ComboFix 08-07-21.1 - WwW 07/22/2008 11:05:03.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.344 [GMT 2:00]
Running from: C:\Documents and Settings\WwW\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\kmnlktwe.ini
C:\WINDOWS\system32\lUwacccf.ini
C:\WINDOWS\system32\lUwacccf.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oxyaspwf.ini
C:\WINDOWS\system32\stsdwtnl.ini
C:\WINDOWS\system32\winio.vxd
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 09:15 16,097,568 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-22 09:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\Skype
2008-07-22 09:14 --------- d-----w C:\Documents and Settings\WwW\Application Data\skypePM
2008-07-22 09:11 307,488 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-22 09:11 --------- d-----w C:\Documents and Settings\WwW\Application Data\DMCache
2008-07-22 09:10 30,872 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-22 09:10 219,632 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-22 08:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-19 12:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\CyberScrub
2008-07-19 12:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\cleaner
2008-07-19 11:35 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-19 10:59 --------- d-----w C:\Documents and Settings\WwW\Application Data\IDM
2008-07-19 08:48 --------- d-----w C:\Documents and Settings\WwW\Application Data\MegauploadToolbar
2008-07-18 19:18 --------- d-----w C:\Documents and Settings\WwW\Application Data\uTorrent
2008-07-18 17:53 --------- d-----w C:\Program Files\MegauploadToolbar
2008-07-16 20:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-15 21:54 635,175 ----a-w C:\WINDOWS\system32\Easyriders 2003 vol. 2.scr
2008-07-15 11:42 --------- d-----w C:\Documents and Settings\WwW\Application Data\Apple Computer
2008-07-15 08:30 --------- d-----w C:\Documents and Settings\WwW\Application Data\Ahead
2008-07-15 06:35 --------- d-----w C:\Program Files\Safari
2008-07-15 06:21 --------- d-----w C:\Program Files\QuickTime
2008-07-15 06:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-14 07:15 --------- d-----w C:\Documents and Settings\WwW\Application Data\NASA
2008-07-13 16:46 --------- d-----w C:\Program Files\NASA
2008-07-09 20:58 --------- d-----w C:\Program Files\Java
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-07-07 20:07 --------- d-----w C:\Program Files\'Full Speed' Internet Booster + Performance Tests
2008-07-07 19:52 --------- d-----w C:\Documents and Settings\WwW\Application Data\MozillaControl
2008-07-07 19:38 --------- d-----w C:\Documents and Settings\WwW\Application Data\SlipStream
2008-07-07 19:25 --------- d-----w C:\Program Files\Unlocker
2008-07-07 10:44 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-06 14:19 --------- d-----w C:\Program Files\Flock
2008-07-06 14:19 --------- d-----w C:\Documents and Settings\WwW\Application Data\Flock
2008-07-05 12:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-04 03:16 --------- d-----w C:\Program Files\Common Files\Skype
2008-07-03 17:49 --------- d-----w C:\Program Files\IntelliAdmin
2008-07-02 11:30 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-07-01 16:09 1,700,352 ----a-w C:\WINDOWS\system32\gdiplus.dll
2008-06-30 08:24 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-06-30 08:24 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-06-30 08:24 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-06-30 06:38 --------- d-----w C:\Program Files\Speed Gear
2008-06-30 05:24 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-30 05:24 --------- d-----w C:\Program Files\Spyware Doctor
2008-06-29 15:29 81,920 ----a-w C:\Documents and Settings\WwW\Application Data\ezpinst.exe
2008-06-29 15:29 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-06-29 15:29 47,360 ----a-w C:\Documents and Settings\WwW\Application Data\pcouffin.sys
2008-06-28 19:12 --------- d-----w C:\Program Files\Cain
2008-06-28 18:53 98,304 ----a-w C:\WINDOWS\system32\SoftAheadCert.dll
2008-06-28 18:52 --------- d-----w C:\Program Files\NextSecurity.NET
2008-06-28 16:09 --------- d-----w C:\Program Files\ESET
2008-06-28 14:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-28 14:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-27 18:02 --------- d-----w C:\Program Files\Apple Software Update
2008-06-27 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-06-27 10:43 --------- d-----w C:\Program Files\Google
2008-06-26 20:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Macrovision
2008-06-26 19:58 --------- d-----w C:\Program Files\Opera
2008-06-26 19:55 --------- d-----w C:\Program Files\Common Files\Macromedia Shared
2008-06-26 19:54 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-06-24 19:59 --------- d-----w C:\Program Files\Yahoo!
