ComboFix 08-08-03.03 - OMC 08/04/2008 11:30:30.1 - NTFSx86
Running from: C:\Documents and Settings\OMC\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\سطح المكتب\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\Antivirus XP 2008
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\LocalService\Application Data\rhca4pj0epcl
C:\Documents and Settings\OMC\Application Data\macromedia\Flash Player\#Shareds\8DF26YML\interclick.com
C:\Documents and Settings\OMC\Application Data\macromedia\Flash Player\#Shareds\8DF26YML\interclick.com\ud.sol
C:\Documents and Settings\OMC\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\OMC\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\OMC\Application Data\rhca4pj0epcl
C:\Documents and Settings\OMC\My Documents\program\Easy Lingo\Desktop_.ini
C:\Program Files\inetget2
C:\Program Files\mjc
C:\Program Files\rhca4pj0epcl
C:\Program Files\XP Antivirus
C:\Program Files\XP Antivirus\xpa.exe
C:\WINDOWS\ktd32.atm
C:\WINDOWS\system32\cmnocfg.xml
C:\WINDOWS\system32\drivers\62258dcf.sys
C:\WINDOWS\system32\phce4pj0epcl.bmp
C:\WINDOWS\system32\qviexio3.dat
C:\WINDOWS\system32\sexit.dat
C:\WINDOWS\ufdata2000.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CBEVTSVC
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_sysrest.sys
-------\Service_62258dcf
-------\Service_CbEvtSvc
-------\Service_MyWebSearchService
-------\Service_sysrest.sys
((((((((((((((((((((((((( Files Created from 2008-07-04 to 2008-08-04 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-04 08:34 144,430 ----a-w C:\Documents and Settings\OMC\catchme.zip
2008-08-04 08:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-04 08:07 --------- d-----w C:\Program Files\AdWare SpyWare Removal
2008-08-04 08:03 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-04 07:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-04 07:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-08-04 05:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-08-03 13:37 --------- d-----w C:\Program Files\Trojan Killer
2008-08-03 10:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-03 09:48 5,532 ----a-w C:\WINDOWS\system32\comsatac.dll
2008-08-03 09:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-08-03 08:23 --------- d-----w C:\Program Files\ESET
2008-08-03 08:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-08-03 07:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-03 07:31 --------- d-----w C:\Documents and Settings\OMC\Application Data\Lavasoft
2008-07-30 08:16 --------- d-----w C:\Program Files\Common Files\element5 Shared
2008-07-30 08:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\element5
2008-07-30 08:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-30 08:12 --------- d-----w C:\Program Files\Common Files\ArcSoft
2008-07-30 08:12 --------- d-----w C:\Program Files\ArcSoft
2008-07-30 07:51 39,936 ----a-w C:\WINDOWS\system32\drivers\CDAC11BA.EXE
2008-07-30 07:51 30,720 ---h--r C:\WINDOWS\CdaC13BA.EXE
2008-07-30 07:51 112,128 ---h--r C:\WINDOWS\CdaC14BA.DLL
2008-07-30 07:51 --------- d-----w C:\Documents and Settings\OMC\Application Data\Arcsoft
2008-07-30 07:49 8,864 ----a-w C:\WINDOWS\system32\drivers\CDAC15BA.SYS
2008-07-30 06:51 --------- d-----w C:\Documents and Settings\OMC\Application Data\skypePM
2008-07-30 06:13 --------- d-----w C:\Program Files\BrOnZ Patch Pro
2008-07-28 07:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-26 09:59 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-07-26 06:20 --------- d-----w C:\Program Files\Google
2008-07-24 07:45 1,175,700 ----a-w C:\WINDOWS\system32\RainySs.scr
2008-07-23 06:40 --------- d-----w C:\Program Files\Real
2008-07-23 06:39 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-23 05:50 20 ----a-w C:\sccfg.sys
2008-07-22 10:13 63,488 ----a-w C:\WINDOWS\xobglu16.dll
2008-07-22 10:13 23,552 ----a-w C:\WINDOWS\xobglu32.dll
2008-07-21 20:04 --------- d-----w C:\Documents and Settings\OMC\Application Data\Wildfire
2008-07-21 11:16 --------- d-----w C:\Program Files\XericDesign
2008-07-21 09:53 65,536 ----a-w C:\WINDOWS\DTDraw.dll
2008-07-21 09:53 --------- d-----w C:\Program Files\DesktopPlant
2008-07-21 09:53 --------- d-----w C:\Documents and Settings\OMC\Application Data\DeskSoft
2008-07-21 09:50 --------- d-----w C:\Documents and Settings\OMC\Application Data\Uniblue
2008-07-21 09:43 --------- d-----w C:\Program Files\CallIT
2008-07-21 09:31 --------- d-----w C:\Program Files\Rainy Screensaver
2008-07-15 05:44 --------- d-----w C:\Documents and Settings\OMC\Application Data\LegalSounds
2008-07-10 09:37 --------- d-----w C:\Documents and Settings\OMC\Application Data\DMCache
2008-07-10 09:34 --------- d-----w C:\Documents and Settings\OMC\Application Data\IDM
2008-07-05 10:38 22,414,120 ----a-w C:\SkypeSetup.exe
2008-06-30 09:36 --------- d-----w C:\Program Files\MSN Password Recovery
2008-06-28 09:56 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-06-25 10:44 --------- d-----w C:\Program Files\ReflexiveArcade
2008-06-23 05:27 --------- d-----w C:\Program Files\QuickWiz
2008-06-23 05:25 --------- d-----w C:\Program Files\Common Files\GuruNet Shared
2008-06-23 05:25 --------- d-----w C:\Program Files\Common Files\Accent Shared
2008-06-22 20:59 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-10 09:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\MumboJumbo
2008-06-10 09:54 --------- d-----w C:\Program Files\Windows Live
