combofix 09-03-26.03 - administrator 03/28/2009 0:11:22.1 - ntfsx86
microsoft windows xp professional 5.1.2600.3.1256.1.1025.18.958.648 [gmt 3:00]
running from: D:\program\combofix.exe
av: Antivir desktop *on-access scanning enabled* (updated)
* created a new restore point
warning -this machine does not have the recovery console installed !!
.
((((((((((((((((((((((((((((((((((((((( other deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\windows\ktd32.atm
c:\windows\system32\agsaame.dll
c:\windows\system32\aloaudiofile2.dll
c:\windows\system32\aloavifile.dll
c:\windows\system32\aloquicktimefile.dll
c:\windows\system32\alovideocorem.dll
c:\windows\system32\alowmafile2.dll
c:\windows\system32\kakle.dll
c:\windows\system32\ultra.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( files created from 2009-02-27 to 2009-03-27 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( find3m report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-27 21:07 --------- d-----w c:\documents and settings\administrator\application data\dmcache
2009-03-27 10:49 --------- d-----w c:\documents and settings\administrator\application data\utorrent
2009-03-27 10:39 --------- d-----w c:\program files\utorrent
2009-03-27 10:37 --------- d---a-w c:\documents and settings\all users\application data\temp
2009-03-26 12:55 --------- d-----w c:\documents and settings\administrator\application data\idm
2009-03-26 12:17 --------- d-----w c:\program files\pcbugdoctor
2009-03-26 12:13 --------- d-----w c:\documents and settings\administrator\application data\cyberscrub
2009-03-26 12:13 --------- d-----w c:\documents and settings\administrator\application data\cleaner
2009-03-25 22:47 --------- d-----w c:\documents and settings\administrator\application data\thinstall
2009-03-25 12:41 --------- d-----w c:\documents and settings\administrator\application data\gpass-4
2009-03-25 12:41 --------- d-----w c:\documents and settings\administrator\application data\gpass
2009-03-25 12:38 --------- d-----w c:\program files\no-ip
2009-03-23 21:34 --------- d-----w c:\documents and settings\all users\application data\messenger plus!
2009-03-23 15:36 --------- d-----w c:\documents and settings\administrator\application data\steady recorder
2009-03-23 12:43 --------- d-----w c:\program files\k-lite codec pack
2009-03-22 22:05 --------- d-----w c:\program files\circle developement
2009-03-22 22:05 --------- d-----w c:\documents and settings\administrator\application data\debugbookcake
2009-03-22 13:19 --------- d-----w c:\documents and settings\all users\application data\office genuine advantage
2009-03-22 12:47 --------- d-----w c:\program files\resize pictures plus
2009-03-22 11:29 --------- d-----w c:\program files\إدارة التشغيل العربي
2009-03-22 11:26 --------- d-----w c:\program files\avira
2009-03-22 11:26 --------- d-----w c:\documents and settings\all users\application data\avira
2009-03-22 03:49 --------- d-----w c:\program files\steganos internet trace destructor 7
2009-03-21 23:21 --------- d-----w c:\documents and settings\administrator\application data\avafind data
2009-03-21 23:16 --------- d-----w c:\program files\manycam 2.3
2009-03-21 23:03 --------- d-----w c:\program files\usb disk security
2009-03-21 21:54 --------- d-----w c:\program files\videocam gf112
2009-03-21 21:54 --------- d-----w c:\program files\installshield installation information
2009-03-21 21:54 --------- d-----w c:\program files\common files\pccamera
2009-03-21 21:54 --------- d-----w c:\program files\common files\installshield
2009-03-21 21:54 --------- d-----w c:\documents and settings\administrator\application data\paltalk
2009-03-21 21:42 --------- d-----w c:\program files\unlocker
2009-03-21 21:06 --------- d-----w c:\program files\paltalk messenger
2009-03-21 20:54 --------- d-----w c:\program files\total video converter
2009-03-21 20:52 --------- d-----w c:\program files\free flv to avi video converter
2009-03-21 20:47 --------- d-----w c:\program files\steady recorder
2009-03-21 20:46 --------- d-----w c:\program files\internet download manager
