ComboFix 09-05-17.05 - xp 05/18/2009 16:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.758.347 [GMT 3:00]
Running from: c:\documents and settings\xp\سطح المكتب\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
F:\cb.exe
F:\qoes.bat
F:\qwtb.com
.
((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))
.
2009-05-18 13:55 . 2009-05-18 13:55 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-18 13:53 . 2009-05-18 13:53 -------- d-----w c:\documents and settings\xp\Application Data\Media Player Classic
2009-05-18 12:59 . 2009-05-18 12:59 -------- d-----w c:\windows\LastGood
2009-05-18 12:58 . 2009-05-18 12:58 -------- d-s---w c:\documents and settings\xp\UserData
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 13:00 . 2001-09-19 12:00 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-18 13:00 . 2001-09-19 12:00 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-18 12:55 . 2009-05-17 18:43 -------- d-----w c:\program files\Yahoo!
2009-05-17 18:54 . 2009-05-17 18:53 -------- d-----w c:\program files\WebcamMax
2009-05-17 18:53 . 2009-05-17 18:44 -------- d-----w c:\program files\Paltalk Messenger
2009-05-17 18:43 . 2009-05-17 18:43 -------- d-----w c:\program files\Common Files\ACD Systems
2009-05-17 18:43 . 2009-05-17 18:43 -------- d-----w c:\program files\ACD Systems
2009-05-17 18:41 . 2009-05-17 18:41 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-17 18:41 . 2009-05-17 18:41 -------- d-----w c:\program files\Windows Live
2009-05-17 18:41 . 2009-05-17 18:37 -------- d-----w c:\program files\MSN Messenger
2009-05-17 18:41 . 2009-05-17 18:41 27264 ----a-w c:\documents and settings\xp\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-17 18:35 . 2009-05-17 18:35 -------- d-----w c:\program files\FlashGet
2009-05-17 18:34 . 2009-05-17 18:34 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-17 18:34 . 2009-05-17 18:34 -------- d-----w c:\program files\Java
2009-05-17 18:28 . 2009-05-17 18:28 -------- d-----w c:\program files\ESET
2009-05-17 18:26 . 2009-05-17 18:26 -------- d-----w c:\program files\Common Files\xing shared
2009-05-17 18:26 . 2009-05-17 18:26 -------- d-----w c:\program files\Real
2009-05-17 18:26 . 2009-05-17 18:26 -------- d-----w c:\program files\Common Files\Real
2009-05-17 18:26 . 2009-05-17 18:24 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-17 18:26 . 2009-05-17 18:24 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-17 18:24 . 2009-05-17 18:24 -------- d-----w c:\program files\K-Lite Codec Pack
2009-05-17 18:17 . 2009-05-17 16:55 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-17 18:16 . 2009-05-17 18:16 17801 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-05-17 18:16 . 2009-05-17 18:16 -------- d-----w c:\program files\Atheros
2009-05-17 18:16 . 2009-05-17 16:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-17 18:14 . 2009-05-17 18:14 -------- d-----w c:\program files\acer
2009-05-17 18:13 . 2009-05-17 18:13 -------- d-----w c:\program files\CONEXANT
2009-05-17 18:13 . 2009-05-17 18:13 -------- d-----w c:\program files\Synaptics
2009-05-17 16:56 . 2009-05-17 16:56 -------- d-----w c:\program files\Intel
2009-05-17 16:49 . 2009-05-17 16:49 -------- d-----w c:\program files\microsoft frontpage
2009-05-17 16:45 . 2009-05-17 16:45 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-09 12:21 . 2009-04-09 12:21 55768 ----a-w c:\windows\system32\drivers\epfwtdi.sys
2009-04-09 12:21 . 2009-04-09 12:21 33096 ----a-w c:\windows\system32\drivers\epfwndis.sys
2009-04-09 12:21 . 2009-04-09 12:21 133000 ----a-w c:\windows\system32\drivers\epfw.sys
2009-04-09 12:18 . 2009-04-09 12:18 107256 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-04-09 12:10 . 2009-04-09 12:10 113960 ----a-w c:\windows\system32\drivers\eamon.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"IDMan"="c:\documents and settings\xp\سطح المكتب\اختصار\IDMan.exe" [2008-11-25 935856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 688218]
"acerWireless"="c:\program files\acer\Wireless\Utility\WlanUtil.exe" [2004-06-09 417792]
"ACU"="c:\program files\Atheros\ACU.exe" [2005-01-31 253952]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-17 185896]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-04-09 2029640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-17 148888]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-4-25 11057664]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [09/04/2009 03:18 م 107256]
R2 CAMTHWDM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\CAMTHWDM.sys [17/05/2009 09:54 م 941784]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [09/04/2009 03:19 م 731840]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Device Detector - DevDetect.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.googel.com/
uInternet Connection Wizard,ShellNext = hxxp://codecs.r8.org/
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=%s
IE: تحميل الكل بواسطة Internet Download Manager - c:\documents and settings\xp\سطح المكتب\اختصار\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\documents and settings\xp\سطح المكتب\اختصار\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\documents and settings\xp\سطح المكتب\اختصار\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-18 16:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
? [29048]
? [2832]
? [2848]
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-18 17:01
ComboFix-quarantined-files.txt 2009-05-18 14:00
Pre-Run: 27,243,077,632 bytes free
Post-Run: 27,419,582,464 bytes free
123 --- E O F --- 2009-05-17 19:41