ComboFix 09-02-25.02 - xp 02/26/2009 20:04:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.351.121 [GMT 3:00]
Running from: c:\documents and settings\xp\سطح المكتب\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\__c002D0D4.dat
c:\windows\system32\__c0068A4E.exe
c:\windows\system32\aguwomem.ini
c:\windows\system32\ahosudew.ini
c:\windows\system32\akisuhob.ini
c:\windows\system32\akusolur.ini
c:\windows\system32\amoburis.ini
c:\windows\system32\anusebey.ini
c:\windows\system32\aqucun.dll
c:\windows\system32\ateboron.ini
c:\windows\system32\atozikun.ini
c:\windows\system32\azadagel.ini
c:\windows\system32\besigaza.dll
c:\windows\system32\bevozeti.dll
c:\windows\system32\bezizipu.dll
c:\windows\system32\botapepe.dll
c:\windows\system32\budaluyo.dll
c:\windows\system32\bujokatu.dll
c:\windows\system32\dabaliru.dll
c:\windows\system32\davagadu.dll
c:\windows\system32\dehehoji.dll
c:\windows\system32\deporare.dll
c:\windows\system32\dezogewi.dll
c:\windows\system32\digeste.dll
c:\windows\system32\durifesu.dll
c:\windows\system32\duyovaha.dll
c:\windows\system32\eberutum.ini
c:\windows\system32\edelulej.ini
c:\windows\system32\edohezaj.ini
c:\windows\system32\egirazak.ini
c:\windows\system32\egumarar.ini
c:\windows\system32\ekanugaf.ini
c:\windows\system32\ekisibaf.ini
c:\windows\system32\elihegof.ini
c:\windows\system32\eluloyum.ini
c:\windows\system32\eripijid.ini
c:\windows\system32\esunodey.ini
c:\windows\system32\etejulin.ini
c:\windows\system32\evafinom.ini
c:\windows\system32\evorelit.ini
c:\windows\system32\ewoyiluj.ini
c:\windows\system32\fipuyuko.dll
c:\windows\system32\firovopa.dll
c:\windows\system32\gelapele.dll.tmp
c:\windows\system32\gerogije.dll
c:\windows\system32\gipekoji.dll
c:\windows\system32\gitisowe.dll
c:\windows\system32\gitoribo.dll
c:\windows\system32\givinoye.dll
c:\windows\system32\gokqhh.dll
c:\windows\system32\goyukuyu.dll
c:\windows\system32\honayoto.dll
c:\windows\system32\hulubera.dll
c:\windows\system32\ighrer.dll
c:\windows\system32\ihifepel.ini
c:\windows\system32\ijiroyaj.ini
c:\windows\system32\ikudurey.ini
c:\windows\system32\ilubugih.ini
c:\windows\system32\inafehoy.ini
c:\windows\system32\ipiwibuk.ini
c:\windows\system32\ipomunoh.ini
c:\windows\system32\ipubebow.ini
c:\windows\system32\isowepej.ini
c:\windows\system32\itizehel.ini
c:\windows\system32\iwufegij.ini
c:\windows\system32\jagepeyu.dll
c:\windows\system32\jayoriji.dll
c:\windows\system32\jelulede.dll
c:\windows\system32\jifetahi.dll
c:\windows\system32\juwefisi.dll
c:\windows\system32\kakle.dll
c:\windows\system32\kekuveka.dll
c:\windows\system32\kipelebi.dll
c:\windows\system32\kisukipe.dll
c:\windows\system32\kofusipo.dll
c:\windows\system32\kubiwipi.dll
c:\windows\system32\kujonuva.dll
c:\windows\system32\kutotoho.dll
c:\windows\system32\kuvarilo.dll
c:\windows\system32\laponino.dll
c:\windows\system32\lidanufu.dll
c:\windows\system32\ligalijo.dll
c:\windows\system32\lokegepe.dll.tmp
c:\windows\system32\madubiha.dll
c:\windows\system32\memowuga.dll
c:\windows\system32\movulohu.dll
c:\windows\system32\muguvora.dll
c:\windows\system32\muturebe.dll
c:\windows\system32\muyolule.dll
c:\windows\system32\nahiyuku.dll
c:\windows\system32\nanulote.dll
c:\windows\system32\natulevo.dll
c:\windows\system32\nelufuyu.dll
c:\windows\system32\nuretuze.dll
c:\windows\system32\nusayuta.dll
c:\windows\system32\obirotig.ini
c:\windows\system32\ogurafuy.ini
c:\windows\system32\ohijawim.ini
c:\windows\system32\ojapuwuv.ini
c:\windows\system32\ojihemuv.ini
c:\windows\system32\operabem.ini
c:\windows\system32\opisufok.ini
c:\windows\system32\ososajev.ini
c:\windows\system32\ovovomem.ini
c:\windows\system32\pakurowe.dll
c:\windows\system32\pddnri.dll
c:\windows\system32\pehuraba.dll
c:\windows\system32\petipado.dll
c:\windows\system32\pisiluvu.dll
c:\windows\system32\pisuvedi.dll
c:\windows\system32\pubulasi.dll
