ComboFix 09-03-10.03 - user 03/13/2009 2:13:03.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.2046.1617 [GMT 3:00]
Running from: c:\documents and settings\user\My Documents\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\cmsetac.dll
c:\windows\IE4 Error Log.txt
c:\windows\KB8888239.log
c:\windows\mstwain32.exe
c:\windows\ntdtcstp.dll
c:\windows\OPTIONS\CABS\_desktop.ini
c:\windows\system32\dumphive.exe
c:\windows\system32\Process.exe
c:\windows\system32\pthreadGC2.dll
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((( Files Created from 2009-02-12 to 2009-03-12 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-12 17:24 32 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-03-12 17:24 32 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-03-12 17:24 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-12 17:24 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-12 14:37 --------- d-----w c:\documents and settings\user\Application Data\Malwarebytes
2009-03-12 14:37 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-12 12:22 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-12 10:20 --------- d-----w c:\program files\Okoker Delete
2009-03-11 13:49 --------- d-----w c:\documents and settings\user\Application Data\U3
2009-03-05 11:30 --------- d-----w c:\program files\AskBarDis
2009-02-28 05:11 --------- d-----w c:\program files\Paltalk Messenger
2009-02-25 04:40 --------- d-----w c:\program files\Any Audio Converter
2009-02-19 02:08 --------- d-----w c:\program files\AskPBar
2009-02-19 00:14 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-18 10:34 --------- d-----w c:\program files\GoldWave
2009-02-17 05:04 --------- d-----w c:\program files\ProPoster
2009-02-17 04:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-17 04:33 --------- d-----w c:\program files\Poster Forge
2009-02-17 00:41 --------- d-----w c:\program files\Smallvideosoft
2009-02-09 10:19 1,846,272 ----a-w c:\windows\system32\win32k.sys
2009-02-02 11:30 --------- d-----w c:\program files\MSXML 6.0
2009-02-01 21:50 --------- d-----w c:\program files\Foxit Software
2009-02-01 21:17 --------- d-----w c:\program files\Microsoft Virtual PC
2009-02-01 03:38 --------- d-----w c:\documents and settings\user\Application Data\Reallusion
2009-02-01 03:05 --------- d-----w c:\program files\DCETools
2009-01-30 11:29 --------- d-----w c:\program files\Program Files
2009-01-27 19:51 --------- d-----w c:\documents and settings\user\Application Data\Paltalk
2009-01-21 14:22 --------- d-----w c:\program files\BandRich
2009-01-20 16:50 --------- d-----w c:\program files\Liatro
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
2008-12-20 10:32 74,459 ----a-w c:\windows\Uninstal.exe
2008-12-19 12:41 344,591 ----a-w c:\windows\logo.exe
2008-05-28 13:23 233 ----a-w c:\program files\Irdeto.txt
2008-05-28 13:23 15,609 ----a-w c:\program files\Aes.txt
.
------- Sigcheck -------
04/14/2008 03:12 AM 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\svchost.exe
08/04/2004 03:56 AM 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\svchost.exe
08/04/2004 03:56 AM 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\dllcache\svchost.exe
04/14/2008 03:12 AM 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ws2_32.dll
08/04/2004 03:56 AM 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\ws2_32.dll
08/04/2004 03:56 AM 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\dllcache\ws2_32.dll
04/14/2008 03:12 AM 507904 ed0ef0a136dec83df69f04118870003e c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
08/04/2004 03:56 AM 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\winlogon.exe
08/04/2004 03:56 AM 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\dllcache\winlogon.exe
04/13/2008 10:20 PM 182656 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ndis.sys
08/04/2004 02:14 AM 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys
08/04/2004 02:14 AM 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys
04/13/2008 09:53 PM 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ip6fw.sys
08/04/2004 02:00 AM 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\dllcache\ip6fw.sys
08/04/2004 02:00 AM 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys
04/14/2008 03:12 AM 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\services.exe
08/04/2004 03:56 AM 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\services.exe
08/04/2004 03:56 AM 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\dllcache\services.exe
04/14/2008 03:12 AM 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lsass.exe
08/04/2004 03:56 AM 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\lsass.exe
08/04/2004 03:56 AM 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\dllcache\lsass.exe
04/14/2008 03:12 AM 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ctfmon.exe
08/04/2004 03:56 AM 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\ctfmon.exe
08/04/2004 03:56 AM 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\dllcache\ctfmon.exe
04/14/2008 03:12 AM 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
08/04/2004 03:56 AM 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\userinit.exe
08/04/2004 03:56 AM 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\dllcache\userinit.exe
04/14/2008 03:12 AM 295424 ff3477c03be7201c294c35f684b3479f c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\termsrv.dll
08/04/2004 03:56 AM 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\system32\termsrv.dll
08/04/2004 03:56 AM 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\system32\dllcache\termsrv.dll
04/14/2008 03:12 AM 17408 50a166237a0fa771261275a405646cc0 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\powrprof.dll
08/04/2004 03:56 AM 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\system32\powrprof.dll
08/04/2004 03:56 AM 17408 1b5f6923abb450692e9fe0672c897aed c:\windows\system32\dllcache\powrprof.dll
04/14/2008 03:11 AM 110080 0da85218e92526972a821587e6a8bf8f c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\imm32.dll
08/04/2004 03:56 AM 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\system32\imm32.dll
08/04/2004 03:56 AM 110080 87ca7ce6469577f059297b9d6556d66d c:\windows\system32\dllcache\imm32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