2009-03-21 20:45 --------- d-----w c:\documents and settings\all users\application data\seek film amok web
2009-03-21 20:41 --------- d-----w c:\program files\ashampoo
2009-03-21 20:41 --------- d-----w c:\documents and settings\all users\application data\ashampoo
2009-03-21 20:41 --------- d-----w c:\documents and settings\administrator\application data\ashampoo
2009-03-21 18:15 155,995 ----a-w c:\windows\java\packages\strndbzf.zip
2009-03-21 17:56 90,112 ----a-w c:\windows\system32\agsaami.dll
2009-03-21 17:56 753,664 ----a-w c:\windows\system32\agsaamg.dll
2009-03-21 17:56 626,688 ----a-w c:\windows\system32\agsaamh.dll
2009-03-21 17:56 544,256 ----a-w c:\windows\system32\agsaamd.dll
2009-03-21 17:56 538,624 ----a-w c:\windows\system32\agsaamb.dll
2009-03-21 17:56 372,736 ----a-w c:\windows\system32\agsaamc.dll
2009-03-21 17:56 331,776 ----a-w c:\windows\system32\agsaama.dll
2009-03-21 17:56 237,568 ----a-w c:\windows\system32\lame_enc.dll
2009-03-21 17:56 2,846,720 ----a-w c:\windows\system32\agsaamj.dll
2009-03-21 17:55 90,112 ----a-w c:\windows\system32\aloaudioformatsettings3.dll
2009-03-21 17:55 780,288 ----a-w c:\windows\system32\alovideocompress.dll
2009-03-21 17:55 778,240 ----a-w c:\windows\system32\aloaudiocompress2.dll
2009-03-21 17:55 215,552 ----a-w c:\windows\system32\alowmvfile.dll
2009-03-21 17:55 2,846,720 ----a-w c:\windows\system32\aloaudiocompress3.dll
2009-03-21 17:55 188,416 ----a-w c:\windows\system32\alovideofile.dll
2009-03-21 17:55 1,245,184 ----a-w c:\windows\system32\bkll.dll
2009-03-21 17:49 --------- d-----w c:\program files\messenger plus! Live
2009-03-21 17:49 --------- d-----w c:\program files\debugbookcake
2009-03-21 16:36 --------- d-----w c:\program files\msecache
2009-03-21 16:32 --------- d-----w c:\program files\ozone
2009-03-21 16:31 --------- d-----w c:\documents and settings\administrator\application data\ursoft
2009-03-21 16:21 --------- d-sh--w c:\documents and settings\all users\application data\{55a29068-f2ce-456c-9148-c869879e2357}
2009-03-21 16:21 --------- d-----w c:\documents and settings\all users\application data\tuneup software
2009-03-21 16:21 --------- d-----w c:\documents and settings\administrator\application data\tuneup software
2009-03-21 16:19 --------- d-----w c:\documents and settings\administrator\application data\media player classic
2009-03-21 16:14 --------- d-----w c:\program files\windows live
2009-03-21 16:12 --------- d-----w c:\program files\uninstaller 2008
2009-03-21 16:12 --------- d-----w c:\program files\the kmplayer
2009-03-21 16:12 --------- d-----w c:\program files\imageshack
2009-03-21 16:12 --------- d-----w c:\program files\foxit reader
2009-03-21 16:12 --------- d-----w c:\program files\dictionary
2009-03-21 16:12 --------- d-----w c:\program files\ccleaner
2009-03-21 16:12 --------- d-----w c:\program files\avi mpeg rm wmv splitter
2009-03-21 16:12 --------- d-----w c:\program files\avi mpeg rm wmv joiner
2009-03-21 16:11 --------- d-----w c:\program files\photobrush
2009-03-21 16:11 --------- d-----w c:\program files\megaview
2009-03-21 16:11 --------- d-----w c:\program files\inpaint
2009-03-21 16:11 --------- d-----w c:\program files\flash player 9
2009-03-21 16:11 --------- d-----w c:\program files\ava find
2009-03-21 16:10 --------- d-----w c:\program files\adobe photoshop cs
2009-03-21 15:06 --------- d-----w c:\program files\keychanger windows edition
2009-03-21 14:58 --------- d-----w c:\program files\difx
2009-03-21 14:50 --------- d-----w c:\program files\microsoft.net
2009-03-21 14:46 --------- d-----w c:\program files\reference assemblies
2009-03-21 14:46 --------- d-----w c:\program files\msbuild
2009-03-21 14:21 --------- d-----w c:\program files\windows media connect 2
2009-02-21 05:25 691,592 ----a-w c:\windows\system32\ogacheckcontrol.dll
2009-02-13 08:31 55,640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-02-09 14:04 1,846,656 ----a-w c:\windows\system32\win32k.sys
2009-02-09 14:04 1,846,656 ------w c:\windows\system32\dllcache\win32k.sys
2009-01-22 14:49 206,256 ----a-w c:\windows\system32\idmmbc.dll
2009-01-16 18:01 3,594,752 ------w c:\windows\system32\dllcache\mshtml.dll
.
