ComboFix 09-03-04.01 - TOSHIBA 03/05/2009 23:35:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1022.533 [GMT 3:00]
Running from: c:\downloads\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\TOSHIBA\Application Data\.#
c:\documents and settings\TOSHIBA\Application Data\.#\MBX@C88@13339B0.###
c:\documents and settings\TOSHIBA\Application Data\.#\MBX@C88@13339C0.###
c:\windows\IE4 Error Log.txt
c:\windows\system32\Data(10).dll
c:\windows\system32\Data(3).dll
c:\windows\system32\Data(4).dll
c:\windows\system32\Data(7).dll
c:\windows\system32\Data(9).dll
c:\windows\system32\kakle.dll
c:\windows\system32\win.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-02-05 to 2009-03-05 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 20:34 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Orbit
2009-03-05 20:26 2,560 ----a-w c:\windows\_MSRSTRT.EXE
2009-03-05 20:20 --------- d-----w c:\program files\Trojan Remover
2009-03-05 20:20 --------- d-----w c:\program files\SWiSHmax
2009-03-05 20:20 --------- d-----w c:\program files\Spyware Terminator
2009-03-05 19:58 --------- d-----w c:\program files\Anti Trojan Elite
2009-03-05 18:52 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-05 18:12 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Simply Super Software
2009-03-05 17:29 --------- d-----w c:\program files\InCode Solutions
2009-03-05 16:55 69,695 --sh--r c:\windows\system32\avgscnr.exe
2009-02-28 03:32 --------- d-----w c:\program files\Orbitdownloader
2009-02-26 23:01 --------- d-----w c:\program files\Avant Browser
2009-02-25 19:57 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-25 19:57 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\IDM
2009-02-24 11:39 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\GrabPro
2009-02-24 08:11 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\DMCache
2009-02-23 20:08 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\IDM(2)
2009-02-23 19:55 --------- d-----w c:\program files\VS Revo Group
2009-02-23 19:35 --------- d-----w c:\program files\ArabicSP Software
2009-02-18 20:32 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Leadertech
2009-02-16 11:32 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Thinstall
2009-02-14 22:59 --------- d-----w c:\documents and settings\Guest\Application Data\Avant Profiles
2009-02-14 22:58 --------- d-----w c:\documents and settings\Guest\Application Data\PC Suite
2009-02-08 18:51 --------- d-----w c:\program files\Uninstall Tool
2009-02-08 14:25 --------- d-----w c:\documents and settings\All Users\Application Data\aHisoft
2009-02-08 13:41 --------- d-----w c:\program files\ALLPlayer
2009-02-06 19:12 --------- d-----w c:\program files\Paltalk Messenger
2009-02-06 19:12 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Paltalk
2009-02-05 19:28 --------- d-----w c:\program files\Extension Changer
2009-02-05 19:25 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Datalayer
2009-02-05 17:46 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\AdobeUM
2009-02-03 03:21 737,280 ----a-w c:\windows\iun6002.exe
2009-02-02 18:06 --------- d-----w c:\program files\iProtect
2009-02-02 13:54 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\AdobeAUM
2009-02-02 13:43 --------- d-----w c:\program files\Nokia
2009-02-02 13:37 --------- d-----w c:\program files\Common Files\PCSuite
2009-02-02 13:37 --------- d-----w c:\program files\Common Files\Nokia
2009-02-01 19:43 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\PC Suite
2009-02-01 19:43 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Nokia
2009-02-01 19:38 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-02-01 19:38 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-02-01 19:29 --------- d-----w c:\documents and settings\All Users\Application Data\Nokia
2009-02-01 19:26 --------- d-----w c:\program files\MSXML 6.0
2009-02-01 19:20 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-02-01 18:27 --------- d-----w c:\program files\DIFX
2009-02-01 18:27 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2009-02-01 14:53 --------- d-----w c:\program files\Password Protect USB
2009-01-30 11:22 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-01-27 22:51 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Talkback
2009-01-27 22:48 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-27 22:48 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-27 22:48 --------- d-----w c:\program files\Real
2009-01-27 22:48 --------- d-----w c:\program files\Common Files\xing shared
2009-01-27 22:48 --------- d-----w c:\program files\Common Files\Real
2009-01-27 22:04 200 ----a-w C:\sccfg.sys
2009-01-27 20:55 180,224 ----a-w c:\windows\system32\WinVd32.sys
2009-01-27 20:55 16,384 ----a-w c:\windows\system32\WinFl32.sys
2009-01-27 03:21 --------- d-----w c:\program files\Dachshund Software
2009-01-26 20:05 --------- d-----w c:\program files\ClocX
2009-01-26 19:08 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Ashampoo
2009-01-23 08:30 --------- d-----w c:\program files\Circle Developement
2009-01-23 08:21 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Avant Profiles
2009-01-23 07:38 45,056 ----a-w c:\windows\NCUNINST.EXE
2009-01-23 07:37 --------- d-----w c:\program files\Hewlett-Packard
2009-01-23 07:35 --------- d-----w c:\program files\Common Files\SWF Studio
2009-01-23 00:02 --------- d-----w c:\program files\Windows Live
2009-01-23 00:02 --------- d-----w c:\program files\MSN Messenger
2009-01-22 20:47 --------- d-sha-r c:\program files\Golden Filter Pro
2009-01-22 15:24 --------- d-----w c:\program files\Nero
2009-01-22 15:24 --------- d-----w c:\program files\Common Files\Ahead
2009-01-22 15:23 155,995 ----a-w c:\windows\java\Packages\T397FBT7.ZIP
