ComboFix 09-02-27.02 - Administrator 02/28/2009 14:48:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.735.361 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Administrator\Application Data\addon.dat
c:\documents and settings\All Users\Application Data\whlb32g.dll
c:\program files\Bifrost
C:\test.txt
c:\windows\msvrc20.dll
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\cbfaaf5_g.dll
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\Ultra.dll
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-01-28 to 2009-02-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 10:19 --------- d-----w c:\program files\TuneUp Utilities 2009
2009-02-28 09:24 60,560 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-02-28 09:24 4,986,912 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-28 09:24 385,056 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-02-28 09:24 3,444 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-02-28 09:06 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-02-27 23:17 --------- d-----w c:\program files\Common Files\xing shared
2009-02-27 23:16 --------- d-----w c:\program files\Real
2009-02-27 23:16 --------- d-----w c:\program files\Common Files\Real
2009-02-27 23:02 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-27 23:02 --------- d-----w c:\program files\Realtek
2009-02-27 22:07 --------- d-----w c:\program files\QuickTime
2009-02-27 22:06 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-02-27 21:55 --------- d-----w c:\program files\Apple Software Update
2009-02-27 21:55 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-27 21:34 --------- d-----w c:\documents and settings\Administrator\Application Data\cleaner
2009-02-27 20:17 --------- d-----w c:\program files\Paltalk Messenger
2009-02-27 19:28 --------- d-----w c:\documents and settings\Administrator\Application Data\Apple Computer
2009-02-27 18:43 --------- d-----w c:\program files\The KMPlayer
2009-02-27 18:09 --------- d-----w c:\program files\Nokia
2009-02-27 11:55 --------- d-----w c:\program files\Realtek AC97
2009-02-27 00:02 --------- d-----w c:\program files\Windows Live
2009-02-26 23:59 --------- d-----w c:\documents and settings\Administrator\Application Data\Skype
2009-02-26 23:58 --------- d-----w c:\documents and settings\Administrator\Application Data\skypePM
2009-02-26 23:43 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-02-26 23:19 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-02-26 23:03 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2009-02-23 14:41 --------- d-----w c:\program files\MSN Messenger
2009-02-22 17:20 --------- d-----w c:\program files\genial78
2009-02-22 16:14 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-22 16:13 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-22 16:13 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-22 14:08 --------- d-----w c:\program files\IObit
2009-02-22 12:11 --------- d-----w c:\documents and settings\Administrator\Application Data\IObit
2009-02-21 15:45 --------- d-----w c:\program files\Recovery for Access
2009-02-21 15:45 --------- d-----w c:\program files\Internet Download Manager
2009-02-21 15:45 --------- d-----w c:\program files\Ad-aware 4.0
2009-02-20 20:14 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-20 13:27 --------- d-----w c:\program files\Windows Media Connect 2
2009-02-20 12:27 319,488 ----a-w c:\windows\HideWin.exe
2009-02-20 12:27 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-19 21:13 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-02-19 21:08 --------- d-----w c:\documents and settings\All Users\Application Data\DriverCure
2009-02-19 21:07 --------- d-----w c:\documents and settings\All Users\Application Data\ParetoLogic
2009-02-19 21:07 --------- d-----w c:\documents and settings\Administrator\Application Data\DriverCure
2009-02-19 20:32 --------- d-----w c:\program files\Common Files\Skype
2009-02-19 20:32 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-02-19 20:32 --------- d-----r c:\program files\Skype
2009-02-19 13:34 --------- d-----w c:\program files\GreenBrowser
2009-02-17 14:20 --------- d-----w c:\documents and settings\Administrator\Application Data\CyberScrub
2009-02-17 14:16 --------- d-----w c:\program files\livetvbar
2009-02-17 12:25 --------- d-----w c:\program files\RegVac Registry Cleaner
2009-02-16 21:10 269 ----a-w C:\dnscache.reg
2009-02-16 20:42 65,856 ----a-w c:\windows\system32\drivers\snapman.sys
2009-02-16 20:42 37,888 ----a-w c:\windows\system32\setupnt.dll
2009-02-16 20:38 --------- d-----w c:\program files\Cimaware
2009-02-16 20:28 --------- d-----w c:\documents and settings\Administrator\Application Data\Cimaware
2009-02-16 17:50 --------- d-----w c:\program files\Yahoo!
