ComboFix 08-11-16.05 - mohamed 2008-11-18 0:56:43.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.545 [GMT 2:00]
Running from: c:\documents and settings\mohamed\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))
.
2008-11-17 22:45 . 2008-11-17 22:45 1,548 --a------ c:\windows\system32\tmp.reg
2008-11-17 22:44 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
2008-11-17 22:44 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
2008-11-17 22:44 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe
2008-11-17 22:44 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe
2008-11-17 22:44 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
2008-11-17 22:44 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe
2008-11-17 22:44 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe
2008-11-17 22:44 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe
2008-11-17 22:44 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
2008-11-17 22:44 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
2008-11-17 22:40 . 2008-11-17 22:40 <DIR> d-------- c:\program files\Symantec
2008-11-17 22:40 . 2008-11-17 22:41 <DIR> d-------- c:\documents and settings\All Users\Application Data\Symantec
2008-11-17 22:22 . 2008-11-17 22:22 <DIR> d-------- c:\documents and settings\mohamed\Application Data\Symantec
2008-11-17 22:09 . 2008-11-17 22:40 10,652 --a------ c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-17 22:09 . 2008-11-17 22:40 806 --a------ c:\windows\system32\drivers\SYMEVENT.INF
2008-11-17 22:07 . 2008-11-17 22:07 <DIR> d-------- c:\program files\Common Files\Symantec Shared
2008-11-17 20:39 . 2008-11-17 20:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-14 13:22 . 2008-11-14 13:22 0 --a------ C:\8741
2008-11-12 17:26 . 2008-10-24 13:10 453,632 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-09 13:14 . 2008-11-09 13:14 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-09 13:08 . 2008-06-13 15:10 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-11-09 13:08 . 2008-06-13 15:10 272,128 --------- c:\windows\system32\dllcache\bthport.sys
2008-11-09 13:04 . 2008-08-14 12:00 2,180,352 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-09 13:04 . 2008-08-14 11:58 2,136,064 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-09 13:04 . 2008-08-14 11:22 2,057,728 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-09 13:04 . 2008-08-14 11:22 2,015,744 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-09 09:04 . 2008-11-09 09:04 <DIR> d--h----- c:\windows\$hf_mig$
2008-11-09 09:04 . 2005-02-25 05:35 22,752 --a------ c:\windows\system32\spupdsvc.exe
2008-11-08 20:44 . 2008-11-08 20:44 <DIR> d-------- c:\documents and settings\mohamed\Application Data\vlc
2008-11-08 20:43 . 2008-11-08 20:43 <DIR> d-------- c:\program files\VideoLAN
2008-11-08 19:56 . 2008-11-08 19:56 <DIR> d--hs---- C:\FOUND.000
2008-11-08 19:48 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-11-08 19:34 . 2004-08-03 23:08 26,496 --a------ c:\windows\system32\dllcache\usbstor.sys
2008-11-08 09:53 . 2008-11-08 09:53 <DIR> d-------- c:\windows\Sun
2008-11-07 20:51 . 2008-11-07 20:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\zyz Kaspersky Lab setup files
2008-11-07 19:01 . 2008-11-07 19:01 <DIR> d-------- c:\documents and settings\mohamed\Application Data\LimeWire
2008-11-07 19:00 . 2008-11-07 19:00 <DIR> d-------- c:\program files\Sun
2008-11-07 19:00 . 2008-11-07 19:00 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-07 19:00 . 2008-11-07 19:00 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-07 18:59 . 2008-11-07 18:59 <DIR> d-------- c:\program files\Java
2008-11-07 18:29 . 2008-11-07 18:29 <DIR> d-------- c:\program files\LimeWire
2008-11-07 18:16 . 2008-11-07 18:16 <DIR> d-------- c:\windows\PaltalkScene
2008-11-07 18:16 . 2008-11-07 18:16 <DIR> d-------- c:\program files\Paltalk Messenger
2008-11-07 18:16 . 2008-11-07 18:16 <DIR> d-------- c:\documents and settings\mohamed\Application Data\Paltalk
2008-11-07 12:45 . 2008-11-07 12:45 7,168 --ahs---- c:\windows\Thumbs.db
2008-11-06 02:04 . 2008-11-06 02:04 <DIR> d-------- c:\program files\Microsoft Silverlight
2008-11-06 01:49 . 2008-11-06 01:49 <DIR> d---s---- c:\documents and settings\mohamed\UserData
2008-11-05 23:46 . 2008-11-05 23:46 <DIR> d-------- c:\program files\Common Files\xing shared
2008-11-05 23:45 . 2008-11-05 23:45 <DIR> d-------- c:\program files\Common Files\Real
2008-11-05 22:15 . 2004-08-04 03:07 19,456 --a------ c:\windows\system32\dllcache\agt0804.dll
