ComboFix 08-11-16.05 - D_007 11/17/2008 21:31:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.553 [GMT 3:00]
Running from: c:\documents and settings\D_007\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\documents and settings\D_007\Application Data\tazebama
c:\documents and settings\D_007\Application Data\tazebama\tazebama.log
c:\documents and settings\D_007\Application Data\tazebama\zPharaoh.dat
C:\zPharaoh.exe
D:\Autorun.inf
d:\recycler\RECYCLER .exe
d:\recycler\WinrRarSerialInstall.exe
D:\zPharaoh.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 19:00 --------- d-----w c:\program files\Sigmatel
2008-11-17 18:27 --------- d-----w c:\program files\IObit
2008-11-17 18:15 0 ----a-w C:\osy3.sys
2008-11-17 17:45 36,896 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-17 17:45 3,596 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-17 17:45 3,104 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-17 17:45 1,340 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-17 17:36 --------- d-----w c:\program files\AutorunRemover
2008-11-17 16:49 --------- d-----w c:\program files\Common Files\INCA Shared
2008-11-17 16:47 --------- d--h--w c:\documents and settings\D_007\Application Data\ijjigame
2008-11-17 16:46 --------- d-----w c:\program files\IDT
2008-11-17 16:46 --------- d-----w c:\documents and settings\All Users\Application Data\IJJIGame
2008-11-17 16:45 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-17 16:45 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-17 16:44 --------- d-----w c:\documents and settings\D_007\Application Data\Ventrilo
2008-11-17 16:28 --------- d-----w c:\program files\Driver-Soft
2008-11-17 16:22 --------- d-----w c:\program files\Ventrilo
2008-11-17 16:22 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-17 16:21 --------- d-----w c:\program files\BitSpirit
2008-11-17 16:21 --------- d-----w c:\program files\Bit Che
2008-11-17 16:21 --------- d-----w c:\documents and settings\D_007\Application Data\Convivea
2008-11-17 16:19 --------- d-----w c:\program files\AGEIA Technologies
2008-11-17 16:10 --------- d-----w c:\program files\microsoft frontpage
.
كود:
<pre>
----a-w 161,145 2008-11-17 15:31:48 c:\ijji\ijji .exe
----a-w 161,565 2008-11-17 13:08:08 c:\ijji\ENGLISH\ENGLISH .exe
----a-w 161,215 2008-11-17 13:08:09 c:\ijji\ENGLISH\res\res .exe
----a-w 161,525 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\u_sf .exe
----a-w 161,825 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\data .exe
----a-w 161,755 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\area\area .exe
----a-w 161,705 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\clan\clan .exe
----a-w 161,545 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\effect\effect .exe
----a-w 161,215 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\force\force .exe
----a-w 161,835 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\lobby\lobby .exe
----a-w 161,425 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\menu\menu .exe
----a-w 161,825 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\save\save .exe
----a-w 161,305 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\scr\scr .exe
----a-w 161,195 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\screenshot\screenshot .exe
----a-w 161,595 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\sound\sound .exe
----a-w 161,145 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\data\weapon\weapon .exe
----a-w 161,595 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\GameGuard\GameGuard .exe
----a-w 161,445 2008-11-17 13:08:09 c:\ijji\ENGLISH\u_sf\redist\redist .exe
----a-w 161,435 2008-11-17 13:08:09 c:\ijji\ENGLISH\xfire\xfire .exe
------w 161,585 2008-11-17 13:08:55 c:\program files\IDT\AUD_allXP_5790.3_PV_IAS_v22 .exe
------w 161,895 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\HDAQFE .exe
------w 161,245 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\srvrtm\srvrtm .exe
------w 161,225 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\srvrtm\us\us .exe
------w 160,945 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\srvsp1\srvsp1 .exe
------w 161,295 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\srvsp1\us\us .exe
------w 161,125 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\win2k3\win2k3 .exe
------w 160,905 2008-11-17 13:09:12 c:\program files\IDT\HDAQFE\win2k3\jpn\jpn .exe
------w 161,565 2008-11-17 13:09:12 c:\program files\IDT\HDAQFE\win2k3\us\us .exe
------w 161,805 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\win2ksp4\win2ksp4 .exe
------w 161,235 2008-11-17 13:09:12 c:\program files\IDT\HDAQFE\win2ksp4\us\us .exe
------w 161,355 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\win2k_xp\win2k_xp .exe
------w 161,585 2008-11-17 13:09:12 c:\program files\IDT\HDAQFE\win2k_xp\us\us .exe
------w 161,625 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\xpsp1\xpsp1 .exe
------w 161,195 2008-11-17 13:09:12 c:\program files\IDT\HDAQFE\xpsp1\us\us .exe
------w 161,735 2008-11-17 13:09:11 c:\program files\IDT\HDAQFE\xpsp2\xpsp2 .exe
------w 161,125 2008-11-17 13:09:12 c:\program files\IDT\HDAQFE\xpsp2\us\us .exe
------w 161,305 2008-11-17 13:09:11 c:\program files\IDT\SONICFOCUS\SONICFOCUS .exe
------w 161,255 2008-11-17 13:09:11 c:\program files\IDT\WDM\WDM .exe
----a-w 161,255 2008-11-17 13:09:11 c:\program files\Sigmatel\C-Major Audio\WDM\WDM .exe
</pre>
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [05/11/2007 01:03 AM 8429568]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitSpirit\\BitSpirit.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\PurpleBean.exe"=
R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\DRIVERS\gflmouhid.sys [2008-08-08 6656]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\D_007\Application Data\Mozilla\Firefox\Profiles\kd8c3i03.default\
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-17 21:33:54
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 11/17/2008 21:34:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-17 18:34:27
ComboFix2.txt 2008-11-17 18:09:11
Pre-Run: 36,446,789,632 bytes free
Post-Run: 36,458,938,368 bytes free
140