2009-02-16 16:32 103 ----a-w C:\MemZilla2.dat
2009-02-16 16:31 273 ----a-w C:\MemZilla1.dat
2009-02-16 15:59 --------- d-----w c:\program files\Java
2009-02-16 14:26 --------- d-----w c:\program files\Jufsoft
2009-02-16 12:36 2,560 ----a-w c:\windows\_MSRSTRT.EXE
2009-02-16 12:34 --------- d-----w c:\program files\SweetIM
2009-02-15 22:10 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-15 16:41 --------- d-----w c:\documents and settings\Administrator\Application Data\Hamachi
2009-02-15 13:57 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-02-15 13:52 --------- d-----w c:\program files\CCleaner
2009-02-15 13:51 --------- d-----w c:\documents and settings\Administrator\Application Data\FileZilla
2009-02-14 23:52 --------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2009-02-14 23:05 603,904 ----a-w c:\windows\system32\TUProgSt.exe
2009-02-14 23:05 360,192 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-02-13 11:15 --------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2009-02-13 11:02 --------- d-----w c:\program files\Ashampoo
2009-02-12 14:01 --------- d-----w c:\program files\Conduit
2009-02-11 20:13 --------- d-----w c:\program files\Common Files\BitDefender
2009-02-11 20:13 --------- d-----w c:\program files\BitDefender
2009-02-11 20:12 --------- d-----w c:\program files\Reference Assemblies
2009-02-11 20:11 --------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-02-11 00:55 81,984 ----a-w c:\windows\system32\bdod.bin
2009-02-11 00:46 --------- d-----w c:\program files\Uniblue
2009-02-11 00:46 --------- d-----w c:\documents and settings\Administrator\Application Data\Uniblue
2009-02-11 00:18 --------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-02-09 09:30 --------- d-----w c:\program files\Maximum Software
2009-02-09 00:36 --------- d-----w c:\documents and settings\Administrator\Application Data\uTorrent
2009-02-09 00:36 --------- d-----w c:\documents and settings\Administrator\Application Data\Nokia Multimedia Player
2009-02-09 00:27 --------- d-----w c:\program files\IDA
2009-02-08 22:41 --------- d-----w c:\program files\Google
2009-02-08 21:55 --------- d-----w c:\program files\Boost PC
2009-02-08 21:40 --------- d-----w c:\documents and settings\Administrator\Application Data\Internet Download Accelerator
2009-02-07 22:56 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-06 19:05 --------- d-----w c:\documents and settings\Administrator\Application Data\Vbuzzer Messenger
2009-02-03 16:01 --------- d-----w c:\documents and settings\Administrator\Application Data\Online 2 fast
2009-02-01 20:06 --------- d-----w c:\program files\MSXML 4.0
2009-01-31 22:39 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2009-01-29 22:14 --------- d-----w c:\program files\DAP
2009-01-29 22:14 --------- d-----w c:\documents and settings\All Users\Application Data\SpeedBit
2009-01-29 21:54 --------- d-----w c:\documents and settings\Administrator\Application Data\Babylon
2009-01-29 11:34 --------- d-----w c:\program files\Giganology
2009-01-28 09:17 --------- d-----w c:\program files\CollageMaker
2006-02-20 05:53 2,423 --sh--r c:\windows\system32\sam\logs.dat
2005-12-31 05:49 0 --sha-r c:\windows\system32\sam\sam.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [01/20/2009 07:00 PM 1451248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [02/28/2009 02:16 AM 185872]
"PCSuiteTrayApplication"="c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [04/26/2006 08:29 AM 237568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [02/16/2009 01:10 AM 148888]
"SoundMan"="SOUNDMAN.EXE" [04/16/2007 03:28 PM 577536 c:\windows\soundman.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 12:56 AM 110592 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-01-28 10950144]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64.exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64[1].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64[2].exe]
"Debugger"=c:\windows\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\english\\setup.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9572:TCP"= 9572:TCP:BitComet 9572 TCP
"9572:UDP"= 9572:UDP:BitComet 9572 UDP
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-02-15 603904]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?]