2009-01-22 15:10 --------- d-----w c:\program files\Toshiba
2009-01-22 14:46 --------- d-----w c:\program files\Realtek
2009-01-22 14:45 315,392 ----a-w c:\windows\HideWin.exe
2009-01-22 14:39 --------- d-----w c:\program files\Intel
2009-01-22 14:25 --------- d-----w c:\program files\microsoft frontpage
2009-01-21 20:11 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Toshiba
2009-01-21 20:06 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\Ahead
2009-01-21 19:12 --------- d-----w c:\program files\Avira
2009-01-21 19:12 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-01-21 19:10 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2009-01-21 15:58 --------- d-----w c:\program files\Microsoft.NET
2009-01-21 15:57 --------- d-----w c:\program files\Microsoft Works
2009-01-21 15:48 --------- d-----w c:\program files\Ozone
2009-01-21 15:45 --------- d-----w c:\program files\Real_SC
2009-01-21 15:45 --------- d-----w c:\program files\القاموس
2009-01-21 15:39 --------- d-----w c:\program files\Common Files\Adobe
2009-01-21 15:37 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 15:34 73,216 ----a-w c:\windows\ST6UNST.EXE
2009-01-21 15:34 172,032 ------w c:\windows\Setup1.exe
2009-01-21 15:34 --------- d-----w c:\program files\Golden Al-Wafi Translator
2009-01-21 15:33 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-01-21 15:32 --------- d-----w c:\program files\GRETECH
2009-01-21 15:32 --------- d-----w c:\documents and settings\TOSHIBA\Application Data\GRETECH
2009-01-21 15:28 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-21 15:27 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-21 15:26 --------- d-----w c:\program files\The KMPlayer
2009-01-21 15:26 --------- d-----w c:\program files\Common Files\InstallShield
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [08/04/2004 01:09 AM 1667584]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [01/31/2009 12:25 AM 39408]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [06/27/2006 04:21 PM 1449984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [08/21/2007 06:17 PM 53248]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [02/16/2006 06:34 PM 7557120]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [06/12/2008 02:28 PM 266497]
"GoldenFilterPro"="c:\program files\Golden Filter Pro\GFPro.exe" [04/12/2008 10:40 PM 1392640]
"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [12/16/2002 04:51 PM 36864]
"TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [03/31/2003 07:28 PM 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [01/28/2009 01:48 AM 185872]
"PCSuiteTrayApplication"="c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [06/15/2006 12:36 PM 229376]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/2005 11:46 PM 57344]
"Anti Trojan Elite"="c:\program files\Anti Trojan Elite\TJEnder.exe" [04/16/2008 05:41 PM 863232]
"RTHDCPL"="RTHDCPL.EXE" [08/21/2007 06:17 PM 16342528 c:\windows\RTHDCPL.exe]
"AVG AntiVirus Scanner"="avgscnr.exe" [03/05/2009 07:55 PM 69695 c:\windows\system32\avgscnr.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-05-22 2756608]
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-02-25 1719496]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 01/28/2009 01:48 AM 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
R3 ATE_PROCMON;ATE_PROCMON;c:\program files\Anti Trojan Elite\ATEPMON.sys [2009-03-05 5969]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2009-01-21 194304]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - ATE_PROCMON
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b22a3e86-e8a5-11dd-b785-806d6172696f}]
\Shell\AutoRun\command - F:\autorun.exe
.
- - - - ORPHANS REMOVED - - - -
BHO-{41F21158-4211-4D32-9E02-D57B19661561} - g:\allplayer\RedTubeToALLPlayer.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.orbitdownloader.com
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\documents and settings\TOSHIBA\Local Settings\Temp\Rar$EX04.547\Cracked exe\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\documents and settings\TOSHIBA\Local Settings\Temp\Rar$EX04.547\Cracked exe\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\documents and settings\TOSHIBA\Local Settings\Temp\Rar$EX04.547\Cracked exe\IEGetVL.htm
LSP: c:\windows\system32\idmmbc.dll
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-05 23:37:25
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-839522115-1958367476-2145773891-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="a"
[HKEY_USERS\S-1-5-21-839522115-1958367476-2145773891-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{391C19D3-1138-A666-FC25-3E96AB54B891}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jafmpaliledclcjacnoc"=hex:62,61,62,64,00,00
"jafmpaliledclcjacnkc"=hex:62,61,66,63,00,00
"iaflfdaadchinnnpee"=hex:6b,61,61,64,6c,70,6e,6d,6a,68,61,6c,69,65,64,63,6e,62,
6d,6f,65,62,00,00
"halmpckccchjndcm"=hex:6b,61,61,64,6c,70,6e,6d,6a,68,61,6c,69,65,6f,62,67,61,
6d,64,6e,6f,00,00
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{391C19D3-1138-A666-FC25-3E96AB54B891}\InProcServer32*]
"kapllgbdaobodhiiamgkeo"=hex:62,61,70,63,00,8b
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):0b,c6,9a,ad,1e,0d,ef,04,7a,fd,66,15,92,6c,77,54,2e,17,0b,05,7c,
d9,bd,ad,9b,65,41,c9,90,35,9a,d4,5b,49,7c,74,94,b8,3c,46,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{af635cba-7f5d-41c8-b5a1-73f6ceb75b67}]
@Denied: (Full) (Everyone)
"Model"=dword:00000029
"Therad"=dword:00000014
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(1336)
c:\windows\system32\idmmbc.dll
.
Completion time: 03/05/2009 23:40:19
ComboFix-quarantined-files.txt 2009-03-05 20:40:16
Pre-Run: 16,624,140,288 bytes free
Post-Run: 19,752,419,328 bytes free
250
k:.png)
.png)
