ComboFix 08-09-22.06 - edaat 11/25/2008 0:36:19.3 - NTFSx86
Running from: C:\DOCUME~1\edaat\LOCALS~1\Temp\ir_ext_temp_4\AutoPlay\Docs\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 21:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-11-24 21:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Babylon
2008-11-24 21:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-11-24 21:41 6,016 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-11-24 21:41 524,320 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-11-24 21:41 4,014,112 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-11-24 21:41 36,632 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-11-24 20:04 --------- d-----w C:\Documents and Settings\edaat\Application Data\cleaner
2008-11-20 13:45 --------- d-----w C:\Documents and Settings\edaat\Application Data\Babylon
2008-11-17 20:56 --------- d-----w C:\Documents and Settings\edaat\Application Data\DMCache
2008-11-12 16:54 --------- d-----w C:\Program Files\The Herbal Pharmacy
2008-11-12 16:49 --------- d-----w C:\Program Files\PCBugDoctor
2008-11-08 15:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\SpeedBit
2008-11-07 12:06 --------- d-----w C:\Documents and Settings\edaat\Application Data\Ectaco
2008-11-07 08:00 --------- d-----w C:\Documents and Settings\edaat\Application Data\Orbit
2008-11-06 22:24 --------- d-----w C:\Documents and Settings\edaat\Application Data\GrabPro
2008-11-06 18:49 --------- d-----w C:\Program Files\DAP
2008-11-06 15:55 116,176 ----a-w C:\WINDOWS\iun1405.exe
2008-11-06 11:15 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-11-06 11:15 --------- d-----w C:\Program Files\Google
2008-11-02 16:38 --------- d-----w C:\Program Files\Opera
2008-10-30 17:38 98,304 ----a-w C:\WINDOWS\system32\viscomtran.dll
2008-10-30 17:37 90,112 ----a-w C:\WINDOWS\system32\ssvideo.dll
2008-10-30 17:37 19,456 ----a-w C:\WINDOWS\system32\videocore.dll
2008-10-30 17:37 18,595,840 ----a-w C:\WINDOWS\system32\coredata.dll
2008-10-30 17:37 1,128,128 ----a-w C:\WINDOWS\system32\NMSDVDXU.dll
2008-10-25 17:38 --------- d-----w C:\Documents and Settings\edaat\Application Data\CBCL
2008-10-25 17:20 --------- d-----w C:\Program Files\Publications
2008-10-25 16:31 --------- d-----w C:\Program Files\ltmoh
2008-10-25 12:36 --------- d-----w C:\Program Files\Intel
2008-10-25 12:34 291,395 ----a-w C:\WINDOWS\WBDCC34I.DLL
2008-10-25 11:40 --------- d-----w C:\Program Files\USB Disk Security
2008-10-23 16:44 --------- d-----w C:\Program Files\Abadisoft
2008-10-23 16:43 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-10-21 14:26 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-10-21 14:26 --------- d-----w C:\Program Files\Femta
2008-10-21 14:26 --------- d-----w C:\Documents and Settings\edaat\Application Data\Azureus
2008-10-20 15:33 --------- d-----w C:\Documents and Settings\edaat\Application Data\cald3
2008-10-20 15:32 --------- d-----w C:\Program Files\IDM
2008-10-20 15:28 --------- d-----w C:\Program Files\Cambridge
2008-10-17 06:51 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-10-15 13:09 --------- d-----w C:\Documents and Settings\edaat\Application Data\RapidGet
2008-10-09 03:46 --------- d-----w C:\Documents and Settings\edaat\Application Data\Lavasoft
2008-10-09 03:35 2,800 ----a-w C:\WINDOWS\system32\tmp.reg
2008-10-07 23:37 0 ----a-w C:\osy3.sys
2008-09-20 21:25 344,064 ----a-w C:\WINDOWS\system32\dkll.dll
2008-09-20 21:25 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-09-20 21:25 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-09-20 21:25 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-09-19 19:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe
2008-09-19 19:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe
2008-09-11 19:43 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-09-11 19:43 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-09-09 06:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-02 23:51 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-11-06 18:48 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{F4F10C1D-87C7-404A-B4B3-000000000000}"= "C:\PROGRA~1\DAP\SBSearch.dll" [11/06/2008 02:15 PM 38384]
[HKEY_CLASSES_ROOT\clsid\{f4f10c1d-87c7-404a-b4b3-000000000000}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{95EFB171-F3DF-4BEC-9EF7-829A800203E6}]