S2 WUSB300NSvc;WUSB300NSvc;"c:\program files\Linksys\WUSB300N\WLService.exe" "WUSB300N.exe" --> c:\program files\Linksys\WUSB300N\WLService.exe [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15b20baa-9950-11dd-b9aa-0019216a4d03}]
\Shell\AutoRun\command - F:\n6t1h.cmd
\Shell\explore\Command - F:\n6t1h.cmd
\Shell\open\Command - F:\n6t1h.cmd
.
*******s of the 'Scheduled Tasks' folder
2009-02-28 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [12/11/2008 09:36 PM]
2009-02-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [07/30/2008 12:34 PM]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{F4F10C1D-87C7-404A-B4B3-000000000000} - (no file)
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
URLSearchHooks-{ad55c869-668e-457c-b270-0cfb2f61116f} - (no file)
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - (no file)
Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
Toolbar-{ad55c869-668e-457c-b270-0cfb2f61116f} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{AD55C869-668E-457C-B270-0CFB2F61116F} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Add to Vbuzzer RSS list - c:\program files\vbuzzer\addurl.htm
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: Download ALL with IDA
IE: Download with IDA
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
IE: الدليل السريع - c:\windows\ww80.html
IE: {{46012075-ED62-464b-9554-AD0BEC35D1EC} -
IE: {{46012076-ED62-464b-9554-AD0BEC35D1EC}
LSP: c:\windows\System32\mswsock2.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1212565B-AA7C-4E80-83AF-708DC6E2BD7A} - hxxp://voice2.emkanat.com/cp/files/talk5.cab
DPF: {3C8E8DD8-D86A-4E6D-AF37-AB3CA7FDF8CD} - hxxp://qtr16.talkok.com/imscp/talkc38.cab
DPF: {8C159DFD-DC9C-4077-B3B6-114A8D64B6D2} - hxxp://lan.emkanat.com/cp/files/talk3.cab
DPF: {9E45BE3C-DE06-4492-AB7D-E51447CF2ED0} - hxxp://qtr16.talkok.com/imscp/talka.cab
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://66.186.63.170/ReadUid.CAB
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://ksacam.saudi4voice.com/saudi1999/talks3n.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\d9wk47is.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - prefs.js: keyword.URL - hxxp://search.speedbit.com/searchresults.asp?src=default&q=
FF - prefs.js: network.proxy.socks - 127.0.0.1
FF - prefs.js: network.proxy.socks_port - 7070
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: *******.max.tokenizing.time - 200000
FF - user.js: *******.notify.interval - 100000
FF - user.js: *******.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-02-28 14:49:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\Administrator\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0207C13C-A327-5A28-9570-D37674C89C48}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):18,5a,89,37,05,47,5d,92,d6,ed,39,8c,3e,4f,0d,8c,19,fd,0c,ed,b1,
f4,c9,d2,6f,a5,ab,88,3a,a1,88,07,89,ac,90,4e,56,f7,29,26,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c4cc0d5e-f2ae-4d20-ae61-b26316826c87}]
@Denied: (Full) (Everyone)
"Model"=dword:0000013b
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(1432)
c:\windows\System32\mswsock2.dll
.
Completion time: 02/28/2009 14:50:52
ComboFix-quarantined-files.txt 2009-02-28 11:50:43
Pre-Run: 32,693,985,280 bytes free
Post-Run: 32,817,512,448 bytes free
411 --- E O F --- 2009-02-10 23:28:21
