ComboFix 08-12-09.02 - welcome 12/10/2008 16:32:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.671 [GMT 3:00]
Running from: c:\documents and settings\welcome\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\welcome\Application Data\tazebama
c:\documents and settings\welcome\Application Data\tazebama\tazebama.log
c:\documents and settings\welcome\Application Data\tazebama\zPharaoh.dat
c:\windows\system32\igfxres.dll
d:\recycler\documents_backup.rar
.
((((((((((((((((((((((((( Files Created from 2008-11-10 to 2008-12-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 13:35 8,886,304 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-10 13:34 104,408 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-09 22:35 --------- d-----w c:\program files\ESET
2008-12-09 22:26 --------- d-----w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-09 13:19 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-09 13:19 47,104 ----a-w c:\windows\AKDeInstall.exe
2008-12-09 12:53 --------- d-----w c:\program files\Adverts
2008-12-09 12:40 --------- d-----w c:\documents and settings\welcome\Application Data\proxy frag heart
2008-12-09 12:39 --------- d-----w c:\documents and settings\All Users\Application Data\Iso Web Bags Else
2008-12-09 12:37 26,920,408 ----a-w C:\avg75free_484a1103.exe
2008-12-08 22:50 --------- d-----w c:\program files\SUPERAntiSpyware
2008-12-08 22:50 --------- d-----w c:\documents and settings\welcome\Application Data\SUPERAntiSpyware.com
2008-12-08 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-08 22:49 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-05 14:00 --------- d-----w c:\program files\MSN Messenger
2008-11-21 16:16 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-21 16:16 --------- d-----w c:\program files\Circle Developement
2008-11-17 15:17 --------- d-----w c:\documents and settings\welcome\Application Data\Nokia
2008-11-13 23:11 --------- d-----w c:\documents and settings\welcome\Application Data\ACD Systems
2008-11-13 15:59 --------- d-----w c:\program files\Yahoo!
2008-11-13 15:58 --------- d-----w c:\program files\Common Files\ACD Systems
2008-11-13 15:58 --------- d-----w c:\program files\ACD Systems
2008-11-13 15:58 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-11-13 15:57 10,368 ----a-w c:\windows\system32\drivers\pfc.sys
2008-11-13 15:57 --------- d-----w c:\program files\Nero
2008-11-13 15:56 --------- d-----w c:\program files\mpegable
2008-11-13 15:54 --------- d-----w c:\program files\HP
2008-11-13 15:20 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-11-13 15:09 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-13 15:09 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-11-13 15:09 --------- d-----w c:\program files\Common Files\xing shared
2008-11-13 15:09 --------- d-----w c:\program files\Common Files\Real
2008-11-13 15:05 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-13 15:04 --------- d-----w c:\program files\MSBuild
2008-11-13 15:04 --------- d-----w c:\program files\Microsoft Works
2008-11-13 14:54 512,096 ----a-w c:\windows\system32\drivers\amon.sys
2008-11-13 14:54 298,104 ----a-w c:\windows\system32\imon.dll
2008-11-13 14:54 15,424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2008-11-13 14:51 --------- d-----w c:\program files\Windows Live
2008-11-13 14:48 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-13 14:47 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-13 14:46 --------- d-----w c:\program files\CyberLink
2008-11-13 14:42 172,032 ------w c:\windows\Setup1.exe
2008-11-13 14:42 --------- d-----w c:\program files\Golden Al-Wafi Translator
2008-11-13 14:35 --------- d-----w c:\program files\Common Files\Adobe
2008-11-13 14:33 155,995 ----a-w c:\windows\java\Packages\AQ0EB3BZ.ZIP
2008-11-13 14:33 --------- d-----w c:\program files\Java
2008-11-13 14:32 --------- d-----w c:\program files\Common Files\Java
2008-11-13 08:51 --------- d-----w c:\documents and settings\welcome\Application Data\Media Player Classic
2008-11-13 08:50 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-11-13 08:48 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-11-13 08:46 --------- d-----w c:\program files\Real
