ComboFix 09-03-13.02 - turkey 03/15/2009 0:22:23.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.446.186 [GMT 3:00]
Running from: c:\documents and settings\turkey\My Documents\Downloads\Programs\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\npf.sys
c:\windows\system32\packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2009-02-14 to 2009-03-14 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-14 16:10 --------- d-----w c:\program files\IDETOOL
2009-03-14 16:04 --------- d-----w c:\program files\VIA
2009-03-14 15:36 --------- d-----w c:\program files\S3
2009-03-14 15:30 --------- d-----w c:\program files\ma-config.com
2009-03-14 15:30 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-03-13 18:04 --------- d-----w c:\program files\WinPcap
2009-03-13 18:03 --------- d-----w c:\program files\Net Tools
2009-03-13 17:37 --------- d-----w c:\program files\Internet Download Manager
2009-03-13 17:37 --------- d-----w c:\documents and settings\turkey\Application Data\IDM
2009-03-13 12:36 --------- d-----w c:\documents and settings\turkey\Application Data\ooVoo Details
2009-03-11 09:24 --------- d-----w c:\documents and settings\turkey\Application Data\Malwarebytes
2009-03-11 09:24 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-10 14:10 --------- d-----w c:\program files\FlashGet
2009-03-08 05:40 603,904 ----a-w c:\windows\system32\TUProgSt.exe
2009-03-08 05:40 360,192 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-03-08 05:23 --------- d-----w c:\documents and settings\turkey\Application Data\Avira
2009-03-08 05:21 --------- d-----w c:\program files\Avira
2009-03-08 05:21 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-03-08 04:34 --------- d-----w c:\documents and settings\turkey\Application Data\TuneUp Software
2009-03-08 04:33 --------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-03-08 04:33 --------- d-----w c:\program files\TuneUp Utilities 2009
2009-03-08 04:33 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-03-06 20:51 --------- d-----w c:\program files\LtUcx
2009-03-05 15:16 --------- d-sh--w c:\program files\Common Files\WindowsLiveInstaller
2009-03-05 15:15 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-03-05 13:22 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-05 13:21 --------- d-----w c:\program files\Messenger Plus! Live
2009-03-05 13:19 --------- d-----w c:\program files\Windows Live
2009-03-05 13:05 --------- d-----w c:\program files\Common Files\Windows Live
2009-03-05 12:26 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-03-05 12:07 --------- d-----w c:\program files\BS.Player ControlBar
2009-03-05 12:06 --------- d-----w c:\program files\Webteh
2009-03-05 12:06 --------- d-----w c:\documents and settings\turkey\Application Data\BSplayer Pro
2009-03-05 12:06 --------- d-----w c:\documents and settings\turkey\Application Data\BSplayer
2009-03-05 12:00 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-03-05 11:52 --------- d-----w c:\documents and settings\turkey\Application Data\Symantec
2009-03-05 11:50 --------- d-----w c:\program files\Norton 360
2009-03-05 11:48 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-03-05 11:47 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-05 11:43 --------- d-----w c:\documents and settings\turkey\Application Data\DMCache
2009-03-05 11:39 --------- d-----w c:\program files\Common Files\xing shared
2009-03-05 11:39 --------- d-----w c:\program files\Common Files\Adobe
2009-03-05 11:38 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-03-05 11:38 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-03-05 11:38 --------- d-----w c:\program files\Real
2009-03-05 11:38 --------- d-----w c:\program files\Common Files\Real
2009-03-05 11:14 --------- d-----w c:\program files\JPEG Camera
2009-03-05 11:10 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-05 11:10 --------- d-----w c:\program files\Creative
2009-03-05 11:10 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-05 10:52 --------- d-----w c:\program files\microsoft frontpage
2009-02-09 14:04 1,846,656 ----a-w c:\windows\system32\win32k.sys
2009-02-09 14:04 1,846,656 ------w c:\windows\system32\dllcache\win32k.sys
2009-01-16 18:01 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-20 22:30 63,488 ------w c:\windows\system32\dllcache\icardie.dll
2008-12-20 22:30 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll
2008-12-20 22:30 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll
2008-12-20 22:30 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll
2008-12-20 22:30 347,136 ------w c:\windows\system32\dllcache\dxtmsft.dll
2008-12-20 22:30 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll
2008-12-20 22:30 214,528 ------w c:\windows\system32\dllcache\dxtrans.dll
2008-12-20 22:30 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll
2008-12-20 22:30 133,120 ------w c:\windows\system32\dllcache\extmgr.dll
2008-12-20 22:30 124,928 ------w c:\windows\system32\dllcache\advpack.dll
2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-12-19 09:08 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2003-01-07 11:53 49,152 ----a-w c:\program files\owcsetup.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 09:29 PM 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [10/28/2008 02:39 PM 2606512]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [09/17/2003 10:43 AM 57344]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [03/05/2009 02:38 PM 185896]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [06/12/2008 01:28 PM 266497]
"VTTimer"="VTTimer.exe" [09/21/2006 04:36 PM 53248 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [08/27/2007 07:03 PM 200704 c:\windows\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [08/03/2006 12:12 AM 577536 c:\windows\SOUNDMAN.EXE]
"PCTVOICE"="pctspk.exe" [10/30/2003 08:12 AM 180224 c:\windows\system32\pctspk.exe]
"PV92TRAY"="PV92Tray.exe" [10/30/2003 12:09 PM 323584 c:\windows\system32\PV92Tray.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 09:29 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
R0 viadsk;viadsk;c:\windows\system32\drivers\viadsk.sys [2003-06-19 56576]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2009-03-08 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avwebgrd.exe [2009-03-08 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2009-03-08 41217]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-03-08 603904]
R2 VRAID Log Service;VRAID Log Service;c:\program files\VIA\RAID\vialogsv.exe [2009-03-14 52888]
S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;c:\windows\system32\drivers\cam1690.sys [2007-08-29 153344]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-01-24 216232]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ec8a396-0979-11de-af6a-0019db695e57}]
\Shell\AutoRun\command - WDSetup.exe
.
*******s of the 'Scheduled Tasks' folder
2009-03-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [12/11/2008 09:36 PM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
LSP: avsda.dll
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://voice.hostmaas.com:1999/ReadUid.CAB
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://76.76.24.68/imscp/talks3n.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-15 00:25:06
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVIRA\ANTIVIR PERSONALEDITION PREMIUM\SCHED.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION PREMIUM\AVGUARD.EXE
c:\windows\SYSTEM32\CTSVCCDA.EXE
.
**************************************************************************
.
Completion time: 03/15/2009 0:26:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-14 21:26:02
Pre-Run: 5,783,207,936 bytes free
Post-Run: 5,870,862,336 bytes free
178 --- E O F --- 2009-03-11 18:28:29
