ComboFix 08-12-17.01 - xp 12/18/2008 13:31:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.1015.670 [GMT 3:00]
Running from: c:\documents and settings\xp\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\IE4 Error Log.txt
c:\windows\svchost.ini
.
((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 23:06 --------- d-----w c:\program files\A360
2008-12-17 22:15 --------- d-----w c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
2008-12-12 11:39 --------- d-----w c:\program files\Common Files\ACD Systems
2008-12-08 10:38 --------- d-----w c:\documents and settings\xp\Application Data\Thinstall
2008-10-26 10:19 --------- d-----w c:\program files\Google
2008-10-23 08:16 --------- d-----w c:\program files\TechSmith
2008-10-22 15:01 --------- d-----w c:\program files\VideoLAN
2008-10-16 11:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 11:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 11:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 11:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 11:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 11:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 11:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 11:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-09 06:06 155,995 ----a-w c:\windows\java\Packages\ISPRJTFB.ZIP
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
07/17/2008 05:20 PM 279944 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [07/17/2008 05:20 PM 279944]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [07/17/2008 05:20 PM 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [12/31/2002 03:00 PM 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [03/27/2008 05:20 PM 102400]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [03/20/2008 12:52 PM 544768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [10/08/2006 08:11 AM 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [10/08/2006 08:13 AM 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [10/08/2006 08:10 AM 94208]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [04/24/2008 09:45 AM 335872]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [08/28/2008 02:31 PM 185896]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [11/26/2006 09:30 PM 97357]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [05/12/2008 07:39 PM 79224]
"RTHDCPL"="RTHDCPL.EXE" [03/06/2008 12:14 PM 16858112 c:\windows\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 01:43 PM 69632 c:\windows\Alcmtr.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [12/31/2002 03:00 PM 110592 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [12/31/2002 03:00 PM 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoColorChoice"= 0 (0x0)
"NoSizeChoice"= 0 (0x0)
"NoVisualStyleChoice"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceActiveDesktopOn"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-04 77904]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-10-04 20560]
R2 BandLuxe_Service;BandLuxe Service;"c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe" -e [2008-05-12 87264]
R3 AsusACPI;ASUS ACPI Driver;c:\windows\system32\DRIVERS\ASUSACPI.sys [2008-08-28 11264]
R3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\DRIVERS\l251x86.sys [2008-08-28 30720]
R3 Ktp;Elantech Smart-Pad;c:\windows\system32\DRIVERS\ETD.sys [2008-08-28 26112]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys [2008-09-06 100096]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5270400c-7666-11dd-a5f1-0015af93bc83}]
\Shell\AutoRun\command - 8uot.exe
\Shell\explore\Command - 8uot.exe
\Shell\open\Command - 8uot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a155db76-79b6-11dd-a5f7-0015af93bc83}]
\Shell\AutoRun\command - F:\AutoRun.exe
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.zyzoom.org/vb/showthread.php?p=691825#post691825
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-18 13:35:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\docume~1\xp\LOCALS~1\Temp\Perflib_Perfdata_5a8.dat
scan completed successfully
hidden files: 1
**************************************************************************
.
Completion time: 12/18/2008 13:37:31
ComboFix-quarantined-files.txt 2008-12-18 10:36:51
Pre-Run: 12,994,461,696 bytes free
Post-Run: 13,007,007,744 bytes free
124
