ComboFix 08-12-12.04 - Egypt 04/21/2009 22:40:53.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.255.91 [GMT 2:00]
Running from: f:\program\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 20:29 16,299,862 ----a-w C:\$Persi0.sys
2009-04-21 20:29 --------- d-sh--r c:\program files\ThunMail
2009-04-21 20:29 --------- d-----w c:\program files\Faronics
2009-04-21 20:07 155,995 ----a-w c:\windows\java\Packages\RRJR37B1.ZIP
2009-04-21 20:01 --------- d-----w c:\program files\Tech-NoCut
2009-04-21 20:01 --------- d-----w c:\documents and settings\Egypt\Application Data\IDM
2009-04-21 20:01 --------- d-----w c:\documents and settings\Egypt\Application Data\DMCache
2009-04-21 20:00 --------- d-----w c:\program files\K-Lite Codec Pack
2009-04-21 20:00 --------- d-----w c:\program files\Internet Download Manager
2009-04-21 19:58 --------- d-----w c:\program files\RealDrawPro By Method
2009-04-21 19:55 --------- d-----w c:\program files\Winamp
2009-04-21 19:55 --------- d-----w c:\documents and settings\Egypt\Application Data\Winamp
2009-04-21 19:54 --------- d-----w c:\program files\Yahoo!
2009-04-21 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-21 19:53 --------- d-----w c:\documents and settings\Egypt\Application Data\URSoft
2009-04-21 19:52 --------- d-----w c:\program files\Your Uninstaller 2008
2009-04-21 19:52 --------- d-----w c:\program files\Windows Live
2009-04-21 19:52 --------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2009-04-21 19:47 --------- d-----w c:\program files\CCleaner
2009-04-21 19:45 --------- d-----w c:\documents and settings\Egypt\Application Data\TuneUp Software
2009-04-21 19:27 --------- d-----w c:\program files\microsoft frontpage
2009-03-02 18:10 67,584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-26 20:47 2,255,360 ----a-w c:\windows\system32\x264vfw.dll
2009-02-06 16:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-01-22 14:49 206,256 ----a-w c:\windows\system32\idmmbc.dll
.
(((((((((((((((((((((((((((((
snapshot@Tue 04-21-2009_22.20.19.70 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-21 20:22:04 2,048 --s-a-w c:\windows\bootstet.dat
- 2009-04-21 20:16:32 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-04-21 20:30:12 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-04-21 20:16:32 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-04-21 20:30:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-21 20:16:32 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-04-21 20:30:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-06-28 17:45:04 131,472 ----a-w c:\windows\system32\drivers\DeepFrz.sys
+ 2004-06-22 07:17:04 18,004 ----a-w c:\windows\system32\drivers\slnt.sys
+ 2007-06-28 17:39:16 65,536 ----a-w c:\windows\system32\LogonDll.dll
- 2008-04-14 10:00:00 1,414,656 ----a-w c:\windows\system32\mmc.exe
+ 2008-04-14 10:00:00 1,435,136 ----a-w c:\windows\system32\mmc.exe
- 2008-04-14 10:00:00 121,856 ----a-w c:\windows\system32\schtasks.exe
+ 2008-04-14 10:00:00 142,336 ----a-w c:\windows\system32\schtasks.exe
- 2008-04-14 10:00:00 9,216 ----a-w c:\windows\system32\scrnsave.scr
+ 2008-04-14 10:00:00 29,696 ----a-w c:\windows\system32\scrnsave.scr
- 2008-04-14 10:00:00 704,512 ----a-w c:\windows\system32\ss3dfo.scr
+ 2008-04-14 10:00:00 724,992 ----a-w c:\windows\system32\ss3dfo.scr
- 2008-04-14 10:00:00 19,968 ----a-w c:\windows\system32\ssbezier.scr
+ 2008-04-14 10:00:00 40,448 ----a-w c:\windows\system32\ssbezier.scr
- 2008-04-14 10:00:00 393,216 ----a-w c:\windows\system32\ssflwbox.scr
+ 2008-04-14 10:00:00 413,696 ----a-w c:\windows\system32\ssflwbox.scr
- 2008-04-14 10:00:00 20,992 ----a-w c:\windows\system32\ssmarque.scr
+ 2008-04-14 10:00:00 41,472 ----a-w c:\windows\system32\ssmarque.scr
- 2008-04-14 10:00:00 47,104 ----a-w c:\windows\system32\ssmypics.scr
+ 2008-04-14 10:00:00 67,584 ----a-w c:\windows\system32\ssmypics.scr
- 2008-04-14 10:00:00 18,944 ----a-w c:\windows\system32\ssmyst.scr
+ 2008-04-14 10:00:00 39,424 ----a-w c:\windows\system32\ssmyst.scr
- 2008-04-14 10:00:00 610,304 ----a-w c:\windows\system32\sspipes.scr
+ 2008-04-14 10:00:00 630,784 ----a-w c:\windows\system32\sspipes.scr
- 2008-04-14 10:00:00 14,336 ----a-w c:\windows\system32\ssstars.scr
+ 2008-04-14 10:00:00 34,816 ----a-w c:\windows\system32\ssstars.scr
- 2008-04-14 10:00:00 679,936 ----a-w c:\windows\system32\sstext3d.scr
+ 2008-04-14 10:00:00 700,416 ----a-w c:\windows\system32\sstext3d.scr
- 2008-04-14 12:00:00 196,608 ----a-w c:\windows\system32\wbem\wmiadap.exe
+ 2008-04-14 12:00:00 217,088 ----a-w c:\windows\system32\wbem\wmiadap.exe
- 2008-04-14 10:00:00 32,256 ----a-w c:\windows\system32\wpabaln.exe
+ 2008-04-14 10:00:00 52,736 ----a-w c:\windows\system32\wpabaln.exe
+ 2009-04-21 20:34:34 16,384 ----a-w c:\windows\temp\Perflib_Perfdata_8f0.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 12:00 PM 35840]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [02/06/2009 06:51 PM 3885408]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 12:00 PM 35840]
"svc"="c:\program files\ThunMail\testabd.exe" [04/21/2009 10:29 PM 66760]
c:\documents and settings\Egypt\Start Menu\Programs\Startup\
NoCut.lnk - c:\program files\Tech-NoCut\NoCut.BAT [4/21/2009 10:01:40 PM 88]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DfLogon]
06/28/2007 07:39 PM 65536 c:\windows\system32\LogonDll.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\ThunMail\testabd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i263"= i263_32.drv
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"IDMan"=c:\program files\Internet Download Manager\IDMan.exe /onboot
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
R0 DeepFrz;DeepFrz;c:\windows\system32\drivers\DeepFrz.sys [6/28/2007 7:45:04 PM 131472]
R3 slnt;Realtek RTL8139 Family PCI Fast Ethernet NIC;c:\windows\system32\DRIVERS\slnt.sys [4/20/2009 9:30:04 PM 18004]
*Newly Created Service* - DF5SERV
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.eg/
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\Egypt\Application Data\Mozilla\Firefox\Profiles\nkze886c.default\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-21 22:41:04
Windows 5.1.2600 Service Pack 3 FAT NTAPI
detected NTDLL code modification:
ZwOpenFile
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\LogonDll.dll
.
Completion time: 04/21/2009 22:41:44
ComboFix-quarantined-files.txt 2009-04-21 20:41:44
Pre-Run: 3,462,369,280 bytes free
Post-Run: 3,477,745,664 bytes free
154
