والتقرير
ComboFix 08-11-13.02 - salem 11/15/2008 21:32:13.4 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.204 [GMT 3:00]
Running from: c:\documents and settings\salem\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-10-15 to 2008-11-15 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 22:42 --------- d-----w c:\program files\Your Uninstaller 2006
2008-11-14 18:29 --------- d-----w c:\program files\a-squared Anti-Malware
2008-11-12 17:04 --------- d-----w c:\program files\ISOFTCENTER
2008-11-11 18:16 81,920 ----a-w c:\windows\SYSTEM32\W32N50.DLL
2008-11-11 18:16 17,134 ----a-w c:\windows\SYSTEM32\PCANDIS5.SYS
2008-11-10 19:33 --------- d-----w c:\program files\Uniblue
2008-11-10 19:33 --------- d-----w c:\documents and settings\salem\Application Data\Uniblue
2008-11-10 18:42 --------- d--h--w c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-11-10 10:57 --------- d-----w c:\program files\Classic Menu for Office
2008-11-09 19:28 --------- d-----w c:\program files\MSBuild
2008-11-09 19:28 --------- d-----w c:\program files\Microsoft Works
2008-11-09 19:19 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-07 22:06 --------- d-----w c:\program files\Microsoft Windows OneCare Live
2008-11-05 18:44 --------- d-----w c:\program files\MSXML 4.0
2008-11-05 14:13 --------- d-----w c:\documents and settings\salem\Application Data\ACD Systems
2008-11-05 14:12 --------- d-----w c:\program files\Common Files\ACD Systems
2008-11-05 14:12 --------- d-----w c:\program files\ACD Systems
2008-11-05 14:12 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-11-04 21:17 --------- d-----w c:\program files\Fax Machine
2008-11-02 18:25 --------- d-----w c:\program files\Windows Live Safety Center
2008-11-02 16:54 --------- d--h--w c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2008-10-31 01:23 --------- d-----w c:\program files\Alwil Software
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ----a-w c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-22 20:50 --------- d-----w c:\program files\IObit
2008-10-22 20:36 --------- d-----w c:\program files\Steganos Internet Trace Destructor 7
2008-10-21 03:41 --------- d-----w c:\program files\System
2008-10-16 11:13 202,776 ----a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 11:13 202,776 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 11:13 1,809,944 ----a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 11:13 1,809,944 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 11:12 561,688 ----a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 11:12 561,688 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 11:12 323,608 ----a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 11:12 323,608 ----a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 11:09 92,696 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 11:09 92,696 ----a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 11:09 51,224 ----a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 11:09 51,224 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 11:09 43,544 ----a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 11:08 34,328 ----a-w c:\windows\SYSTEM32\WUPS.DLL
2008-10-16 11:08 34,328 ----a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-15 16:57 332,800 ----a-w c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-14 19:58 256 ----a-w C:\sccfg.sys
2008-10-14 19:44 --------- d-----w c:\documents and settings\salem\Application Data\iolo
2008-10-14 19:44 --------- d-----w c:\documents and settings\All Users\Application Data\iolo
2008-10-14 19:25 --------- d-----w c:\program files\أحكام التجويد
2008-10-11 19:57 --------- d-----w c:\program files\Java
2008-10-11 19:57 --------- d-----w c:\program files\Common Files\Java
2008-10-08 21:36 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2008-10-07 14:19 --------- d-----w c:\documents and settings\Administrator\Application Data\Orbit
2008-10-06 11:00 --------- d-----w c:\documents and settings\salem\Application Data\GrabPro
2008-10-05 20:01 --------- d-----w c:\program files\ma-config.com
2008-10-05 20:01 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2008-10-04 20:37 --------- d-----w c:\program files\Orbitdownloader
2008-10-04 20:37 --------- d-----w c:\documents and settings\salem\Application Data\Orbit
2008-10-03 04:47 --------- d-----w c:\program files\aljazeera news
2008-09-30 13:43 1,286,152 ----a-w c:\windows\SYSTEM32\msxml4.dll
2008-09-25 05:43 86,400 ----a-w c:\windows\~GLC0000.TMP
2008-09-15 11:57 1,846,016 ----a-w c:\windows\SYSTEM32\win32k.sys
2008-09-15 11:57 1,846,016 ----a-w c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-09-12 10:44 206,256 ----a-w c:\windows\SYSTEM32\idmmbc.dll
2008-09-11 22:58 679,936 ----a-w c:\windows\3D World Map.scr
2008-09-05 20:30 241,704 ------w c:\windows\SYSTEM32\DLLCACHE\wgaLogon.dll
2008-09-05 20:29 917,032 ------w c:\windows\SYSTEM32\DLLCACHE\WgaTray.exe
2008-09-04 16:42 1,106,944 ----a-w c:\windows\SYSTEM32\msxml3.dll
2008-09-04 16:42 1,106,944 ----a-w c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-08-28 10:04 333,056 ----a-w c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-08-20 05:38 474,112 ----a-w c:\windows\SYSTEM32\DLLCACHE\shlwapi.dll
2008-08-20 05:38 151,040 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdfview.dll
2008-08-20 05:38 1,494,528 ----a-w c:\windows\SYSTEM32\DLLCACHE\shdocvw.dll
