ComboFix 08-11-22.02 - nagi 11/24/2008 0:18:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.169 [GMT 3:00]
Running from: c:\documents and settings\nagi\سطح المكتب\ComboFix.exe
* Created a new restore point
[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\windows\IE4 Error Log.txt
c:\windows\system32\amvo.exe
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ASC3360PR
-------\Service_asc3360pr
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 21:18 --------- d-----w c:\documents and settings\nagi\Application Data\DMCache
2008-11-23 21:02 --------- d-----w c:\documents and settings\All Users\Application Data\TechSmith
2008-11-23 21:00 --------- d-----w c:\program files\Alloy
2008-11-23 20:47 --------- d-----w c:\program files\Your Uninstaller 2008
2008-11-23 20:45 --------- d-----w c:\documents and settings\nagi\Application Data\URSoft
2008-11-23 20:37 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-23 20:31 --------- d-----w c:\program files\TechSmith
2008-11-23 20:28 84,992 --sh--r c:\windows\system32\kav320.dll
2008-11-23 11:04 84,992 --sh--r c:\windows\system32\kav321.dll
2008-11-23 11:04 187,392 --sh--r C:\ln9.exe
2008-11-23 02:06 --------- d-----w c:\program files\Common Files\TechSmith Shared
2008-11-23 02:04 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-22 22:55 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-22 22:54 --------- d-----w c:\program files\Windows Live
2008-11-22 21:54 --------- d-----w c:\documents and settings\nagi\Application Data\Media Player Classic
2008-11-22 21:53 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-22 21:48 --------- d-----w c:\program files\VIA
2008-11-22 21:46 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-22 21:10 84,992 --sh--r c:\windows\system32\kav322.dll
2008-11-22 20:42 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-11-22 20:42 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-11-22 20:42 --------- d-----w c:\documents and settings\nagi\Application Data\PC Suite
2008-11-22 20:42 --------- d-----w c:\documents and settings\nagi\Application Data\Nokia
2008-11-22 20:40 --------- d-----w c:\documents and settings\All Users\Application Data\PC Suite
2008-11-22 20:40 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-11-22 20:39 --------- d-----w c:\program files\PC Connectivity Solution
2008-11-22 20:39 --------- d-----w c:\program files\Nokia
2008-11-22 20:39 --------- d-----w c:\program files\DIFX
2008-11-22 20:39 --------- d-----w c:\program files\Common Files\PCSuite
2008-11-22 20:39 --------- d-----w c:\program files\Common Files\Nokia
2008-11-22 20:37 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2008-11-22 18:41 --------- d-----w c:\documents and settings\nagi\Application Data\IDM
2008-11-22 18:39 --------- d-----w c:\program files\Internet Download Manager
2008-11-22 18:36 --------- d-----w c:\program files\IObit
2008-11-22 18:36 --------- d-----w c:\documents and settings\nagi\Application Data\IObit
2008-11-22 17:20 24,064 ----a-w c:\windows\autoload.exe
2008-11-22 17:15 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-22 17:08 --------- d-----w c:\program files\Realtek AC97
2008-11-22 15:25 --------- d-----w c:\program files\S3
2008-11-22 15:07 --------- d-----w c:\program files\microsoft frontpage
2008-11-02 14:02 7,680 ----a-w c:\windows\system32\ff_vfw.dll
2008-10-28 22:35 684,032 ----a-w c:\windows\system32\divx.dll
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 11:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 11:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 11:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 11:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 11:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 11:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 11:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 11:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll
2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-09-15 15:37 1,845,888 ----a-w c:\windows\system32\win32k.sys
2008-09-04 16:44 1,106,944 ----a-w c:\windows\system32\msxml3.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [11/15/2008 12:11 PM 2235920]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [10/28/2008 07:08 PM 2688432]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [06/17/2008 04:00 PM 1249280]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [08/11/2008 08:31 AM 1124352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [06/29/2007 12:51 PM 811008]
"VTTimer"="VTTimer.exe" [08/03/2006 09:53 AM 53248 c:\windows\system32\VTTimer.exe]
"S3Trayp"="S3trayp.exe" [07/10/2006 09:33 PM 176128 c:\windows\system32\S3Trayp.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Reboot.exe [2006-12-29 409088]
SnagIt 9.lnk - c:\program files\TechSmith\SnagIt 9\SnagIt32.exe [2008-09-22 6903112]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PC Connectivity Solution\\Transports\\NclMSBTSrv.exe"=
"c:\\Program Files\\IObit\\Advanced SystemCare 3\\AWC.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\VIA\\VIAudioi\\HDADeck\\HDeck.exe"=
"e:\\ln9.exe"=
"c:\\Program Files\\Nokia\\Nokia PC Suite 7\\PCSync2.exe"=
"c:\\WINDOWS\\system32\\MsiExec.exe"=
"c:\\Program Files\\PC Connectivity Solution\\NclInstaller.exe"=
"c:\\Program Files\\Internet Download Manager\\IDMan.exe"=
R3 S3GIGP;S3GIGP;c:\windows\system32\DRIVERS\S3gIGPm.sys [2008-11-22 654848]
S3 autorun;autorun;\??\C:\huadio.tmp [2008-11-22 5789]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a0c2a12-b8bf-11dd-9781-001bb9c598cc}]
\Shell\AutoRun\command - G:\ln9.exe
\Shell\explore\Command - G:\ln9.exe
\Shell\open\Command - G:\ln9.exe
*Newly Created Service* - ASC3360PR
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [URL="http://www.gmer.net/"]http://www.gmer.net[/URL]
Rootkit scan 2008-11-24 00:19:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\spupdsvc.log
scan completed successfully
hidden files: 1
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\C:\huadio.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\WgaLogon.dll
c:\windows\system32\rsaenh.dll
- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 11/24/2008 0:21:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-23 21:21:40
Pre-Run: 10,622,873,600 bytes free
Post-Run: 10,653,646,848 bytes free
163 --- E O F --- 2008-11-23 20:31:48
