iepro.dll
LSP: c:\windows\system32\idmmbc.dll
TCP: {F9186D2A-96A9-4B0C-8D55-D8278F16950E} = 193.251.169.165
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v54pt70m.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://ar.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:ar
fficial
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: *******.notify.interval - 750000
FF - user.js: *******.max.tokenizing.time - 2250000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-06 17:18:11
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3d3e27a9-2812-41ba-9128-02fa5d117f7d}]
@Denied: (Full) (Everyone)
"Model"=dword:0000002c
"Therad"=dword:0000000f
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):76,b2,53,cc,06,d7,03,d4,39,08,ae,49,f4,cb,3b,43,8e,e5,b0,6e,0a,
4d,5a,e3,73,ac,81,57,d9,60,26,ce,91,50,dc,71,ff,22,db,e2,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(636)
c:\windows\system32\idmmbc.dll
.
Completion time: 03/06/2009 17:20:01
ComboFix-quarantined-files.txt 2009-03-06 16:20:00
ComboFix3.txt 2009-03-04 11:34:30
ComboFix2.txt 2009-03-04 18:35:08
Pre-Run: 7,612,497,920 bytes free
Post-Run: 7,704,444,928 bytes free
241 --- E O F --- 2009-02-27 02:36:02