c:\windows\system32\puwisuro.dll
c:\windows\system32\pykftz.dll
c:\windows\system32\ravoruna.dll
c:\windows\system32\regizogu.dll
c:\windows\system32\rehenano.dll
c:\windows\system32\ribemago.dll
c:\windows\system32\ririzaki.dll
c:\windows\system32\rulosuka.dll
c:\windows\system32\sedehobi.dll
c:\windows\system32\seyohale.dll
c:\windows\system32\sowemame.dll
c:\windows\system32\sujuwido.dll
c:\windows\system32\tadagagu.dll.tmp
c:\windows\system32\teniveba.dll
c:\windows\system32\titeyota.dll
c:\windows\system32\tiworita.dll
c:\windows\system32\ubigasew.ini
c:\windows\system32\udefinaj.ini
c:\windows\system32\ufayimod.ini
c:\windows\system32\ufuzezus.ini
c:\windows\system32\ulokufiw.ini
c:\windows\system32\uzejaguf.ini
c:\windows\system32\vamibedi.dll.tmp
c:\windows\system32\vedilune.dll
c:\windows\system32\vupewoka.dll
c:\windows\system32\vusumuje.dll
c:\windows\system32\wjwbms.dll
c:\windows\system32\wobebupi.dll
c:\windows\system32\yagayaye.dll
c:\windows\system32\yizimife.dll
c:\windows\system32\yuniyuzi.dll
c:\windows\system32\zabunego.dll
c:\windows\system32\zayezeru.dll
c:\windows\system32\zizaduvu.dll
c:\windows\system32\zoyageze.dll
c:\windows\system32\zumijasa.dll.tmp
c:\windows\system32\zusidebi.dll
c:\windows\wiaserviv.log
C:\xcrashdump.dat
----- BITS: Possible infected sites -----
hxxp://77.74.48.101
hxxp://77.74.48.105
.
((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 17:12 231,385,120 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-26 17:12 2,625,152 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-02-26 15:39 --------- d-----w c:\documents and settings\xp\Application Data\Orbit
2009-02-26 15:32 2,560 ----a-w c:\windows\_MSRSTRT.EXE
2009-02-26 15:32 --------- d-----w c:\program files\Hotspot_Shield
2009-02-26 15:25 --------- d-----w c:\documents and settings\xp\Application Data\cleaner
2009-02-24 18:41 1,598,818 --sh--w c:\windows\system32\ewenewop.tmp
2009-02-24 06:42 1,597,440 ----a-w c:\windows\system32\ojapuwuv.tmp
2009-02-23 04:31 4,992 --sh--w c:\windows\system32\pozofohu.exe
2009-02-22 14:05 --------- d-----w c:\program files\Play89
2009-02-22 12:39 --------- d-----w c:\documents and settings\xp\Application Data\U3
2009-02-21 18:39 --------- d-----w c:\documents and settings\xp\Application Data\CyberScrub
2009-02-20 07:02 1,560,576 ----a-w c:\windows\system32\evorelit.tmp
2009-02-14 21:42 --------- d-----w c:\program files\LtUcx
2009-02-05 21:55 31,704 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-01-25 17:06 --------- d-----w c:\program files\Common Files\Adobe
2009-01-25 17:03 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-25 17:03 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-21 13:47 --------- d-----w c:\program files\AskSearch
2009-01-21 13:18 --------- d-----w c:\program files\Paltalk Messenger
2009-01-21 13:18 --------- d-----w c:\documents and settings\xp\Application Data\Paltalk
2009-01-21 05:21 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-01-21 05:12 --------- d-----w c:\program files\Conduit
2009-01-21 05:11 --------- d-----w c:\documents and settings\xp\Application Data\Media Player Classic
2009-01-20 19:50 --------- d-----w c:\program files\ESET
2009-01-20 19:50 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-01-20 19:49 --------- d-----w c:\program files\Windows Media Connect 2
2009-01-20 19:48 90,112 ----a-w c:\windows\system32\agsaami.dll
2009-01-20 19:48 610,304 ----a-w c:\windows\system32\agsaamg.dll
2009-01-20 19:48 372,736 ----a-w c:\windows\system32\agsaamc.dll
2009-01-20 19:48 2,535,424 ----a-w c:\windows\system32\agsaamj.dll
2009-01-20 19:48 196,608 ----a-w c:\windows\system32\maag.dll
2009-01-20 19:48 1,986,560 ----a-w c:\windows\system32\akll.dll
2009-01-20 19:48 1,245,184 ----a-w c:\windows\system32\bkll.dll
2009-01-20 19:48 1,212,416 ----a-w c:\windows\system32\ckll.dll
2009-01-20 19:48 --------- d-----w c:\program files\Real_SC