2008-06-10 09:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\SpinTop Games
2008-06-07 07:34 --------- d-----w C:\Program Files\FreshDevices
2008-06-07 07:14 --------- d-----w C:\Program Files\TrueDownloader
2008-06-05 22:38 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-05 22:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-05 22:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-05 22:37 --------- d-----w C:\Program Files\Common Files\Real
2008-05-30 17:07 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-30 17:07 172,032 ------w C:\WINDOWS\Setup1.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/06/2008 01:37 AM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 10:16 PM 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 03/01/2007 10:37 AM 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 11/16/2006 07:04 PM 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 01:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 08/04/2004 01:09 AM 1667584 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 08/16/2007 04:19 PM 5728112 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 01/12/2006 03:40 PM 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 06/06/2008 01:37 AM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/30/2007 05:43 PM 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Barsaka]
--a------ 08/04/2004 01:56 AM 1029632 C:\WINDOWS\explorer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R3 AVMWAN;AVM NDIS WAN CAPI Driver;C:\WINDOWS\system32\DRIVERS\avmwan.sys [08/17/2001 12:13 PM]
S3 fxusbase;AVM ISDN-Connector FRITZ!X USB;C:\WINDOWS\system32\DRIVERS\fxusbase.sys [08/17/2001 12:15 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09a6ac35-20ba-11dd-8e38-0002e33efeb3}]
\Shell\AutoRun\command - F:\owlstxm.exe
\Shell\explore\Command - F:\owlstxm.exe
\Shell\open\Command - F:\owlstxm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dded9ef-01ac-11dd-8dec-0002e33efeb3}]
\Shell\AutoRun\command - F:\owlstxm.exe
\Shell\explore\Command - F:\owlstxm.exe
\Shell\open\Command - F:\owlstxm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42c75583-35b9-11dd-8e86-0002e33efeb3}]
\Shell\AutoRun\command - F:\ekugb3.bat
\Shell\explore\Command - F:\ekugb3.bat
\Shell\open\Command - F:\ekugb3.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{642e50cd-027c-11dd-8ded-0002e33efeb3}]
\Shell\AutoRun\command - F:\owlstxm.exe
\Shell\explore\Command - F:\owlstxm.exe
\Shell\open\Command - F:\owlstxm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67770039-150c-11dd-8e15-0002e33efeb3}]
\Shell\AutoRun\command - F:\owlstxm.exe
\Shell\explore\Command - F:\owlstxm.exe
\Shell\open\Command - F:\owlstxm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8a1fcf07-5170-11dd-8e9b-0002e33efeb3}]
\Shell\AutoRun\command - fooool.exe
\Shell\explore\Command - fooool.exe
\Shell\open\Command - fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0d394a1-3b7a-11dd-8e91-0002e33efeb3}]
\Shell\AutoRun\command - F:\kongxsg.exe
\Shell\explore\Command - F:\kongxsg.exe
\Shell\open\Command - F:\kongxsg.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0d39be7-3b7a-11dd-8e91-0002e33efeb3}]
\Shell\AutoRun\command - F:\ekugb3.bat
\Shell\explore\Command - F:\ekugb3.bat
\Shell\open\Command - F:\ekugb3.bat
.
s of the 'Scheduled Tasks' folder
2008-07-21 C:\WINDOWS\Tasks\Uniblue SpyEraser.job
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe []
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-AdWare SpyWare Removal - C:\Program Files\AdWare SpyWare Removal\AdWare SpyWare Removal.exe
Notify-winmyy32 - (no file)
MSConfigStartUp-Advanced DHTML Enable - C:\c.exe
MSConfigStartUp-amva - C:\WINDOWS\system32\amvo.exe
MSConfigStartUp-avgnt - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
MSConfigStartUp-AVP - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
MSConfigStartUp-Free Download Manager - C:\Program Files\Free Download Manager\fdm.exe
MSConfigStartUp-IDMan - C:\Program Files\Internet Download Manager\IDMan.exe
MSConfigStartUp-InternetK - C:\Program Files\Invisible Keylogger\nvsr32.exe
MSConfigStartUp-Local Security Authority Service - C:\WINDOWS\system32\lssas.exe
MSConfigStartUp-mjc - C:\Program Files\mjc\mjc.exe
MSConfigStartUp-My Web Search Bar - C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL
MSConfigStartUp-MyWebSearch Email Plugin - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-MyWebSearch Plugin - C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
MSConfigStartUp-ngcxjsi - C:\Program Files\Common Files\System\qbbtqcy.exe
MSConfigStartUp-owlstxm - C:\Program Files\Common Files\Microsoft Shared\hasybbc.exe
MSConfigStartUp-PCSuiteTrayApplication - C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
MSConfigStartUp-PcSync - C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
MSConfigStartUp-runner1 - C:\WINDOWS\mrofinu1535.exe
MSConfigStartUp-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
MSConfigStartUp-IMJPMIG8 - msime80.exe
MSConfigStartUp-MsServer - msfir80.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\OMC\Application Data\Mozilla\Firefox\Profiles\3vx6m10b.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US
fficial
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-04 11:36:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 08/04/2008 11:43:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-04 08:43:06
Pre-Run: 14,724,308,992 bytes free
Post-Run: 17,242,906,624 bytes free
255