2008-08-20 05:38 1,054,208 ----a-w c:\windows\SYSTEM32\DLLCACHE\danim.dll
2008-08-20 05:38 1,023,488 ----a-w c:\windows\SYSTEM32\DLLCACHE\browseui.dll
2008-08-19 10:33 724,992 ----a-w c:\windows\iun6002.exe
2008-08-16 12:30 90,112 ----a-w c:\windows\DUMPdc17.tmp
2008-08-16 10:50 90,112 ----a-w c:\windows\DUMPcc87.tmp
2007-12-09 20:34 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((
snapshot@Sat 11-15-2008_14.01.39.64 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-12 16:57:30 1,235,696 ----a-w c:\windows\SYSTEM32\aswBoot.exe
+ 2008-11-12 16:51:12 97,480 ----a-w c:\windows\SYSTEM32\AvastSS.scr
+ 2008-11-12 16:51:36 26,944 ----a-w c:\windows\SYSTEM32\DRIVERS\aavmker4.sys
+ 2008-11-12 16:53:28 20,560 ----a-w c:\windows\SYSTEM32\DRIVERS\aswFsBlk.sys
+ 2008-11-12 16:54:28 93,296 ----a-w c:\windows\SYSTEM32\DRIVERS\aswmon.sys
+ 2008-11-12 16:54:20 94,032 ----a-w c:\windows\SYSTEM32\DRIVERS\aswmon2.sys
+ 2008-11-12 16:52:28 23,152 ----a-w c:\windows\SYSTEM32\DRIVERS\aswRdr.sys
+ 2008-11-12 16:53:38 110,160 ----a-w c:\windows\SYSTEM32\DRIVERS\aswSP.sys
+ 2008-11-12 16:52:38 50,656 ----a-w c:\windows\SYSTEM32\DRIVERS\aswTdi.sys
+ 2008-11-15 16:05:06 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_74c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [09/01/2004 12:00 AM 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [11/08/2008 09:45 PM 2606512]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [10/13/2004 07:24 PM 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SDaemon"="c:\windows\sdaemon.exe" [04/19/2005 12:57 AM 111104]
"a-squared"="c:\program files\A-SQUARED ANTI-MALWARE\a2guard.exe" [11/02/2008 06:15 PM 2780816]
"SWd"="c:\windows\winwd.exe" [BU]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [11/12/2008 07:54 PM 81000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^salem^Start Menu^Programs^Startup^FastStone Capture.lnk]
backup=c:\windows\pss\FastStone Capture.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 05/11/2007 03:06 AM 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 09/01/2004 12:00 AM 15360 c:\windows\SYSTEM32\CTFMON.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 11/08/2008 09:45 PM 2606512 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 10/13/2004 07:24 PM 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 10/18/2007 11:34 AM 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDaemon]
--a------ 04/19/2005 12:57 AM 111104 c:\windows\sdaemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 08/28/2008 12:26 AM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Avant Browser\\avant.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"g:\\HIW\\stInstall.exe"=
R0 WINSEC;WINSEC;c:\windows\system32\drivers\WINSEC.SYS [2008-10-30 20352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-15 110160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-15 20560]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe -k netsvcs [2008-10-30 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-10-30 24344]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-02 195752]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2008-10-30 10305280]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-10-30 306432]
S4 winser;winser;c:\windows\system32\winsersec.exe []
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{764cfc5d-a105-11dc-ba7a-806d6172696f}]
\Shell\AutoRun\command - G:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4ab7ff6-af4b-11dd-86c1-0019d115a791}]
\Shell\AutoRun\command - H:\xih9.cmd
\Shell\explore\Command - H:\xih9.cmd
\Shell\open\Command - H:\xih9.cmd
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
2008-11-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [01/08/2008 01:31 PM]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page =
R0 -: HKLM-Main,Window Title = ابوعبدالله
O8 -: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
O8 -: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
O8 -: ????? ?? ?????? ??????? ??????
O8 -: ????? ???? ?? ?????? ??????? ??????
O8 -: ????? ????? ????? (??.??.??) ?? ?????? ??????? ??????
O8 -: ?????? ??????
O8 -: Add to &Teleport - c:\progra~1\TELEPO~1\teleport.htm
O8 -: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
O8 -: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
O8 -: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: E???? ??E?? ??I?? (??.??.??) EU ??E??E IC????I ?C????
O8 -: E???? C??? EU ??E??E IC????I ?C????
O8 -: E???? EU ??E??E IC????I ?C????
O8 -: Send To &Bluetooth -
O8 -: E???? ??E?? ??I?? (??.??.??) EU ??E??E IC????I ?C???? - c:\program files\Internet Download Manager\IEGetVL.htm
O8 -: E???? C??? EU ??E??E IC????I ?C???? - c:\program files\Internet Download Manager\IEGetAll.htm
O8 -: E???? EU ??E??E IC????I ?C???? - c:\program files\Internet Download Manager\IEExt.htm
O8 -: الدليل السريع - c:\windows\ww80.html
O8 -: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
O16 -: Microsoft XML Parser for Java - c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
-
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-15 21:35:59
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 11/15/2008 21:36:38
ComboFix-quarantined-files.txt 2008-11-15 18:36:36
ComboFix5.txt 2008-11-15 18:31:08
ComboFix4.txt 2008-11-10 21:09:08
ComboFix3.txt 2008-11-10 22:07:38
ComboFix2.txt 2008-11-15 11:02:28
Pre-Run: 12,976,062,464 bytes free
Post-Run: 12,988,432,384 bytes free
223 --- E O F --- 2008-11-15 10:24:18