------- sigcheck -------
12/23/2007 09:51 pm 1814528 9fac07ba33c683cd81fdcded6d7ae44f c:\windows\explorer.exe
.
((((((((((((((((((((((((((((((((((((( reg loading points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*note* empty entries & legit default entries are not shown
regedit4
[hkey_current_user\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [04/15/2008 12:29 am 15360]
"msnmsgr"="c:\program files\windows live\messenger\msnmsgr.exe" [03/25/2009 04:17 pm 5728112]
"idman"="c:\program files\internet download manager\idman.exe" [03/21/2009 11:46 pm 2745776]
[hkey_local_machine\software\microsoft\windows\currentversion\run]
"avgnt"="c:\program files\avira\antivir desktop\avgnt.exe" [03/02/2009 12:08 pm 209153]
"vttimer"="vttimer.exe" [09/21/2006 06:36 pm 53248 c:\windows\system32\vttimer.exe]
"s3trayp"="s3trayp.exe" [06/11/2007 01:15 pm 176128 c:\windows\system32\s3trayp.exe]
"rthdcpl"="rthdcpl.exe" [04/10/2008 05:52 pm 16861184 c:\windows\rthdcpl.exe]
"bluetoothauthenticationagent"="bthprops.cpl" [04/15/2008 12:30 am 110592 c:\windows\system32\bthprops.cpl]
[hkey_users\.default\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [04/15/2008 12:29 am 15360]
[hkey_users\.default\software\microsoft\windows\currentversion\runonce]
"nltide_2"="shell32" [x]
"itd7"="c:\program files\steganos internet trace destructor 7\itd7.exe" [09/03/2004 04:02 pm 241664]
"nltide_3"="advpack.dll" [12/21/2008 01:30 am 124928 c:\windows\system32\advpack.dll]
c:\documents and settings\administrator\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
one click destruction.lnk - c:\program files\steganos internet trace destructor 7\itd7.exe [2004-09-03 241664]
c:\documents and settings\all users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
paltalk.lnk - c:\program files\paltalk messenger\paltalk.exe [2009-01-28 10950144]
[hkey_local_machine\software\microsoft\windows\currentversion\policies\explorer]
"nosmhelp"= 1 (0x1)
"memcheckboxinrundlg"= 1 (0x1)
[hkey_current_user\software\microsoft\windows\currentversion\policies\explorer]
"nosmconfigureprograms"= 1 (0x1)
[hklm\~\startupfolder\c:^documents and settings^administrator^قائمة ابدأ^البرامج^بدء التشغيل^thaker.lnk]
path=c:\documents and settings\administrator\قائمة ابدأ\البرامج\بدء التشغيل\thaker.lnk
backup=c:\windows\pss\thaker.lnkstartup
[hklm\~\startupfolder\c:^documents and settings^all users^قائمة ابدأ^البرامج^بدء التشغيل^dyndns updater tray icon.lnk]
path=c:\documents and settings\all users\قائمة ابدأ\البرامج\بدء التشغيل\dyndns updater tray icon.lnk
backup=c:\windows\pss\dyndns updater tray icon.lnkcommon startup
[hklm\~\startupfolder\c:^documents and settings^all users^قائمة ابدأ^البرامج^بدء التشغيل^dyndns updater.lnk]
path=c:\documents and settings\all users\قائمة ابدأ\البرامج\بدء التشغيل\dyndns updater.lnk
backup=c:\windows\pss\dyndns updater.lnkcommon startup
[hkey_local_machine\software\microsoft\shared tools\msconfig\startupreg\itd7]
--a------ 09/03/2004 04:02 pm 241664 c:\program files\steganos internet trace destructor 7\itd7.exe
[hkey_local_machine\software\microsoft\security center]
"updatesdisablenotify"=dword:00000001