2008-11-13 08:45 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-13 08:41 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-12 19:21 --------- d-----w c:\documents and settings\welcome\Application Data\Printer Info Cache
2008-11-12 19:21 --------- d-----w c:\documents and settings\welcome\Application Data\Image Zone Express
2008-11-12 18:51 --------- d-----w c:\documents and settings\All Users\Application Data\WEBREG
2008-11-12 18:49 --------- d-----w c:\documents and settings\welcome\Application Data\HP
2008-11-12 18:46 --------- d-----w c:\program files\Common Files\Hewlett-Packard
2008-11-12 18:45 --------- d-----w c:\documents and settings\All Users\Application Data\Hewlett-Packard
2008-11-12 17:57 --------- d-----w c:\program files\Synaptics
2008-11-12 17:57 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-12 17:32 --------- d-----w c:\program files\NetWaiting
2008-11-12 17:32 --------- d-----w c:\program files\CONEXANT
2008-11-12 17:30 --------- d-----w c:\program files\Broadcom
2008-11-12 17:30 --------- d-----w c:\documents and settings\welcome\Application Data\InstallShield
2008-11-12 17:29 --------- d-----w c:\program files\Intel
2008-11-12 17:25 --------- d-----w c:\program files\Hewlett-Packard
2008-11-12 16:45 --------- d-----w c:\program files\microsoft frontpage
2008-11-11 16:34 --------- d-----w c:\program files\proxy frag heart
2008-11-11 15:46 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-16 11:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 11:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 11:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 11:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 11:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 11:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 11:08 34,328 ----a-w c:\windows\system32\wups.dll
.
(((((((((((((((((((((((((((((
snapshot@Sat 12-06-2008_17.29.19.71 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-03 21:56:44 2,804,224 -c----w c:\windows\$MSI31Uninstall_KB893803v2$\msi.dll
+ 2004-08-03 21:56:54 77,312 -c----w c:\windows\$MSI31Uninstall_KB893803v2$\msiexec.exe
+ 2004-08-03 21:56:44 331,264 -c----w c:\windows\$MSI31Uninstall_KB893803v2$\msihnd.dll
+ 2004-08-03 21:56:18 884,736 -c----w c:\windows\$MSI31Uninstall_KB893803v2$\msimsg.dll
+ 2004-08-03 21:56:44 44,032 -c----w c:\windows\$MSI31Uninstall_KB893803v2$\msisip.dll
+ 2005-05-04 11:45:28 371,936 -c----w c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
- 2008-11-11 16:29:43 238,447 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe
+ 2008-12-09 13:34:49 81,920 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe
- 2008-11-11 16:29:47 238,447 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe
+ 2008-12-09 13:34:49 81,920 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe
- 2008-11-11 16:29:48 238,447 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\ACDSeeShowroomShortc_B2D418833BFC4BA0A2F65A2C9836C238.exe
+ 2008-12-09 13:34:49 81,920 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\ACDSeeShowroomShortc_B2D418833BFC4BA0A2F65A2C9836C238.exe
- 2008-11-11 16:29:48 201,583 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\DevDetectPMShortcut_ECE0113B23D04DD889E6D2F026CABF03.exe
+ 2008-12-09 13:34:49 45,056 ----a-w c:\windows\Installer\{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}\DevDetectPMShortcut_ECE0113B23D04DD889E6D2F026CABF03.exe
+ 2008-12-08 22:50:10 18,944 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-12-08 22:50:10 65,024 ----a-r c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
- 2004-08-03 21:56:44 2,804,224 -c--a-w c:\windows\system32\dllcache\msi.dll
+ 2005-05-04 11:45:32 2,890,240 -c--a-w c:\windows\system32\dllcache\msi.dll
- 2004-08-03 21:56:54 77,312 -c--a-w c:\windows\system32\dllcache\msiexec.exe
+ 2005-05-04 11:45:36 78,848 -c--a-w c:\windows\system32\dllcache\msiexec.exe
- 2004-08-03 21:56:44 331,264 -c--a-w c:\windows\system32\dllcache\msihnd.dll
+ 2005-05-04 11:45:36 271,360 -c--a-w c:\windows\system32\dllcache\msihnd.dll
- 2004-08-03 21:56:18 884,736 -c--a-w c:\windows\system32\dllcache\msimsg.dll
