ComboFix 09-04-30.05 - بوفاضل 05/01/2009 16:21.4 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.446.269 [GMT 3:00]
Running from: c:\documents and settings\بوفاضل\سطح المكتب\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-01 to 2009-05-01 )))))))))))))))))))))))))))))))
.
2009-04-30 14:40 . 2009-04-30 15:36 1718304 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-29 08:15 . 2009-04-29 08:15 -------- d-----w c:\documents and settings\Administrator\سطح المكتب
2009-04-29 08:15 . 2009-04-29 08:15 -------- d-----w c:\documents and settings\Administrator\قائمة ابدأ
2009-04-29 08:15 . 2009-04-29 08:15 -------- d-----w c:\documents and settings\Administrator
2009-04-28 21:04 . 2009-04-28 21:29 -------- d-----w c:\documents and settings\بوفاضل\DoctorWeb
2009-04-28 21:04 . 2009-04-28 21:29 -------- d-----w c:\documents and settings\بوفاضل\DoctorWeb
2009-04-28 11:43 . 2009-04-28 11:43 -------- d-sh--w C:\found.004
2009-04-28 11:30 . 2009-04-28 11:30 -------- d-----w c:\documents and settings\بوفاضل\Application Data\CyberScrub
2009-04-28 11:29 . 2009-05-01 13:03 -------- d-----w c:\documents and settings\بوفاضل\Application Data\cleaner
2009-04-28 10:02 . 2009-04-28 10:37 -------- d-----w c:\windows\BDOSCAN8
2009-04-23 16:15 . 2009-03-10 19:18 453000 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-23 16:15 . 2009-04-24 09:41 -------- d-----w c:\windows\system32\KB905474
2009-04-22 13:42 . 2009-04-22 13:42 -------- d-----w c:\program files\Ask Search Assistant
2009-04-21 20:21 . 2009-04-21 20:21 -------- d-sh--w C:\found.003
2009-04-16 13:38 . 2009-04-16 13:38 -------- d-----w c:\program files\Lavalys
2009-04-16 13:38 . 2009-04-16 13:38 -------- d-----w c:\program files\AviSynth 2.5
2009-04-16 13:38 . 2009-04-16 13:38 -------- d-----w c:\program files\AC3Filter
2009-04-16 13:38 . 2009-04-16 13:42 -------- d-----w c:\program files\Easy RealMedia Tools
2009-04-16 13:37 . 2009-04-16 13:37 -------- d-----w c:\documents and settings\بوفاضل\Local Settings\Application Data\WinAVI
2009-04-16 13:36 . 2009-04-16 13:36 -------- d-----w c:\program files\WinAVI Video Converter 9.0
2009-04-16 13:36 . 2009-04-16 13:36 -------- d-----w c:\windows\WinAVI Video Converter 9.0
2009-04-16 13:02 . 2009-04-16 13:02 -------- d-sh--w c:\windows\ftpcache
2009-04-16 13:02 . 2009-04-16 13:02 -------- d-----w c:\program files\FLV-Media Player
2009-04-16 13:00 . 2009-04-16 13:01 -------- d-----w c:\documents and settings\بوفاضل\Application Data\Video Converter for Any Flv Player
2009-04-16 13:00 . 2009-04-16 13:00 -------- d-----w c:\program files\Any Flv Player
2009-04-16 12:48 . 2009-04-16 12:48 -------- d-----w c:\documents and settings\بوفاضل\Application Data\FLVPlayer4Free
2009-04-16 12:32 . 2009-04-16 12:32 275456 ----a-w c:\windows\system32\gfbaksm.dll
2009-04-16 12:32 . 2009-04-16 12:32 275456 ----a-w c:\windows\system32\gfbaksm.dat
2009-04-16 12:32 . 2009-04-16 12:33 -------- d-----w c:\program files\GetFLV
2009-04-09 21:53 . 2009-04-09 21:53 -------- d-----w c:\program files\Avira
2009-04-09 21:53 . 2009-04-09 21:53 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-04-06 16:27 . 2009-04-06 16:27 -------- d-----w c:\program files\TechSmith
2009-04-06 15:57 . 2009-04-06 16:02 -------- d-----w c:\program files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter
2009-04-06 15:49 . 2009-04-06 15:49 -------- d-----w C:\Mp3 Output
2009-04-06 15:49 . 2007-02-25 12:36 383238 ----a-w c:\windows\system32\libmp3lame-0.dll
2009-04-06 15:49 . 2009-04-06 15:49 -------- d-----w c:\program files\Smallvideosoft
2009-04-05 08:26 . 2009-04-05 08:26 -------- d-sh--w C:\found.002
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-01 09:41 . 2001-09-19 12:00 59628 ----a-w c:\windows\system32\perfc001.dat
2009-05-01 09:41 . 2001-09-19 12:00 331398 ----a-w c:\windows\system32\perfh001.dat
2009-04-30 14:41 . 2009-04-30 14:40 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-28 11:44 . 2008-10-05 01:35 -------- d-----w c:\program files\Yahoo!