2008-11-05 22:15 . 2004-08-04 03:07 19,456 --a------ c:\windows\system32\dllcache\agt0412.dll
2008-11-05 22:15 . 2004-08-04 03:07 19,456 --a------ c:\windows\system32\dllcache\agt0404.dll
2008-11-05 22:09 . 2004-08-04 03:07 66,594 --a------ c:\windows\system32\dllcache\c_852.nls
2008-11-05 22:09 . 2004-08-04 03:07 66,082 --a------ c:\windows\system32\dllcache\c_20127.nls
2008-11-05 22:09 . 2004-08-04 03:07 66,082 --a------ c:\windows\system32\dllcache\c_10082.nls
2008-11-05 22:09 . 2004-08-04 03:07 66,082 --a------ c:\windows\system32\dllcache\c_10029.nls
2008-11-05 22:09 . 2004-08-04 03:07 66,082 --a------ c:\windows\system32\dllcache\c_10010.nls
2008-11-05 22:09 . 2004-08-04 03:07 8,704 --a------ c:\windows\system32\dllcache\batt.dll
2008-11-05 21:47 . 2008-11-05 21:47 <DIR> d--hs---- C:\Recycled
2008-11-05 21:46 . 2008-11-05 21:46 <DIR> d-------- c:\program files\Real
2008-11-05 21:46 . 2008-11-05 21:46 <DIR> d-------- c:\documents and settings\mohamed\Contacts
2008-11-05 21:45 . 2008-11-05 21:45 <DIR> d-------- c:\windows\system32\DRVSTORE
2008-11-05 21:44 . 2008-11-05 21:44 <DIR> d-------- c:\program files\MSN Messenger
2008-11-05 21:00 . 2008-11-05 21:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 20:36 782,336 ----a-r c:\windows\system32\nwiz.exe
2008-11-17 18:47 90,112 ----a-w c:\windows\DUMPb6f7.tmp
2008-11-05 18:33 --------- d-----w c:\program files\Realtek Sound Manager
2008-11-05 18:33 --------- d-----w c:\program files\AvRack
2008-11-05 18:32 --------- d-----w c:\program files\Marvell
2008-11-05 18:30 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-05 18:30 --------- d-----w c:\program files\Intel
2008-11-05 18:30 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-05 18:24 --------- d-----w c:\program files\microsoft frontpage
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-15 16:57 332,800 ----a-w c:\windows\system32\dllcache\netapi32.dll
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\dllcache\win32k.sys
2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-09-04 16:42 1,106,944 ----a-w c:\windows\system32\dllcache\msxml3.dll
2008-08-29 15:43 25,088 ----a-w c:\windows\system32\msxml3a.dll
2008-08-28 10:04 333,056 ----a-w c:\windows\system32\dllcache\srv.sys
2008-08-19 09:30 18,432 ----a-w c:\windows\system32\dllcache\iedw.exe
.
كود:
<pre>
----a-w 2,182,065 2006-12-28 22:05:20 c:\documents and settings\mohamed\Desktop\WinRAR.Crystal.2008 .exe
</pre>
(((((((((((((((((((((((((((((
snapshot@2008-11-17_22.53.28.84 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-17 20:59:22 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_658.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5743984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2001-12-16 2899968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2001-12-16 46080]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-05 180269]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-07 136600]
"DsNiu"="c:\windows\system32\ShuiNiu.exe" [N/A]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2008-11-17 c:\windows\system32\nwiz.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SymLnch"="c:\documents and settings\mohamed\Application Data\Symantec\Layouts\Norton Internet Security\15.0\SymAllLanguages\NIS_RETAIL\20070828\Support\SymLnch\SymLnch.exe" [2007-08-27 761704]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2008-09-11 11713536]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= c:\\Program Files\\MSN Messenger\\MsnMsgr.Exe
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"d:\\program\\New Folder\\LimeWireWin.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=
"c:\\WINDOWS\\system32\\nwiz.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\SOUNDMAN.EXE"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=
"c:\\WINDOWS\\system32\\ctfmon.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Documents and Settings\\mohamed\\Application Data\\Symantec\\Layouts\\Norton Internet Security\\15.0\\SymAllLanguages\\NIS_RETAIL\\20070828\\Stub.exe"=
"c:\\WINDOWS\\system32\\cmd.exe"=
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\oqktrn.sys []
*Newly Created Service* - COMHOST
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-18 00:57:49
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-18 0:58:21
ComboFix-quarantined-files.txt 2008-11-17 22:58:20
ComboFix2.txt 2008-11-17 20:54:04
Pre-Run: 2,188,664,832 bytes free
Post-Run: 2,187,837,440 bytes free
180 --- E O F --- 2008-11-12 16:23:27