+ 2005-05-04 11:45:36 884,736 -c--a-w c:\windows\system32\dllcache\msimsg.dll
- 2004-08-03 21:56:44 44,032 -c--a-w c:\windows\system32\dllcache\msisip.dll
+ 2005-05-04 11:45:36 15,360 -c--a-w c:\windows\system32\dllcache\msisip.dll
+ 2008-07-08 10:54:02 148,496 ----a-w c:\windows\system32\drivers\
04459951.sys
- 2004-08-03 21:56:44 2,804,224 ----a-w c:\windows\system32\msi.dll
+ 2005-05-04 11:45:32 2,890,240 ----a-w c:\windows\system32\msi.dll
- 2004-08-03 21:56:54 77,312 ----a-w c:\windows\system32\msiexec.exe
+ 2005-05-04 11:45:36 78,848 ----a-w c:\windows\system32\msiexec.exe
- 2004-08-03 21:56:44 331,264 ----a-w c:\windows\system32\msihnd.dll
+ 2005-05-04 11:45:36 271,360 ----a-w c:\windows\system32\msihnd.dll
- 2004-08-03 21:56:18 884,736 ----a-w c:\windows\system32\msimsg.dll
+ 2005-05-04 11:45:36 884,736 ----a-w c:\windows\system32\msimsg.dll
- 2004-08-03 21:56:44 44,032 ----a-w c:\windows\system32\msisip.dll
+ 2005-05-04 11:45:36 15,360 ----a-w c:\windows\system32\msisip.dll
- 2008-12-06 12:35:53 40,326 ----a-w c:\windows\system32\perfc009.dat
+ 2008-12-10 12:24:01 40,326 ----a-w c:\windows\system32\perfc009.dat
- 2008-12-06 12:35:53 311,938 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-10 12:24:01 311,938 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-10 13:35:12 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4b0.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [11/17/2008 03:11 PM 1805552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [08/03/2004 10:32 PM 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/03/2004 10:32 PM 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/03/2004 10:32 PM 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [09/18/2007 10:29 PM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [09/18/2007 10:29 PM 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [09/18/2007 10:29 PM 137752]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [01/12/2007 02:36 PM 827392]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [11/13/2008 11:48 AM 136600]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [02/07/2007 04:24 PM 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [12/09/2008 03:23 PM 54832]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM 31016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/13/2008 06:09 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-04-28 415072]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [05/13/2008 09:13 AM 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
07/23/2008 03:28 PM 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
R1 is-7CBUGdrv;is-7CBUGdrv;c:\windows\system32\DRIVERS\
04459951.sys [2008-12-09 01:52:25 148496]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-11-13 15424]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-11-17 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024]
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\c:\program files\CyberLink\PowerDVD\
000.fcl [2006-11-02 16:51:58 13560]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46ea3d02-b15e-11dd-9e0f-001cbf7a76f6}]
\Shell\AutoRun\command - F:\x.bat
\Shell\explore\Command - F:\x.bat
\Shell\open\Command - F:\x.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46ea3d03-b15e-11dd-9e0f-001cbf7a76f6}]
\Shell\AutoRun\command - G:\xih9.cmd
\Shell\explore\Command - G:\xih9.cmd
\Shell\open\Command - G:\xih9.cmd
.
s of the 'Scheduled Tasks' folder
2008-12-10 c:\windows\Tasks\A53C6B0691B41C02.job
- c:\docume~1\welcome\applic~1\proxyf~1\second win help.exe []
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = hxxp://codecs.r8.org/
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-10 16:35:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\
000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(848)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'lsass.exe'(904)
c:\windows\system32\imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ESET\nod32krn.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 12/10/2008 16:36:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-10 13:36:38
ComboFix2.txt 2008-12-06 14:29:48
Pre-Run: 33,634,447,360 bytes free
Post-Run: 33,824,755,712 bytes free
256