[HKEY_CLASSES_ROOT\SearchHook.SrchHook]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [05/23/2004 03:00 PM 15360]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.EXE" [11/06/2008 09:48 PM 3061248]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [11/06/2008 02:15 PM 171448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [01/26/2004 08:03 PM 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [01/26/2004 08:03 PM 118784]
"SigmaTel StacMon"="C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe" [08/03/2003 05:01 PM 86073]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [03/21/2006 03:34 AM 213936]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [01/02/2003 05:16 PM 172032]
"Babylon Client"="C:\Program Files\Babylon\Babylon-Pro\Babylon.exe" [02/14/2008 08:02 PM 3165920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/13/2008 11:51 AM 185896]
"Cselect"="C:\WINDOWS\system32\cselect.exe" [03/05/2003 01:15 PM 110592]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\zyzoom.exe" [11/03/2007 02:50 PM 6731312]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [04/26/2008 04:21 AM 201992]
"AGRSMMSG"="AGRSMMSG.exe" [04/18/2003 12:20 PM 88363 C:\WINDOWS\agrsmmsg.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [05/23/2004 03:00 PM 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
07/23/2006 09:49 AM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ :\WINDOWS\syste scecli
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalStart.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^سرعة تشغيل Adobe Reader.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 11/03/2007 02:50 PM 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\zyzoom.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 06/12/2008 12:38 PM 34672 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nitro PDF Printer Monitor]
--a------ 02/09/2008 02:42 AM 210208 C:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch]
--a------ 02/12/2004 09:02 PM 1019904 C:\Program Files\TOSHIBA\PadTouch\PadExe.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 02/16/2007 08:54 PM 282624 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 06/10/2008 02:27 PM 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 11/06/2008 02:15 PM 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTSMMSG]
--a------ 04/18/2003 11:06 AM 32768 C:\WINDOWS\ltsmmsg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5]
-ra------ 12/02/2003 03:15 PM 73728 C:\WINDOWS\system32\TFNF5.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/30/2008 04:29 AM 32784]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [05/23/2004 03:00 PM 14336]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/14/2008 05:02 AM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [03/26/2008 06:07 AM 24592]
S3 bepldr;BCL easyPDF SDK 5 Loader;C:\Program Files\Common Files\BCL Technologies\NitroPDF5\bepldr.exe [11/16/2007 04:05 AM 151552]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
s of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R1 -: HKCU-Internet Settings,ProxyServer = proxy.ksu.edu.sa:8080
R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie
O8 -: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 -: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 -: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 -: Save Flash with Flash Catcher - C:\Program Files\Common Files\Justdo\IECatcher.DLL/FlashCatcher.htm
O8 -: Translate with &Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O8 -: ت&صدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 -: {90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} - res://C:\Program Files\Common Files\Justdo\IECatcher.DLL/FlashCatcher.htm
O9 -: {90BAE0EF-F4BF-4FAC-B2EC-2C725C34AF12} - res://C:\Program Files\Common Files\Justdo\IECatcher.DLL/FlashCatcher.htm -
O18 -: Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~1\DAP\dapie.dll
O18 -: Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~1\DAP\dapie.dll
.
.
------- File Associations -------
.
vbefile\shell\edit\command=C:\WINDOWS\Notepad.exe %1
vbsfile\shell\edit\command=C:\WINDOWS\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-25 00:46:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 11/25/2008 0:52:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-24 21:52:08
ComboFix2.txt 2008-10-26 13:54:41
ComboFix3.txt 2008-10-09 03:25:57
Pre-Run: 7,052,075,008 bytes free
Post-Run: 7,120,871,424 bytes free
216
