ComboFix 08-03-04.3 - pc 03/04/2008 22:11:29.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.183 [GMT -8:00]
Running from: C:\??????????????????????????????????????????????? ?s and Settings\pc\My ????????????????????????????????????????????????s\ My Completed Downloads\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2008-02-05 to 2008-03-05 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-03-05 03:06 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-04 04:48 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-03 06:57 --------- d-----w C:\Program Files\Windows Live Messenger Khalid Edition v5.1
2008-03-03 06:10 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\CyberScrub
2008-03-03 06:06 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\cleaner
2008-03-03 00:48 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-03 00:46 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
2008-03-02 07:12 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-03-02 04:49 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2008-03-02 04:22 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-03-01 07:48 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-02-29 08:05 --------- d-----w C:\Program Files\CONEXANT
2008-02-29 07:30 --------- d-----w C:\Program Files\dead dupe funk
2008-02-29 07:05 --------- d-----w C:\Program Files\MSN Messenger
2008-02-23 17:21 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\Datalayer
2008-02-23 17:05 --------- d-----w C:\Program Files\Nokia
2008-02-18 11:26 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
2008-02-18 10:32 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2008-02-18 10:31 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll
2008-02-18 10:30 --------- d-----w C:\Program Files\Google
2008-02-18 10:30 --------- d-----w C:\Program Files\DAP
2008-02-18 10:07 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\Internet Download Accelerator
2008-02-18 10:06 --------- d-----w C:\Program Files\IDA
2008-02-18 06:09 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\COWON
2008-02-17 15:45 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\Guest\Application Data\dead dupe funk
2008-02-17 10:05 --------- d-----w C:\Program Files\Wave Splitter
2008-02-17 09:00 --------- d-----w C:\Program Files\Internet Download Manager
2008-02-17 04:14 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Anti-Virus Personal
2008-02-17 04:13 --------- d-----w C:\Program Files\Kaspersky Lab
2008-02-17 04:12 --------- d-----w C:\Program Files\Common Files\xing shared
2008-02-17 04:10 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-02-17 04:10 --------- d-----w C:\Program Files\Real
2008-02-17 03:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-17 03:57 --------- d-----w C:\Program Files\JetAudio
2008-02-17 03:57 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\Media Player Classic
2008-02-17 03:56 --------- d-----w C:\Program Files\Common Files\Real
2008-02-17 03:56 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2008-02-17 03:55 --------- d-----w C:\Program Files\Ringz Studio
2008-02-17 03:54 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-17 02:28 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-02-17 02:28 172,032 ------w C:\WINDOWS\Setup1.exe
2008-02-17 02:28 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-02-17 02:27 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\ACD Systems
2008-02-17 02:23 10,368 ----a-w C:\WINDOWS\system32\drivers\pfc.sys
2008-02-17 02:23 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-02-17 02:23 --------- d-----w C:\Program Files\ACD Systems
2008-02-17 02:23 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
2008-02-17 02:16 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-17 02:07 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-17 02:07 --------- d-----w C:\Program Files\Ahead
2008-02-17 01:36 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-02-17 01:36 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-02-17 01:36 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-02-17 01:36 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-02-17 01:36 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-02-17 01:36 --------- d-----w C:\Program Files\Xp Bosster
2008-02-17 01:35 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-02-17 01:35 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-02-17 01:35 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-02-17 01:35 --------- d-----w C:\Program Files\Real_SC
2008-02-17 00:37 --------- d-----w C:\Program Files\Common Files\L&H
2008-02-17 00:36 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-17 00:34 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-17 00:31 --------- d-----w C:\Program Files\Microsoft Works
2008-02-16 20:11 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
2008-02-16 20:10 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\platform dupe draw memo
2008-02-16 20:09 --------- d-----w C:\??????????????????????????????????????????????? ?s and Settings\pc\Application Data\dead dupe funk
2008-02-16 20:07 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-02-16 20:07 --------- d-----w C:\Program Files\Circle Developement
2008-02-16 17:49 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2008-02-16 17:47 --------- d-----w C:\Program Files\Paltalk Messenger
2008-02-16 17:46 --------- d-----w C:\Program Files\Yahoo!
2008-02-16 17:36 --------- d-----w C:\Program Files\Windows Live
2008-02-16 17:33 415,846 ----a-w C:\WINDOWS\system32\cdky1.reg
2008-02-16 17:28 155,995 ----a-w C:\WINDOWS\java\Packages\GVV39RPZ.ZIP
2008-02-16 01:28 --------- d-----w C:\Program Files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34 AM 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:56 AM 15360]
"Internet Download Accelerator"="C:\Program Files\IDA\ida.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe" [02/18/2008 02:32 AM 171448]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
"poll 32"="C:\DOCUME~1\pc\APPLIC~1\DEADDU~1\HoldEggsOnli ne.exe" [02/28/2008 11:30 PM 445440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"KAVPersonal50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" [08/30/2005 04:51 AM 139367]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/16/2008 08:10 PM 185896]
"DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [02/18/2008 02:31 AM 3057152]
"draw memo up hide"="C:\???????????????????????????????????????? ????????s and Settings\All Users\Application Data\platform dupe draw memo\Sixth Stop.exe" [03/04/2008 09:59 PM 599040]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 07:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 07:56 AM 15360]
C:\??????????????????????????????????????????????? ?s and Settings\pc\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
"NoMovingBands"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKLM\~\startupfolder\C:^?????????????????????????? ??????????????????????s and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\?????????????????????????????????????????? ??????s and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^?????????????????????????? ??????????????????????s and Settings^All Users^Start Menu^Programs^Startup^PalStart.lnk]
path=C:\?????????????????????????????????????????? ??????s and Settings\All Users\Start Menu\Programs\Startup\PalStart.lnk
backup=C:\WINDOWS\pss\PalStart.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 07:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 08/04/2004 05:32 AM 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 10/18/2007 11:34 AM 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 11:50 AM 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 08/04/2004 05:32 AM 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 08/04/2004 05:32 AM 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
--a------ 11/26/2006 10:30 AM 97357 C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 02/16/2008 08:10 PM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DAP\\DAP.exe"=
"C:\\Program Files\\Windows Live Messenger Khalid Edition v5.1\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R1 Klmc;Klmc;C:\WINDOWS\system32\drivers\klmc.sys [08/30/2005 04:52 AM]
R3 als4k;Xwave 4000 Sound Driver (WDM);C:\WINDOWS\system32\drivers\als4000.sys [03/05/2000 10:59 PM]
R3 ALS4KMF;ALS4KMF;C:\WINDOWS\system32\drivers\mf.sys [08/03/2004 11:07 PM]
R3 alsgame;Gameport for Xwave 4000;C:\WINDOWS\system32\drivers\alsgame.sys [02/24/2000 05:45 AM]
R3 AtiBt829;WDM Video Capture For AIW (AtiBt829);C:\WINDOWS\system32\DRIVERS\AtiBt829.sy s [08/17/2001 12:49 PM]
R3 ATITVAUDIO;WDM TVAudio (ATITVSnd);C:\WINDOWS\system32\DRIVERS\atitvsnd.sy s [08/17/2001 12:49 PM]
R3 ATIXBAR;ATI Video Audio Crossbar (ATIXBar);C:\WINDOWS\system32\DRIVERS\atixbar.sys [08/17/2001 12:49 PM]
*Newly Created Service* - UPNPHOST
.
************************************************** ************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-03-04 22:17:32
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
Completion time: 03/04/2008 22:19:56
ComboFix-quarantined-files.txt 2008-03-05 06:19:46
.png)
.png)
