ComboFix 08-07-27.5 - Mostafa 07/28/2008 21:18:21.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.116 [GMT 3:00]
Running from: F:\M Y - R I P P E D - G A M E S\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Mostafa\Local Settings\Temporary Internet Files\.IE5\WL4ZKF03\cnsminex_empty[1].htm
C:\WINDOWS\AppPatch\AcSpecf.dll
C:\WINDOWS\linkinfo.dll
C:\WINDOWS\system32\_000110_.tmp.dll
C:\WINDOWS\system32\caotxb.dll
C:\WINDOWS\system32\cedafb.dll
C:\WINDOWS\system32\ddserh.dll
C:\WINDOWS\system32\drivers\cdralw.sys
C:\WINDOWS\system32\fsrgeb.dll
C:\WINDOWS\system32\googleons.dll
C:\WINDOWS\system32\hhrdxd.dll
C:\WINDOWS\system32\jfrwdh.dll
C:\WINDOWS\system32\jolin0.dll
C:\WINDOWS\system32\jsnoer.dll
C:\WINDOWS\system32\sgdewg.dll
C:\WINDOWS\system32\tdfhex.dll
C:\WINDOWS\system32\tdggrz.dll
C:\WINDOWS\system32\theralte.dll
C:\WINDOWS\system32\wcnonpe.dll
C:\WINDOWS\system32\wmdrtc32.dl_
C:\WINDOWS\system32\wmdrtc32.dll
C:\WINDOWS\system32\woswelc.dll
C:\WINDOWS\system32\zycdex.dll
C:\WINDOWS\Update.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CDRALW
-------\Service_cdralw
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 18:23 5,477 ----a-w C:\WINDOWS\system32\drivers\oosmmm.sys
2008-07-28 18:22 40,960 ----a-w C:\WINDOWS\system32\wmdrtc32.dll
2008-07-28 18:05 18,048 ----a-w C:\WINDOWS\system32\drivers\eth8023.sys
2008-07-28 17:41 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-28 16:20 --------- d-----w C:\Program Files\SpywareStop
2008-07-28 16:20 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\SpywareStop
2008-07-28 15:50 30 ----a-w C:\MicroSoft.bat
2008-07-28 15:50 186 ----a-w C:\MicroSoft.vbs
2008-07-28 15:17 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\IDM
2008-07-28 14:25 9,728 ----a-w C:\WINDOWS\AppPatch\AclLayer.dll
2008-07-28 13:47 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\Media Player Classic
2008-07-28 12:24 --------- d-----w C:\Program Files\Maxthon2
2008-07-28 10:30 27,136 ----a-w C:\WINDOWS\AppPatch\AcPlugin.dll
2008-07-28 02:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-07-28 02:04 749,568 ----a-w C:\WINDOWS\iun6002ev.exe
2008-07-28 01:32 --------- d-----w C:\Program Files\SUAVE
2008-07-28 01:25 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\PlanetPlayMore
2008-07-28 01:23 --------- d-----w C:\Program Files\ReflexiveArcade
2008-07-28 01:11 36,864 ----a-w C:\WINDOWS\system32\mssetd.dll
2008-07-28 01:11 28,672 ----a-w C:\WINDOWS\system32\crtnumo.dll
2008-07-28 01:10 24,576 ----a-w C:\WINDOWS\system32\xfimerl.dll
2008-07-28 01:10 24,576 ----a-w C:\WINDOWS\system32\xboxdo.dll
2008-07-28 01:10 24,576 ----a-w C:\WINDOWS\system32\tennfs.dll
2008-07-28 01:09 28,672 ----a-w C:\WINDOWS\system32\welyri.dll
2008-07-28 01:09 28,672 ----a-w C:\WINDOWS\system32\esceps.dll
2008-07-28 01:09 24,576 ----a-w C:\WINDOWS\system32\offecao.dll
2008-07-28 01:09 232,960 ---ha-w C:\WINDOWS\system32\zgtwfx.dll
2008-07-28 01:09 225,792 ---ha-w C:\WINDOWS\system32\zsdgff.dll
2008-07-28 01:08 240,128 ---ha-w C:\WINDOWS\system32\fmcvxy.dll
2008-07-28 01:08 24,576 ----a-w C:\WINDOWS\system32\myusemt.dll
2008-07-28 01:08 24,576 ----a-w C:\WINDOWS\system32\longasus.dll
2008-07-28 01:08 225,792 ---ha-w C:\WINDOWS\system32\jhfrxz.dll
2008-07-28 01:05 14,336 ----a-w C:\WINDOWS\system32\mssetdk.exe
2008-07-28 01:05 14,336 ----a-w C:\WINDOWS\AppPatch\DesktopWin.dll
2008-07-27 22:59 660 --sh--r C:\io64.sys
2008-07-27 22:59 --------- d-----w C:\Program Files\GLDirect
2008-07-27 21:37 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-27 20:44 --------- d-----w C:\Program Files\SpeedProject
2008-07-27 20:44 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\SpeedProject
2008-07-27 19:51 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\LimeWire
2008-07-27 11:00 --------- d-----w C:\Program Files\NortonInstaller
2008-07-27 11:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-07-27 04:49 --------- d-----w C:\Program Files\DAEMON Tools
2008-07-27 04:45 --------- d-----w C:\Program Files\AntiARP Stand-alone Edition
