ComboFix 09-04-23.A3 - wswsa 04/24/2009 5:18.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.511.225 [GMT 3:00]
Running from: c:\documents and settings\wswsa\سطح المكتب\32.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\IE4 Error Log.txt
.
((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-4-24 )))))))))))))))))))))))))))))))
.
2009-04-24 01:43 . 2009-04-24 01:43 -------- d-----w C:\ComboFix
2009-04-23 13:50 . 2009-04-23 13:50 0 ----a-w c:\windows\nsreg.dat
2009-04-23 13:50 . 2009-04-23 13:50 -------- d-----w c:\documents and settings\wswsa\Local Settings\Application Data\Mozilla
2009-04-23 13:46 . 2009-04-23 13:46 -------- d-----w c:\documents and settings\wswsa\Application Data\CyberScrub
2009-04-23 13:44 . 2009-04-23 13:44 -------- d-----w c:\documents and settings\wswsa\Application Data\cleaner
2009-04-22 20:49 . 2009-04-22 20:49 -------- d-----w c:\windows\system32\KB905474
2009-04-22 20:49 . 2009-03-10 19:26 1430400 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-22 20:49 . 2009-03-10 19:18 453000 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-22 20:49 . 2009-02-09 15:51 11874 ----a-w c:\windows\system32\KB905474\wga_eula.txt
2009-04-21 14:58 . 2009-04-21 14:58 -------- d-----w c:\documents and settings\wswsa\Application Data\Media Player Classic
2009-04-01 19:44 . 2009-04-24 01:22 12 ----a-w c:\windows\bthservsdp.dat
2009-04-01 19:18 . 2004-08-03 19:58 100992 ----a-w c:\windows\system32\drivers\bthpan.sys
2009-04-01 19:18 . 2004-08-03 20:10 59648 ----a-w c:\windows\system32\drivers\rfcomm.sys
2009-04-01 19:18 . 2004-08-03 20:10 17024 ----a-w c:\windows\system32\drivers\BthEnum.sys
2009-04-01 19:18 . 2004-08-03 21:55 26624 ----a-w c:\windows\system32\irmon.dll
2009-04-01 19:18 . 2004-08-03 21:56 152064 ----a-w c:\windows\system32\irftp.exe
2009-04-01 19:18 . 2004-08-03 21:56 8192 ----a-w c:\windows\system32\wshirda.dll
2009-04-01 19:18 . 2004-08-03 20:10 18944 ----a-w c:\windows\system32\drivers\BTHUSB.SYS
2009-04-01 18:23 . 2009-04-03 03:16 754 ----a-w c:\windows\WORDPAD.INI
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-24 02:16 . 2004-08-04 09:00 40118 ----a-w c:\windows\system32\perfc001.dat
2009-04-24 02:16 . 2004-08-04 09:00 251674 ----a-w c:\windows\system32\perfh001.dat
2009-04-24 01:22 . 2009-02-20 23:00 32 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-24 01:22 . 2009-02-20 23:00 32 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-24 01:22 . 2009-02-20 23:00 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-24 01:22 . 2009-02-20 23:00 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-28 10:43 . 2009-03-28 10:43 -------- d-----w c:\program files\LtUcx
2009-03-07 00:25 . 2009-03-07 00:25 -------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-03-06 14:44 . 2004-08-04 09:00 282624 ----a-w c:\windows\system32\pdh.dll
2009-02-25 02:51 . 2009-02-25 02:51 -------- d-----w c:\program files\Mv2Player
2009-02-23 19:29 . 2009-02-23 19:29 -------- d-----w c:\program files\Common Files\Adobe
2009-02-23 03:36 . 2009-02-23 03:36 -------- d-----w c:\program files\RamCleaner
2009-02-23 02:48 . 2009-02-23 02:48 -------- d-----w c:\program files\Gabest
2009-02-21 22:43 . 2009-02-20 22:18 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-21 00:03 . 2009-02-21 00:03 27264 ----a-w c:\documents and settings\wswsa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-20 23:12 . 2009-02-20 23:12 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-02-20 23:12 . 2009-02-20 22:54 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-02-20 22:53 . 2009-02-20 22:53 2232 ----a-w c:\windows\java\Packages\Data\J9Z5VFB5.DAT
2009-02-20 22:53 . 2009-02-20 22:53 155995 ----a-w c:\windows\java\Packages\WVJHFF13.ZIP
2009-02-20 22:53 . 2009-02-20 22:53 2678 ----a-w c:\windows\java\Packages\Data\GEMZXFXV.DAT
2009-02-20 22:53 . 2009-02-20 22:53 2678 ----a-w c:\windows\java\Packages\Data\YZF97HJF.DAT
2009-02-20 22:53 . 2009-02-20 22:53 2678 ----a-w c:\windows\java\Packages\Data\QECAR1R5.DAT
2009-02-20 22:53 . 2009-02-20 22:53 2678 ----a-w c:\windows\java\Packages\Data\O2AZX71V.DAT
2009-02-20 22:53 . 2009-02-20 22:53 2678 ----a-w c:\windows\java\Packages\Data\NZ35VBPB.DAT
2009-02-20 22:16 . 2009-02-20 22:16 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-02-20 08:29 . 2004-08-04 09:00 657920 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:29 . 2004-08-04 09:00 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 14:15 . 2004-08-04 09:00 1846144 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:48 . 2004-08-04 09:00 2182016 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:48 . 2004-08-03 21:48 2059264 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 10:19 . 2004-08-04 09:00 717824 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:19 . 2004-08-04 09:00 680960 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2004-08-04 09:00 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:19 . 2004-08-04 09:00 693760 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:05 . 2004-08-04 09:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 16:54 . 2004-08-04 09:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 20:08 . 2004-08-04 09:00 55808 ----a-w c:\windows\system32\secur32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-20 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2003-02-27 47104]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BearShare\\Bearshare.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bit Lord 1.1\\BitLord.exe"=
"c:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\AVP.EXE"=
S3 EL910;3Com 3CSOHO100B-TX PCI;c:\windows\system32\DRIVERS\EL910N51.sys [2002-05-29 38400]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-04-17 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 13:53]
2009-04-24 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 19:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = hxxp://www.internetdownloadmanager.com/welcome.html
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
DPF: Microsoft XML Parser for Java -
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://67.198.194.91:1999/ReadUid.CAB
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://76.76.24.112/saudi1999/talks3n.cab
FF - ProfilePath - c:\documents and settings\wswsa\Application Data\Mozilla\Firefox\Profiles\qw0v0kup.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-24 05:44
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):91,27,c0,3b,50,7f,ed,6c,82,3c,24,7d,5f,53,d8,e7,cc,93,84,8b,6e,
9a,b3,41,d8,e9,14,da,54,0a,87,b9,73,15,d8,11,24,4b,79,d3,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{744f7de2-b3d6-4f17-89af-47ecd7ea31a4}]
@Denied: (Full) (Everyone)
"Model"=dword:0000004f
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(852)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(908)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(1948)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll
c:\windows\system32\msi.dll
.
Completion time: 2009-04-24 5:49
ComboFix-quarantined-files.txt 2009-04-24 02:49
Pre-Run: 11,699,142,656 bytes free
Post-Run: 11,659,968,512 bytes free
164 --- E O F --- 2009-04-22 20:49
