combofix 08-10-23.08 - al-kc 10/24/2008 13:27:12.1 - ntfsx86
microsoft windows xp professional 5.1.2600.2.1256.1.1025.18.320 [gmt 3:00]
running from: C:\documents and settings\al-kc\سطح المكتب\combofix.exe
* created a new restore point
warning -this machine does not have the recovery console installed !!
.
Error: Cfiles.dat
((((((((((((((((((((((((((((((((((((((( other deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( drivers/services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\service_tdssserv
((((((((((((((((((((((((( files created from 2008-09-24 to 2008-10-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( find3m report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 10:33 4,492 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-10-24 10:33 385,056 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-10-24 10:32 --------- d-----w c:\documents and settings\all users\application data\kaspersky lab
2008-10-24 10:31 20,592 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-10-24 10:31 2,229,280 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-10-24 10:18 --------- d-----w c:\documents and settings\al-kc\application data\utorrent
2008-10-23 23:09 --------- d-----w c:\program files\internet download manager
2008-10-23 23:08 --------- d-----w c:\documents and settings\al-kc\application data\idm
2008-10-23 22:11 --------- d-----w c:\documents and settings\al-kc\application data\dmcache
2008-10-23 21:26 --------- d-----w c:\program files\google
2008-10-23 21:18 --------- d-----w c:\program files\common files\installshield
2008-10-23 21:17 --------- d-----w c:\program files\counter-strike source
2008-10-23 11:18 --------- d-----w c:\documents and settings\al-kc\application data\greatcamp
2008-10-23 11:17 --------- d-----w c:\documents and settings\all users\application data\memo save stupid creative
2008-10-23 11:15 --------- d-----w c:\program files\greatcamp
2008-10-23 09:03 --------- d--h--w c:\program files\installshield installation information
2008-10-21 11:15 --------- d-----w c:\documents and settings\al-kc\application data\cleaner
2008-10-18 22:52 --------- d-----w c:\program files\common files\xing shared
2008-10-18 22:52 --------- d-----w c:\program files\common files\real
2008-10-07 23:07 --------- d-----w c:\program files\paltalk messenger
2008-10-07 23:07 --------- d-----w c:\documents and settings\al-kc\application data\paltalk
2008-10-06 01:59 --------- d-----w c:\documents and settings\al-kc\application data\cyberscrub
2008-10-05 02:42 --------- d-----w c:\documents and settings\all users\application data\cafe
2008-09-23 19:05 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-09-23 19:05 --------- d-----w c:\program files\real
2008-09-23 09:43 --------- d-----w c:\program files\k-lite codec pack
2008-09-23 09:36 823,296 ----a-w c:\windows\is-jli2j.exe
2008-09-23 09:28 --------- d-----w c:\documents and settings\al-kc\application data\media player classic
2008-09-23 09:27 823,296 ----a-w c:\windows\is-c2ov8.exe
2008-09-22 21:08 --------- d-----w c:\program files\utorrent
2008-09-22 00:01 --------- d-----w c:\documents and settings\al-kc\application data\vlc
2008-09-21 10:52 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-09-21 10:52 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-09-21 02:53 --------- d-----w c:\program files\kaspersky lab
2008-09-21 02:51 --------- d-----w c:\documents and settings\all users\application data\kaspersky lab setup files
2008-09-21 02:50 --------- d-----w c:\documents and settings\all users\application data\avira
2008-09-20 00:27 --------- d-----w c:\documents and settings\all users\application data\messenger plus!
2008-09-18 23:07 --------- d-----w c:\program files\windows live
2008-09-18 23:07 --------- d-----w c:\program files\msn messenger
2008-09-18 23:07 --------- d-----w c:\program files\messenger plus! Live
2008-09-18 23:07 --------- d-----w c:\program files\circle developement
2008-09-18 11:07 --------- d-----w c:\program files\common files\adobe
2008-09-18 11:04 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-09-18 11:04 --------- d-----w c:\program files\videolan
2008-09-18 11:03 --------- d-----w c:\documents and settings\all users\application data\cyberlink
2008-09-18 11:02 --------- d-----w c:\program files\cyberlink
2008-09-18 10:59 73,216 ----a-w c:\windows\st6unst.exe
2008-09-18 10:59 172,032 ------w c:\windows\setup1.exe
2008-09-18 10:59 --------- d-----w c:\program files\acd
2008-09-18 10:03 --------- d-----w c:\program files\microsoft.net
2008-09-18 10:03 --------- d-----w c:\program files\microsoft works
2008-09-18 09:06 --------- d-----w c:\program files\microsoft frontpage
2008-07-25 08:34 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w c:\windows\system32\divx.dll
.
