ComboFix 09-03-31.04 - Fateh 2009-04-02 15:36:36.1 - NTFSx86
Microsoft® Windows Vista™ Edition Intégrale 6.0.6002.2.1256.213.1036.18.1023.451 [GMT 1:00]
Running from: f:\mes documents\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
AV: Outpost Security Suite Pro *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
FW: Outpost Security Suite Pro *disabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-03-02 to 2009-04-02 )))))))))))))))))))))))))))))))
.
2009-03-27 21:10 . 2009-03-27 21:10 <REP> d--h----- C:\msdownld.tmp
2009-03-25 21:13 . 2009-03-25 21:17 <REP> d-------- c:\program files\Unlocker
2009-03-25 11:56 . 2009-03-25 11:56 <REP> d-------- C:\RegSupreme
2009-03-24 22:33 . 2009-03-24 22:36 <REP> d-------- C:\EVTERM1
2009-03-24 22:28 . 2009-03-25 13:05 <REP> d-------- c:\users\Fateh\AppData\Roaming\cleaner
2009-03-13 22:56 . 2009-02-10 21:29 2,034,176 --a------ c:\windows\System32\win32k.sys
2009-03-05 17:55 . 2009-03-05 17:55 <REP> d-------- c:\users\All Users\Real
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-02 14:39 --------- d-----w c:\users\Fateh\AppData\Roaming\DMCache
2009-04-02 14:34 --------- d-----w c:\programdata\Kaspersky Lab
2009-04-02 13:36 401,440 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-02 13:36 3,500 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-02 13:36 2,161,184 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-02 13:36 19,012 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-01 22:06 --------- d-----w c:\program files\Mozilla Firefox 3.1 Beta 2
2009-03-25 20:17 --------- d---a-w c:\programdata\TEMP
2009-03-25 19:29 --------- d-----w c:\program files\SUPERAntiSpyware
2009-03-13 21:56 --------- d-----w c:\programdata\Microsoft Help
2009-03-05 16:55 --------- d-----w c:\program files\K-Lite Codec Pack
2009-03-02 01:04 --------- d-----w c:\users\Fateh\AppData\Roaming\uTorrent
2009-02-27 22:08 --------- d-----w c:\users\Fateh\AppData\Roaming\Skype
2009-02-27 10:07 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-26 01:12 --------- d-----w c:\programdata\Skype
2009-02-26 01:12 --------- d-----r c:\program files\Skype
2009-02-18 10:42 --------- d-----w c:\users\Fateh\AppData\Roaming\Convivea
2009-02-18 10:42 --------- d-----w c:\program files\Bit Che
2009-02-17 17:39 --------- d-----w c:\program files\Internet Download Manager
2009-02-16 19:50 6,656 ----a-w c:\windows\System32\lpcio.dll
2009-02-04 15:55 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-03 22:19 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-03 22:19 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-01-22 14:49 206,256 ----a-w c:\windows\System32\idmmbc.dll
2008-09-18 18:28 32 ----a-w c:\users\All Users\ezsid.dat
2008-09-18 18:28 32 ----a-w c:\programdata\ezsid.dat
2008-09-11 10:05 174 --sha-w c:\program files\desktop.ini
2008-12-26 22:57 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
2008-12-26 22:57 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
2008-11-11 17:00 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-11-11 17:00 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-10-17 1233920]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-02-16 2745776]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-25 1830128]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-04 206088]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2008-12-25 1292120]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Security Suite Pro\feedback.exe" [2008-12-25 432984]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-13 c:\windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-11-20 c:\windows\SkyTel.exe]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
delXP.bat [2005-01-23 181]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"BindDirectlyToPropertySetStorage"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-01-28 21:41 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\agnitum\outpos~1\wl_hook.dll c:\progra~1\kasper~1\kasper~1\mzvkbd.dll c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll c:\progra~1\kasper~1\kasper~1\adialhk.dll c:\progra~1\kasper~1\kasper~1\kloehk.dll
