ComboFix 08-09-16.05 - user 09/19/2008 5:04:05.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.74 [GMT 3:00]
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-08-19 to 2008-09-19 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-19 02:10 --------- d-----w C:\Documents and Settings\user\Application Data\Orbit
2008-09-19 02:07 409,632 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-19 02:07 3,528 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-19 02:07 22,232 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-19 02:07 2,573,344 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-18 23:17 --------- d-----w C:\Program Files\Orbitdownloader
2008-09-18 23:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-17 00:18 --------- d-----w C:\Program Files\Microsoft Works
2008-09-16 18:32 --------- d-----w C:\Documents and Settings\user\Application Data\cleaner
2008-09-16 16:31 --------- d-----w C:\Documents and Settings\user\Application Data\GrabPro
2008-09-16 16:27 --------- d-----w C:\Program Files\Free Download Manager
2008-09-16 16:17 --------- d-----w C:\Program Files\MSN Messenger
2008-09-16 16:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-16 02:17 --------- d-----w C:\Program Files\MessengerDiscovery
2008-09-15 17:26 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-15 16:54 --------- d-----w C:\Program Files\Windows Live
2008-09-14 20:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-14 19:03 --------- d-----w C:\Program Files\VideoLAN
2008-09-14 03:17 --------- d-----w C:\Documents and Settings\user\Application Data\Paltalk
2008-09-14 03:16 --------- d-----w C:\Program Files\Paltalk Messenger
2008-09-13 21:35 --------- d-----w C:\Program Files\QuickTime
2008-09-13 21:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-13 15:38 --------- d-----w C:\Program Files\Video GIF Converter
2008-09-12 23:14 --------- d-----w C:\Program Files\Video Convert Master
2008-09-12 17:25 --------- d-----w C:\Documents and Settings\user\Application Data\Wait soap burn
2008-09-12 01:04 64,650 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-09-12 01:04 6,112 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-12 01:04 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-11 23:58 --------- d-----w C:\Program Files\Circle Developement
2008-09-11 23:12 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-09-11 22:45 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-09-11 22:41 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-11 22:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-09-10 17:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-10 05:47 --------- d-----w C:\Program Files\TechSmith
2008-09-10 05:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith
2008-09-10 05:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-07 16:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Memo save stupid creative
2008-09-07 16:42 --------- d-----w C:\Program Files\Wait soap burn
2008-09-07 16:42 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-07 16:31 --------- d-----w C:\Program Files\Common Files\xing shared
2008-09-07 16:31 --------- d-----w C:\Program Files\Common Files\Real
2008-09-07 16:30 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-09-07 16:30 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-09-06 02:31 --------- d-----w C:\Program Files\The KMPlayer
2008-09-05 03:21 81,920 ----a-w C:\Documents and Settings\user\Application Data\ezpinst.exe
2008-09-05 03:21 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-09-05 03:21 47,360 ----a-w C:\Documents and Settings\user\Application Data\pcouffin.sys
2008-09-05 03:21 --------- d-----w C:\Documents and Settings\user\Application Data\Vso
2008-09-05 03:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-05 03:12 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-05 01:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-04 16:41 --------- d-----w C:\Documents and Settings\user\Application Data\Apple Computer
2008-09-04 14:34 --------- d-----w C:\Documents and Settings\user\Application Data\CyberScrub
2008-09-03 23:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-09-03 22:17 --------- d-----w C:\Program Files\Adobe FL CS3
2008-09-02 21:02 --------- d-----w C:\Program Files\VIA Technologies, Inc
2008-09-02 20:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-09-02 20:56 --------- d-----w C:\Program Files\Real
2008-09-02 20:52 502,272 ----a-w C:\WINDOWS\system32\winlogon.exe
2008-09-02 20:44 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-02 20:44 --------- d-----w C:\Program Files\Common Files\L&H
2008-09-02 20:43 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-09-02 20:34 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-29 14:43 25,088 ----a-w C:\WINDOWS\system32\msxml3a.dll
2008-07-29 17:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-29 17:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-07-21 15:34 121,872 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.
------- Sigcheck -------
04/14/2008 03:12 AM 507904 ed0ef0a136dec83df69f04118870003e C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe
09/02/2008 11:52 PM 502272 6225f14b8ce08ccba8b25ad27843c674 C:\WINDOWS\system32\winlogon.exe
02/28/2006 03:00 PM 974336 a5c1f2cf7c31874e66478910b43d6513 C:\WINDOWS\explorer.exe
04/14/2008 03:12 AM 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
02/28/2006 03:00 PM 974336 a5c1f2cf7c31874e66478910b43d6513 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [02/28/2006 03:00 PM 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [05/11/2007 03:06 AM 40048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/07/2008 07:30 PM 185896]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [07/29/2008 08:20 PM 206088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [02/28/2006 03:00 PM 15360]
C:\Documents and Settings\user\Start Menu\Programs\Startup\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-05 113664]
AudioDeck.lnk - C:\Program Files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe [2008-09-03 581632]
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-09-16 1707208]
PalTalk.lnk - C:\Program Files\Paltalk Messenger\paltalk.exe [2008-09-11 11713536]
SnagIt 9.lnk - C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe [2008-05-15 6822728]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM 24592]
S3 Vsp;Vsp;C:\WINDOWS\system32\drivers\Vsp.sys [05/27/2003 04:45 PM 3351]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\7104w6a4.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://search.orbitdownloader.com
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-19 05:10:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
-> C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\TechSmith\SnagIt 9\TscHelp.exe
C:\Program Files\TechSmith\SnagIt 9\SnagPriv.exe
C:\Program Files\TechSmith\SnagIt 9\SnagItEditor.exe
.
**************************************************************************
.
Completion time: 09/19/2008 5:17:09 - machine was rebooted [user]
ComboFix-quarantined-files.txt 2008-09-19 02:16:49
Pre-Run: 30,791,917,568 bytes free
Post-Run: 31,064,297,472 bytes free
183 --- E O F --- 2008-09-18 00:39:53