2008-07-27 04:45 --------- d-----w C:\Program Files\Anti Netcut
2008-07-27 04:44 315,392 ------w C:\WINDOWS\Setup1.exe
2008-07-27 04:44 101,888 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-07-27 04:44 --------- d-----w C:\Program Files\WinPcap
2008-07-27 04:43 --------- d-----w C:\Program Files\stopcut
2008-07-27 04:42 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-07-27 04:41 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-27 04:41 --------- d-----w C:\Program Files\Winamp
2008-07-27 04:37 --------- d-----w C:\Program Files\Java
2008-07-27 04:37 --------- d-----w C:\Program Files\Common Files\Java
2008-07-27 04:36 --------- d-----w C:\Documents and Settings\Mostafa\Application Data\DMCache
2008-07-27 04:13 --------- d-----w C:\Program Files\microsoft frontpage
2006-09-16 13:20 3,808 ----a-w C:\Program Files\SETUP.LST
2006-09-16 13:20 1,880,140 ----a-w C:\Program Files\Anti NetCut.CAB
1998-06-17 21:00 169,472 ----a-w C:\Program Files\setup.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/28/2008 06:17 PM 880896]
"SpywareStop"="C:\Program Files\SpywareStop\SpywareStop.exe" [07/25/2008 07:03 PM 7754992]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AntiARPStandalone"="C:\Program Files\AntiARP Stand-alone Edition\AntiArp.exe" [08/15/2007 03:27 PM 5073408]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
C:\Documents and Settings\Mostafa\Start Menu\Programs\Startup\
StopCut home.lnk - C:\Program Files\stopcut\StopCut home.url [2007-07-17 18:38:54 79]
StopCut.lnk - C:\Program Files\stopcut\StopCut.exe [2007-07-17 16:05:43 57372]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{7914E0AA-ECCB-4311-B584-C49538227824}"= "C:\WINDOWS\system32\jhfrxz.dll" [07/28/2008 04:08 AM 225792]
"{73AE86E6-7F03-4C3B-8980-FB1DA157D3C7}"= "C:\WINDOWS\system32\fmcvxy.dll" [07/28/2008 04:08 AM 240128]
"{53D44DB6-E22B-4B17-97D3-572C96CCA6E1}"= "C:\WINDOWS\system32\zsdgff.dll" [07/28/2008 04:09 AM 225792]
"{006CA8A1-61BC-4774-A54C-F49034270BAD}"= "C:\WINDOWS\system32\zgtwfx.dll" [07/28/2008 04:09 AM 232960]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R0 pmfilt;pmfilt;C:\WINDOWS\system32\drivers\pmfilt.sys [07/20/2004 03:13 AM]
R0 pmhelp;pmhelp;C:\WINDOWS\system32\drivers\pmhelp.sys [07/20/2004 03:13 AM]
R2 AntiArpNdisProt;AntiARP NDIS Protocol Driver;C:\WINDOWS\system32\DRIVERS\AntiArpNdisProt.sys [04/18/2007 07:16 PM]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [08/03/2004 10:29 PM]
R3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [01/25/2007 08:31 PM]
R3 slnt;Realtek RTL8139 Family PCI Fast Ethernet NIC;C:\WINDOWS\system32\DRIVERS\slnt.sys [06/22/2004 08:17 AM]
R3 xAntiArp;xAntiArpSpoof Service;C:\WINDOWS\system32\DRIVERS\xAntiArp.sys [08/11/2007 11:06 PM]
R4 NdisFileServices32;NdisFileServices32;C:\WINDOWS\system32\drivers\oosmmm.sys [07/28/2008 09:25 PM]
S3 eth8023;eth8023;C:\WINDOWS\system32\drivers\eth8023.sys [07/28/2008 09:05 PM]
.
s of the 'Scheduled Tasks' folder
2008-07-28 C:\WINDOWS\Tasks\SpywareStop Scheduled Scan.job
- C:\Program Files\SpywareStop\SpywareStop.exe [07/25/2008 07:03 PM]
2008-07-28 C:\WINDOWS\Tasks\SpywareStop Scheduled Scan.job
- C:\Program Files\SpywareStop [07/28/2008 07:20 PM]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-3PMmUpdate - C:\WINDOWS\Update.dll
.
------- Supplementary Scan -------
.
O8 -: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 -: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O17 -: HKLM\CCS\Interface\{EB6BC2DB-1DB1-4515-8C56-A172F4F6B09B}: NameServer = 163.121.128.134,212.103.160.18
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-28 21:23:09
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\wmdrtc32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Winamp\winamp.exe
.
**************************************************************************
.
Completion time: 07/28/2008 21:25:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-28 18:25:50
Pre-Run: 2,726,686,720 bytes free
Post-Run: 2,965,540,864 bytes free
185