((((((((((((((((((((((((((((((((((((( reg loading points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*note* empty entries & legit default entries are not shown
regedit4
[hkey_current_user\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 am 15360]
"okay jugs"="c:\docume~1\al-kc\applic~1\greatc~1\bib bleh barb.exe" [10/23/2008 02:15 pm 554496]
"msmsgs"="c:\program files\messenger\msmsgs.exe" [08/04/2004 01:09 am 1667584]
[hkey_local_machine\software\microsoft\windows\currentversion\run]
"remotecontrol"="c:\program files\cyberlink\powerdvd\pdvdserv.exe" [09/18/2006 11:08 am 29696]
"languageshortcut"="c:\program files\cyberlink\powerdvd\language\language.exe" [09/29/2006 09:58 pm 49152]
"tkbellexe"="c:\program files\common files\real\update_ob\realsched.exe" [10/19/2008 01:51 am 185896]
"avp"="c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe" [04/25/2008 06:21 pm 201992]
[hkey_users\.default\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 am 15360]
[hkey_local_machine\software\microsoft\security center]
"updatesdisablenotify"=dword:00000001
"antivirusoverride"=dword:00000001
[hkey_local_machine\software\microsoft\security center\monitoring\kasperskyantivirus]
"disablemonitoring"=dword:00000001
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"enablefirewall"= 0 (0x0)
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"=
"c:\\program files\\msn messenger\\msnmsgr.exe"=
"c:\\program files\\msn messenger\\livecall.exe"=
"c:\\documents and settings\\all users\\application data\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"=
"c:\\program files\\utorrent\\utorrent.exe"=
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"9420:tcp"= 9420:tcp:akamai network manager
"5000:udp"= 5000:udp:akamai network manager
r0 klbg;kaspersky lab boot guard driver;c:\windows\system32\drivers\klbg.sys [01/29/2008 06:29 pm 32784]
r3 klfltdev;kaspersky lab klfltdev;c:\windows\system32\drivers\klfltdev.sys [03/13/2008 07:02 pm 26640]
r3 klim5;kaspersky anti-virus ndis filter;c:\windows\system32\drivers\klim5.sys [03/25/2008 08:07 pm 24592]
s3 tapvpn;tap vpn adapter;c:\windows\system32\drivers\tapvpn.sys [12/16/2006 11:37 pm 27136]
.
S of the 'scheduled tasks' folder
2008-10-24 c:\windows\tasks\bb12ae369bc92402.job
- c:\docume~1\al-kc\applic~1\greatc~1\inside 01 store.exe [10/23/2008 02:18 pm]
.
- - - - orphans removed - - - -
hklm-run-snpstd - c:\windows\vsnpstd.exe
.
------- supplementary scan -------
.
R0 -: Hkcu-main,start page = about:blank
r0 -: Hklm-main,start page = hxxp://www.farsicd.ir
r1 -: Hkcu-searchurl,(default) = hxxp://www.google.com/search?q=%s
o8 -: &تصدير إلى microsoft excel - c:\progra~1\micros~2\office11\excel.exe/3000
o8 -: Add to banner ad blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
.
**************************************************************************
catchme 0.3.1367 w2k/xp/vista - rootkit/stealth malware detector by gmer,
rootkit scan 2008-10-24 13:33:09
windows 5.1.2600 service pack 2 ntfs
scanning hidden processes ...
Scanning hidden autostart entries ...
Scanning hidden files ...
Scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ other running processes ------------------------
.
C:\program files\common files\microsoft shared\vs7debug\mdm.exe
c:\program files\cyberlink\shared files\richvideo.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 10/24/2008 13:37:31 - machine was rebooted
combofix-quarantined-files.txt 2008-10-24 10:37:05
pre-run: 36,690,366,464 bytes free
post-run: 36,671,303,680 bytes free
152