2009-01-20 19:47 --------- d-----w c:\program files\Ringz Studio
2009-01-20 19:46 --------- d-----w c:\program files\CyberLink
2009-01-20 19:44 --------- d-----w c:\program files\Windows Live
2009-01-20 19:44 --------- d-----w c:\program files\MSN Messenger
2009-01-20 19:44 --------- d-----w c:\program files\Messenger Plus! Live
2009-01-20 19:44 --------- d-----w c:\program files\Circle Developement
2009-01-20 19:43 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-20 19:43 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-20 19:43 --------- d-----w c:\program files\Real
2009-01-20 19:43 --------- d-----w c:\program files\Common Files\xing shared
2009-01-20 19:43 --------- d-----w c:\program files\Common Files\Real
2009-01-20 19:41 --------- d-----w c:\program files\GRETECH
2009-01-20 19:41 --------- d-----w c:\documents and settings\xp\Application Data\GRETECH
2009-01-20 19:41 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-01-20 19:37 --------- d-----w c:\program files\Golden Al-Wafi Translator
2009-01-20 19:36 73,216 ----a-w c:\windows\ST6UNST.EXE
2009-01-20 19:36 172,032 ------w c:\windows\Setup1.exe
2009-01-20 19:36 155,995 ----a-w c:\windows\java\Packages\X7F7Z35N.ZIP
2009-01-20 19:35 --------- d-----w c:\documents and settings\xp\Application Data\Ashampoo
2009-01-20 19:35 --------- d-----w c:\documents and settings\All Users\Application Data\ashampoo
2009-01-20 19:09 --------- d-----w c:\program files\Microsoft.NET
2009-01-20 19:08 --------- d-----w c:\program files\Microsoft Works
2009-01-20 18:57 --------- d-----w c:\program files\microsoft frontpage
1601-01-01 00:12 4,992 --sha-w c:\windows\system32\gehuseda.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [01/20/2009 10:42 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"vidc.vp31"= vp31vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Orbit.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 10:16 PM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
--a------ 02/20/2008 11:06 AM 1443072 c:\program files\ESET\ESET NOD32 Antivirus\egui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 04/13/2006 11:09 AM 49152 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 08/04/2004 01:09 AM 1667584 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 12/07/2005 10:57 PM 30208 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
--a------ 03/24/2005 03:52 PM 94770 c:\program files\Ringz Studio\Storm Codec\StormSet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 01/20/2009 10:42 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2009-01-27 13696]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800]
R1 is-0VENOdrv;is-0VENOdrv;c:\windows\system32\drivers\39097747.sys [2009-02-07 148496]
R1 is-18LO5drv;is-18LO5drv;c:\windows\system32\drivers\58558859.sys [2009-02-07 148496]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [2009-02-02 31704]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95611b28-0063-11de-bd6b-00142aad83d9}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
- - - - ORPHANS REMOVED - - - -
BHO-{a249185b-a393-4812-a0b0-bae2cb9b9846} - c:\windows\system32\aqucun.dll
BHO-{eb4cbedd-4703-42d0-8e58-d5cab896e19f} - c:\windows\system32\botapepe.dll
Notify-__c002D0D4 - c:\windows\system32\__c002D0D4.dat
MSConfigStartUp-90a4d689 - c:\windows\system32\norobeta.dll
MSConfigStartUp-CPM9397e515 - c:\windows\system32\yizimife.dll
MSConfigStartUp-fuzodujehu - c:\windows\system32\fogehile.dll
MSConfigStartUp-Cmaudio - cmicnfg.cpl
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-02-26 20:14:09
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
.
**************************************************************************
.
Completion time: 02/26/2009 20:16:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-26 17:16:26
Pre-Run: 15,438,266,368 bytes free
Post-Run: 15,443,611,648 bytes free
322