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Canon LBP3000 Fenêtre d'état.lnk]
backup=c:\windows\pss\Canon LBP3000 Fenêtre d'état.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"ehTray.exe"=c:\windows\ehome\ehTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{64D88B6F-6141-403E-B741-27810110CC55}"= Disabled:UDP:c:\windows\System32\CNAB3RPK.EXE:Canon LBP3000 RPC Server Process
"{E5D27D8E-FCD0-4E96-A9FB-6B21FB8D9666}"= Disabled:TCP:c:\windows\System32\CNAB3RPK.EXE:Canon LBP3000 RPC Server Process
"{6173CD10-20F2-4077-9C37-1798256A874E}"= c:\program files\Skype\Phone\Skype.exe:Skype
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [2008-01-29 33808]
R1 afw;Agnitum Firewall Driver;c:\windows\System32\drivers\afw.sys [2009-01-28 28688]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [2008-07-09 20496]
R1 SandBox;SandBox;c:\windows\System32\drivers\SandBox.sys [2009-01-28 703904]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-09-03 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-09-03 55024]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2008-12-18 603904]
R3 afwcore;afwcore;c:\windows\System32\drivers\afwcore.sys [2009-01-28 295960]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [2008-03-13 26640]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [2009-01-28 1604952]
S3 ASWFilt;ASWFilt;c:\windows\System32\Filt\ASWFilt.dll [2009-01-28 34080]
S3 VBEngNT;VBEngNT;c:\windows\System32\drivers\VBEngNT.sys [2009-01-28 1075154]
S3 VBFilt;VBFilt;c:\windows\System32\Filt\VBFilt.dll [2009-01-28 229024]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-03-23 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-12 15:04]
2009-03-23 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-25 03:11]
2009-02-26 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-25 03:11]
.
- - - - ORPHANS REMOVED - - - -
ShellIconOverlayIdentifiers-{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} - %SystemRoot%\system32\EhStorShell.dll
HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
FF - ProfilePath - c:\users\Fateh\AppData\Roaming\Mozilla\Firefox\Profiles\mcdrl9xm.default\
FF - component: c:\program files\Mozilla Firefox 3.1 Beta 2\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\Fateh\AppData\Roaming\IDM\idmmzcc2\components\idmmzcc.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: nglayout.initialpaint.delay - 750
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 2250000
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox 3.1 Beta 2\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox 3.1 Beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-02 15:39:08
Windows 6.0.6002 Service Pack 2, v.113 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2454489773-369999015-4284712137-1000_Classes\CLSID\{1b8bb33e-c024-4ffb-b644-dec478cf7afd}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000012f
"Therad"=dword:00000028
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,43,35,f5,e6,14,18,9b,31,0d,b4,fe,3d,58,ad,\
[HKEY_USERS\S-1-5-21-2454489773-369999015-4284712137-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):80,04,0f,1f,2b,31,99,fa,29,fb,4d,1c,a3,31,6c,27,77,b9,33,a5,3b,
88,e7,bf,42,2a,a1,85,1d,16,9e,00,fc,02,03,35,4a,f1,93,5d,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-2454489773-369999015-4284712137-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):5b,35,5d,e6,f6,78,06,37,61,53,e7,17,4d,51,67,c8,b1,fe,c5,85,fd,
54,e5,31,e3,2b,62,30,68,9e,ac,38,c3,34,d9,c5,65,73,de,26,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-2454489773-369999015-4284712137-1000_Classes\CLSID\{f2004ad7-34be-4f12-bd55-d14f174e5fcd}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000003b
"Therad"=dword:0000000e
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,45,82,64,e5,53,
4d,9b,63,05,98,32,02,34,2b,da,61,21,48,e3,d5,c9,bf,eb,f7,c1,3d,e4,c8,e3,43,\
.
Completion time: 2009-04-02 15:41:33
ComboFix-quarantined-files.txt 2009-04-02 14:41:30
Pre-Run: 23 169 921 024 octets libres
Post-Run: 23,131,328,512 octets libres
218 --- E O F --- 2009-03-21 11:03:04
s_startup