ComboFix 09-05-19.08 - toshiba 05/20/2009 11:55.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.966.1033.18.2939.1944 [GMT 3:00]
Running from: D:\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 )))))))))))))))))))))))))))))))
.
2009-05-19 08:30 . 2009-05-19 08:31 -------- d-----w c:\users\toshiba\AppData\Roaming\Media Player Classic
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-14 00:00 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-04-24 14:33 . 2009-02-25 17:39 429392 ----a-w c:\users\toshiba\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-19 21:21 . 2009-04-19 21:19 -------- d-----w c:\program files\All2Chat
2009-04-17 18:52 . 2009-02-26 03:32 -------- d-----w c:\program files\McAfee
2009-04-07 18:41 . 2009-04-07 11:13 132864 ----a-w c:\windows\hppins20.dat
2009-04-07 13:57 . 2008-08-07 16:54 -------- d-----w c:\program files\Picasa2
2009-04-07 11:20 . 2009-04-07 11:15 -------- d-----w c:\program files\HP
2009-04-07 11:20 . 2009-04-07 11:18 -------- d-----w c:\program files\Common Files\HP
2009-03-27 01:27 . 2009-02-26 03:32 -------- d-----w c:\program files\Circle Developement
2009-03-26 17:08 . 2009-03-26 17:07 -------- d-----w c:\program files\مصحف المدينة النبوية
2009-03-26 17:08 . 2008-08-07 16:20 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-26 17:08 . 2008-08-07 16:17 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-25 08:06 . 2009-02-26 03:33 40552 ----a-w c:\windows\system32\drivers\mfesmfk.sys
2009-03-25 08:06 . 2009-02-26 03:33 79880 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-03-25 08:06 . 2009-02-26 03:33 35272 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-03-25 08:06 . 2009-02-26 03:33 214024 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-03-25 08:05 . 2009-02-26 03:33 34216 ----a-w c:\windows\system32\drivers\mferkdk.sys
2009-03-17 03:38 . 2009-04-15 19:37 13824 ----a-w c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 19:37 24064 ----a-w c:\windows\system32\amxread.dll
2009-03-03 04:46 . 2009-04-15 19:39 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 19:39 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-15 19:38 827392 ----a-w c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-15 19:39 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 19:39 551424 ----a-w c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 19:39 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 19:38 78336 ----a-w c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-15 19:39 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 19:39 54784 ----a-w c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-15 19:39 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-15 19:39 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 19:39 17408 ----a-w c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-15 19:38 26624 ----a-w c:\windows\system32\ieUnatt.exe
2009-02-26 03:31 . 2009-02-26 03:31 410984 ----a-w c:\windows\system32\deploytk.dll
2009-02-26 03:25 . 2009-02-26 03:25 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-02-26 03:25 . 2009-02-26 03:25 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-02-26 03:24 . 2009-02-26 03:24 196608 ----a-w c:\windows\system32\maag.dll
2009-02-26 03:24 . 2009-02-26 03:24 1212416 ----a-w c:\windows\system32\ckll.dll
2009-02-26 03:24 . 2009-02-26 03:24 1245184 ----a-w c:\windows\system32\bkll.dll
2009-02-26 03:24 . 2009-02-26 03:24 90112 ----a-w c:\windows\system32\agsaami.dll
2009-02-26 03:24 . 2009-02-26 03:24 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-02-26 03:24 . 2009-02-26 03:24 1986560 ----a-w c:\windows\system32\akll.dll
2009-02-26 03:24 . 2009-02-26 03:24 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-02-26 03:24 . 2009-02-26 03:24 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-02-25 20:22 . 2009-02-25 20:22 319456 ----a-w c:\windows\DIFxAPI.dll
2009-02-25 20:22 . 2009-02-25 20:22 315392 ----a-w c:\windows\HideWin.exe
2008-01-21 02:43 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BASEGREY"="c:\programdata\32 link link.v87jl8" [X]
"Okay Proxy Ooze Each"="c:\programdata\Atom Coal Default.616miie" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2008-01-21 49664]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater\AdobeUpdater.exe" [2005-03-16 970752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-26 148888]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-04-24 103824]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 145944]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-06-24 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-05-09 716800]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-08 645328]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"NDSTray.exe"="NDSTray.exe" [BU]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-04-08 6037504]
c:\users\toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{91457A03-B655-4289-A781-3AFC9FC62652}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{CBEA9905-DECC-4614-B69F-75E9A641B937}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7C9D2E59-8A40-4E46-911E-32D1D7763F67}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{A437C327-A20B-4204-8F8D-A380149C5823}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{47DF4F31-F674-4294-9AB7-FDDD6082438C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{7B445DD3-9765-4258-A326-86D8C99BAE96}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{EDBAFD07-A5AD-4535-BCD1-66B9C47C3C58}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{24FBA5EC-2BC8-478B-A90E-2785A7382C44}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CFF34A73-5E56-4D08-8EB9-D7BA31B741DD}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{B999A56C-615C-4A10-9D14-3270E505D220}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{DF93E536-6CFD-47E2-82A9-D019EB22C969}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80FCD6B8-4619-4946-B790-7AE4D0AEEC38}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\System32\drivers\RtlProt.sys [25/02/09 08:42 م 25896]
R2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [17/04/08 02:19 ص 40960]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [01/03/09 05:18 م 210216]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [24/04/08 12:21 م 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [06/02/08 05:12 م 126976]
R3 FwLnk;FwLnk Driver;c:\windows\System32\drivers\FwLnk.sys [07/08/08 07:24 م 7168]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\rtl8187B.sys [07/08/08 07:23 م 290304]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [24/04/08 06:35 م 73728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
2009-05-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2009-03-21 07:53]
2009-04-30 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2009-03-21 07:53]
2009-05-19 c:\windows\Tasks\User_Feed_Synchronization-{C955CBEF-4434-401C-B234-45F01DB627FA}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} -
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} -
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-20 11:59
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2009-05-20 12:00
ComboFix-quarantined-files.txt 2009-05-20 09:00
Pre-Run: 37,767,229,440 bytes free
Post-Run: 38,711,398,400 bytes free
182 --- E O F --- 2009-05-14 00:01