"antivirusoverride"=dword:00000001
"firewalloverride"=dword:00000001
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\network diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\program files\\paltalk messenger\\paltalk.exe"=
"c:\\program files\\mozilla firefox\\firefox.exe"=
"c:\\program files\\windows live\\messenger\\msnmsgr.exe"=
"c:\\program files\\windows live\\messenger\\livecall.exe"=
"c:\\program files\\utorrent\\utorrent.exe"=
r2 antivirmailservice;avira antivir mailguard;c:\program files\avira\antivir desktop\avmailc.exe [2009-03-22 186625]
r2 antivirschedulerservice;avira antivir scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-03-22 108289]
r2 antivirwebservice;avira antivir webguard;c:\program files\avira\antivir desktop\avwebgrd.exe [2009-03-22 432897]
r3 manycam;manycam virtual webcam, wdm video capture driver;c:\windows\system32\drivers\manycam.sys [2008-01-14 21632]
r3 s3gigp;s3gigp;c:\windows\system32\drivers\s3gigpm.sys [2009-03-21 714240]
s3 pac207;videocam gf112;c:\windows\system32\drivers\pfc027.sys [2005-04-08 162176]
.
Contents of the 'scheduled tasks' folder
2009-03-27 c:\windows\tasks\a318633b910c161f.job
- c:\docume~1\admini~1\applic~1\debugb~1\this bags view.exe []
2009-03-27 c:\windows\tasks\ogadaily.job
- c:\windows\system32\ogaverify.exe []
2009-03-27 c:\windows\tasks\ogalogon.job
- c:\windows\system32\ogaverify.exe []
.
.
------- supplementary scan -------
.
Usearchmigrateddefaulturl = hxxp://www.google.com/search?q={searchterms}&sourceid=ie7&rls=com.microsoft:en-us&ie=utf8&oe=utf8
ustart page = hxxp://www.google.com.sa/
uinternet settings,proxyoverride = local
usearchurl,(default) = hxxp://www.google.com/keyword/%s
ie: تحميل الكل بواسطة internet download manager - c:\program files\internet download manager\iegetall.htm
ie: تحميل بواسطة internet download manager - c:\program files\internet download manager\ieext.htm
ie: تحميل محتوى flv بواسطة internet download manager - c:\program files\internet download manager\iegetvl.htm
lsp: C:\program files\avira\antivir desktop\avsda.dll
dpf: Microsoft xml parser for java - file:///c:/windows/java/classes/xmldso.cab
ff - profilepath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\zvdd24av.default\
ff - prefs.js: Browser.startup.homepage - hxxp://www.google.com.sa/
ff - component: C:\documents and settings\administrator\application data\idm\idmmzcc2\components\idmmzcc.dll
ff - plugin: C:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
ff - plugin: C:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1367 w2k/xp/vista - rootkit/stealth malware detector by gmer,
rootkit scan 2009-03-28 00:12:53
windows 5.1.2600 service pack 3 ntfs
scanning hidden processes ...
Scanning hidden autostart entries ...
Scanning hidden files ...
Scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- dlls loaded under running processes ---------------------
- - - - - - - > 'lsass.exe'(676)
c:\program files\avira\antivir desktop\avsda.dll
.
Completion time: 03/28/2009 0:14:25
combofix-quarantined-files.txt 2009-03-27 21:14:23
pre-run: 35,734,683,648 bytes free
post-run: 35,726,213,120 bytes free
231
k:
.png)
.png)