2009-04-22 13:42 . 2008-08-07 02:59 -------- d-----w c:\program files\MSN Messenger
2009-04-22 13:41 . 2008-09-03 01:18 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-19 15:12 . 2009-04-19 15:12 -------- d-----w c:\program files\PGP Corporation
2009-04-09 22:34 . 2009-01-01 21:55 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-06 12:32 . 2009-01-01 21:55 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 12:32 . 2009-01-01 21:55 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-28 06:02 . 2008-08-08 11:52 116904 ----a-w c:\documents and settings\بوفاضل\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-27 16:16 . 2009-03-27 16:16 -------- d-----w c:\program files\MSECache
2009-03-27 15:35 . 2008-09-03 01:17 -------- d-----w c:\program files\Windows Live
2009-03-27 15:34 . 2009-03-27 15:34 -------- d-----w c:\program files\Microsoft Sync Framework
2009-03-27 15:33 . 2009-03-27 15:33 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-03-27 15:30 . 2009-03-27 15:30 -------- d-----w c:\program files\Microsoft
2009-03-27 15:30 . 2009-03-27 15:30 -------- d-----w c:\program files\Windows Live SkyDrive
2009-03-06 14:20 . 2008-04-14 18:29 283136 ----a-w c:\windows\system32\pdh.dll
2009-03-04 17:55 . 2009-03-04 17:55 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-04 17:55 . 2008-09-29 10:08 -------- d-----w c:\program files\Java
2009-03-03 00:06 . 2008-07-20 10:51 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-26 23:48 . 2008-12-10 11:48 74490 ----a-w c:\windows\Uninstal.exe
2009-02-20 16:50 . 2008-07-20 10:50 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-10 16:03 . 2008-04-14 18:12 2067584 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 14:04 . 2008-04-14 18:07 1846656 ----a-w c:\windows\system32\win32k.sys
2009-02-09 13:40 . 2009-02-07 15:52 592 ----a-w c:\windows\chgkey.vbs
2009-02-09 11:22 . 2008-04-14 18:12 2190592 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:21 . 2008-04-14 18:30 110592 ----a-w c:\windows\system32\services.exe
2009-02-09 10:51 . 2008-04-14 18:29 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:51 . 2008-04-14 18:29 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:51 . 2008-04-14 18:29 681472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:51 . 2008-04-14 18:29 693760 ----a-w c:\windows\system32\ntdll.dll
2009-02-07 17:04 . 2007-07-18 12:39 112144 ----a-w c:\windows\system32\drivers\kl1.sys
2009-02-06 16:43 . 2009-02-06 16:43 307576 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 10:39 . 2001-09-19 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:57 . 2008-04-14 18:29 56832 ----a-w c:\windows\system32\secur32.dll
.