2008-06-24 15:31 --------- d-----w C:\Program Files\Hotspot Shield
2008-06-24 13:51 --------- d-----w C:\Program Files\Maxthon2
2008-06-22 20:42 12,464 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2008-06-22 19:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-22 11:27 --------- d-----w C:\Documents and Settings\WwW\Application Data\ONSPEED_TOOLBAR
2008-06-20 11:09 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-20 11:08 --------- d-----w C:\Program Files\Windows Live
2008-06-20 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-06-19 13:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-18 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-06-18 12:50 --------- d-----w C:\Documents and Settings\WwW\Application Data\Ipswitch
2008-06-18 12:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ipswitch
2008-06-17 19:47 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-17 18:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-17 18:02 --------- d-----w C:\Program Files\Bonjour
2008-06-17 17:51 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-06-17 15:32 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-06-17 15:31 --------- d-----w C:\Program Files\Skype
2008-06-17 15:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-06-17 15:27 --------- d-----w C:\Documents and Settings\WwW\Application Data\Media Player Classic
2008-06-17 15:24 --------- d-----w C:\Program Files\Common Files\Java
2008-06-17 15:14 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-17 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-06-17 15:07 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-06-17 14:53 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-17 14:45 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-17 14:34 --------- d-----w C:\Program Files\Save Flash
2008-06-17 14:21 --------- d-----w C:\Program Files\WinPcap
2008-06-17 14:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-05-26 23:33 512 ----a-w C:\Program Files\HBEDV.KEY
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [05/30/2008 03:54 PM 21718312]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:09 AM 1667584]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/15/2008 08:39 AM 931248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM 144784]
"USB Antivirus"="d:\Program Files\USB Disk Security\USBGuard.exe" [05/09/2008 03:42 PM 798720]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM 413696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [11/11/2005 07:47 AM 7311360]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [02/08/2008 06:36 PM 227856]
"VTTimer"="VTTimer.exe" [03/07/2005 09:33 PM 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [03/11/2005 11:33 AM 147456 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [06/10/2003 01:12 PM 55296 C:\WINDOWS\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.ac3filter"= ac3filter.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 11/11/2005 07:47 AM 7311360 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 11/11/2005 07:47 AM 86016 C:\WINDOWS\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pdfFactory Pro Dispatcher v3]
--a------ 09/26/2006 10:33 PM 503808 C:\WINDOWS\system32\spool\drivers\w32x86\3\fppdis3a.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 11/06/2006 10:27 AM 200704 d:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 05/27/2008 10:50 AM 413696 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 06/17/2008 05:24 PM 77824 C:\Program Files\Java\jre1.6.0\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 11/11/2005 07:47 AM 1519616 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\AppServ\\Apache2.2\\bin\\httpd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\uTorrent\\utorrent.exe"=
"D:\\Program Files\\Ipswitch\\WS_FTP Professional\\wsftpgui.exe"=
"D:\\Program Files\\Valve\\hlds.exe"=
"D:\\Program Files\\Valve\\hl.exe"=
"C:\\AppServ\\MySQL\\bin\\mysqld-nt.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 Apache2.2;Apache2.2;C:\AppServ\Apache2.2\bin\httpd.exe [01/09/2007 06:17 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [01/23/2008 11:25 PM]
S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys []
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [08/03/2005 06:10 AM]
S3 SIWIO;SIW low-level I/O driver;C:\WINDOWS\TEMP\SiwIo.sys []
S3 xAntiArp;xAntiArpSpoof Service;C:\WINDOWS\system32\DRIVERS\xAntiArp.sys []
.
s of the 'Scheduled Tasks' folder
"2008-07-22 06:01:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemManagerV1 - C:\WINDOWS\SystemManagerV1.exe
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
MSConfigStartUp-1816ed83 - C:\WINDOWS\system32\ewtklnmk.dll
MSConfigStartUp-abadisoft - C:\Program Files\Abadisoft\WinUtility\\Abadisoft.WinUtilites.exe
MSConfigStartUp-AvaFind - D:\Program Files\AvaFind\AvaFind.exe
MSConfigStartUp-BM1b25de1f - C:\WINDOWS\system32\ncvujnve.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: &تصدير إلى Microsoft Excel - D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-22 11:12:09
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mysql]
"ImagePath"="C:\AppServ\MySQL\bin\mysqld-nt --defaults-file=C:\AppServ\MySQL\my.ini mysql"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\Crypserv.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\AppServ\MySQL\bin\mysqld-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 07/22/2008 11:25:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-22 09:25:09
Pre-Run: 9,625,169,920 bytes free
Post-Run: 10,511,937,536 bytes free
262 --- E O F --- 2008-06-22 21:20:15