08/06/2008 03:20 PM 279944 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [08/06/2008 03:20 PM 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [08/06/2008 03:20 PM 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [10/13/2004 07:24 PM 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [05/02/2006 03:51 PM 3334144]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [08/11/2006 04:43 PM 7630848]
"SNPSTD2"="c:\windows\vsnpstd2.exe" [06/10/2004 11:54 AM 286720]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [08/11/2006 04:43 PM 86016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/12/2008 03:55 PM 185896]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/15/2008 01:04 AM 39792]
"SMSERIAL"="sm56hlpr.exe" [12/29/2004 01:01 AM 544768 c:\windows\sm56hlpr.exe]
"RTHDCPL"="RTHDCPL.EXE" [04/12/2007 12:33 PM 16132608 c:\windows\RTHDCPL.exe]
"nwiz"="nwiz.exe" [08/11/2006 04:43 PM 1519616 c:\windows\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 12:56 AM 110592 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
c:\documents and settings\user\Start Menu\Programs\Startup\
PalNetaware.lnk - c:\paltalka\pnetaware.exe [2009-01-27 26112]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-01 113664]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-01-28 10950144]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= F:\l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 10/15/2008 01:04 AM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
-ra------ 04/20/2007 08:57 AM 162584 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
-ra------ 04/20/2007 08:57 AM 142104 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
-ra------ 04/20/2007 08:57 AM 138008 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 11/02/2004 08:24 PM 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VGAUtil]
--a------ 01/02/2007 10:22 AM 544768 c:\program files\GIGABYTE\VGA Utility Manager\G-VGA.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows]
--ah----- 09/28/2007 05:15 PM 98304 c:\windows\system32\shell23.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 05/02/2006 03:51 PM 3334144 c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GIGABYTE\\VGA Utility Manager\\G-VGA.exe"=
"c:\\Program Files\\GIGABYTE\\VGA Utility Manager\\gvupdate.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\PaltalkA\\Paltalk.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\english\\setup.exe"=
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys --> c:\windows\system32\DRIVERS\br3gmdm.sys [?]
S3 DtvAudio;DtvAudio;c:\windows\system32\drivers\DtvAudio.sys [2008-10-25 22441]
S3 DtvVideo;DtvVideo;c:\windows\system32\drivers\DtvVideo.sys [2008-10-25 19171]
S3 GPCIDrv;GPCIDrv;c:\windows\GPCIDrv.sys [2008-02-15 5112]
S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2007-10-23 17962]
S3 PRODIGY;PRODIGY;c:\windows\system32\drivers\prodigy.sys [2008-03-13 32377]
S3 VPNET;DTVNet DVB Ethernet Controller;c:\windows\system32\drivers\DTVNet.sys [2008-10-25 26624]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16a975f4-f3a3-11dd-a638-001d7d986880}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4da1f14b-729c-11dd-a2ab-001d7d986880}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{614862f9-8389-11dd-a329-001d7d986880}]
\Shell\Auto\command - sunny.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sunny.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e925e8b-2014-11dd-82d2-001d7d986880}]
\Shell\AutoRun\command - I:\LaunchU3.exe -a
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E0FC152E-8150-AB80-28AF-ADA150CD266C}]
c:\windows\logo.exe
.
*******s of the 'Scheduled Tasks' folder
2009-03-12 c:\windows\Tasks\User_Feed_Synchronization-{01D75432-6FF4-41B8-AF8A-F92C3F2C3D59}.job
- c:\windows\system32\msfeedssync.exe [08/13/2007 06:36 PM]
2009-03-06 c:\windows\Tasks\ZDelete Auto-Cleaner.job
- c:\program files\LSoft Technologies\Active ZDelete\ZDelete.exe []
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-NI - e:\جوال\installer_en.exe
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-13 02:15:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioInput\TokenEnums\MMAudioIn\ *3,JD *.7 *'DEH/E *#*0*\Attributes]
"Vendor"="Microsoft"
"Technology"="MMSys"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioInput\TokenEnums\MMAudioIn\ *3,JD *.7 *'DEH/E *#*0*\UI\AudioProperties]
******"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioInput\TokenEnums\MMAudioIn\ *3,JD *.7 *'DEH/E *#*0*\UI\AudioVolume]
******"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioInput\TokenEnums\MMAudioIn\ *3,JD *.7 *'DEH/E *#*1*\Attributes]
"Vendor"="Microsoft"
"Technology"="MMSys"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioInput\TokenEnums\MMAudioIn\ *3,JD *.7 *'DEH/E *#*1*\UI\AudioProperties]
******"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioInput\TokenEnums\MMAudioIn\ *3,JD *.7 *'DEH/E *#*1*\UI\AudioVolume]
******"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\ B1'!) *.7 *'DEH/E *#*0*\Attributes]
"Vendor"="Microsoft"
"Technology"="MMSys"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\ B1'!) *.7 *'DEH/E *#*0*\UI\AudioVolume]
******"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\ B1'!) *.7 *'DEH/E *#*1*\Attributes]
"Vendor"="Microsoft"
"Technology"="MMSys"
[HKEY_USERS\S-1-5-21-1202660629-179605362-839522115-1003\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\ B1'!) *.7 *'DEH/E *#*1*\UI\AudioVolume]
******"="{364D8E0B-67CB-4547-9948-9E7F1B1743ED}"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(864)
c:\windows\system32\antiwpa.dll
.
Completion time: 03/13/2009 2:17:49
ComboFix-quarantined-files.txt 2009-03-12 23:17:17
Pre-Run: 3,769,700,352 bytes free
Post-Run: 3,840,102,400 bytes free
256 --- E O F --- 2009-03-11 17:17:10Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:22:11 ص, on 13/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\PaltalkA\pnetaware.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\user\My Documents\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PalNetaware.lnk = C:\PaltalkA\pnetaware.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5501 bytes