------- Sigcheck -------
[-] 2008-07-20 10:56 1571328 E16DB203BFEB9740C8483E418C8C18AD c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot_2009-04-30_12.46.30 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-09-19 12:00 . 2009-04-28 17:27 59638 c:\windows\system32\perfc009.dat
+ 2001-09-19 12:00 . 2009-05-01 09:41 59638 c:\windows\system32\perfc009.dat
+ 2001-09-19 12:00 . 2009-05-01 09:41 395398 c:\windows\system32\perfh009.dat
- 2001-09-19 12:00 . 2009-04-28 17:27 395398 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Privacy Suite"="c:\documents and settings\بوفاضل\Application Data\cleaner\CSPSeraser.exe" [2007-11-20 872080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-25 8433664]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-02 185872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-08-07 98304]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Microsoft Office OneNote 2003 Quick Launch.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Microsoft Office OneNote 2003 Quick Launch.lnk
backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^بوفاضل^قائمة ابدأ^البرامج^بدء التشغيل^Yankee Clipper III.lnk]
path=c:\documents and settings\بوفاضل\قائمة ابدأ\البرامج\بدء التشغيل\Yankee Clipper III.lnk
backup=c:\windows\pss\Yankee Clipper III.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"RichVideo"=2 (0x2)
"ose"=3 (0x3)
"OracleXETNSListener"=2 (0x2)
"OracleXEClrAgent"=3 (0x3)
"OracleServiceXE"=2 (0x2)
"OracleMTSRecoveryService"=3 (0x3)
"MDM"=2 (0x2)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"AVP"=2 (0x2)
"AgereModemAudio"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\English\\setup.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2009-04-09 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-06-12 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-05-09 41217]
R2 PGPdisk;PGPdisk; [x]
R2 PGPsdkServ;PGPsdkService;c:\windows\system32\PGPsdkServ.exe [2002-11-26 77824]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2007-07-20 5632]
R3 winbondhidcir;Winbond HID CIR Receiver;c:\windows\system32\DRIVERS\winbondhidcir.sys [2007-07-20 21504]
R4 OracleJobSchedulerXE;OracleJobSchedulerXE; [x]
R4 OracleServiceXE;OracleServiceXE; [x]
R4 OracleXETNSListener;OracleXETNSListener;c:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe [2006-02-01 204800]
S2 PGPsdkDriver;PGPsdkDriver;c:\windows\system32\Drivers\PGPsdk.sys [2002-11-26 26624]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5abdb341-a430-11dd-8d5c-001b24ee22c5}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f49c9904-67b7-11dd-8c06-001b24ee22c5}]
\Shell\AutoRun\command - f:\ctrun\start.exe
\Shell\readme\command - notepad \readme.txt
.
Contents of the 'Scheduled Tasks' folder
2009-04-30 c:\windows\Tasks\User_Feed_Synchronization-{8BB6EAE7-E840-45A3-BB97-672FB2F53D5F}.job
- c:\windows\system32\msfeedssync.exe [2008-07-20 10:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: Download ALL with IDA
IE: Download with IDA
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: avsda.dll
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\بوفاضل\Application Data\Mozilla\Firefox\Profiles\1dogw6dj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.plusnetwork.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=en-CA&FORM=MICFEC&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-01 16:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1708537768-1202660629-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="a"
[HKEY_USERS\S-1-5-21-1708537768-1202660629-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B98EC8F3-C72D-17F0-F729-48FBEB943424}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"fajjenaeimka"=hex:66,61,68,6d,68,66,6c,6b,6c,6a,66,6b,00,00
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(264)
c:\windows\system32\klogon.dll
.
Completion time: 2009-05-01 16:25
ComboFix-quarantined-files.txt 2009-05-01 13:24
ComboFix2.txt 2009-04-30 13:04
ComboFix3.txt 2009-04-28 12:03
Pre-Run: 29,705,478,144 bytes free
Post-Run: 29,704,368,128 bytes free
229 --- E O F --- 2009-04-30 12:35
هذا التقرير الاداه الاولى
