ComboFix 09-05-20.A1 - ابوابراهيم 05/21/2009 17:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1014.516 [GMT 3:00]
Running from: c:\documents and settings\ابوابراهيم\سطح المكتب\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\101.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\prsgrc.dll
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-04-21 to 2009-05-21 )))))))))))))))))))))))))))))))
.
2009-05-19 17:47 . 2009-05-19 17:47 -------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-05-19 17:46 . 2009-05-19 17:46 -------- d-----w c:\program files\Hewlett-Packard
2009-05-19 17:45 . 2003-04-22 07:24 16606 ------w c:\windows\hpomdl01.dat
2009-05-19 17:45 . 2009-05-19 17:48 19575 ----a-w c:\windows\hpoins01.dat
2009-05-19 17:45 . 2009-05-19 17:45 -------- d-----w C:\temp
2009-05-19 17:45 . 2009-05-19 17:45 -------- d-----w c:\temp\HP All-in-One Series Web Release
2009-05-11 17:02 . 2009-05-11 17:03 -------- d-----w C:\images
2009-05-07 22:32 . 2009-05-07 22:32 -------- d-----w C:\المستندات
2009-05-07 22:00 . 1998-10-29 13:45 306688 ----a-w c:\windows\IsUninst.exe
2009-05-07 19:54 . 2009-05-07 20:10 -------- d-----w c:\documents and settings\ابوابراهيم\Application Data\TeamViewer
2009-04-23 08:26 . 2009-04-23 08:26 -------- d-----w c:\program files\Ask Search Assistant
2009-04-22 12:23 . 2009-04-22 12:23 -------- d-----w c:\program files\iPod
2009-04-22 12:23 . 2009-04-22 12:23 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-22 12:20 . 2009-04-22 12:20 -------- d-----w c:\program files\QuickTime
2009-04-22 11:57 . 2009-04-22 11:57 -------- d-----w c:\program files\Bonjour
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-21 14:20 . 2009-01-09 13:23 -------- d-----w c:\program files\Easy-Hide-IP
2009-05-09 16:53 . 2008-10-09 14:24 208796 ---ha-w c:\windows\system32\mlfcache.dat
2009-05-09 16:44 . 2008-07-17 05:21 339464 ----a-w c:\documents and settings\ابوابراهيم\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-03 19:48 . 2001-09-19 15:00 59764 ----a-w c:\windows\system32\perfc001.dat
2009-05-03 19:48 . 2001-09-19 15:00 331594 ----a-w c:\windows\system32\perfh001.dat
2009-04-23 08:26 . 2008-07-17 07:21 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-22 12:23 . 2008-08-05 23:27 -------- d-----w c:\program files\iTunes
2009-04-22 12:23 . 2008-08-05 23:25 -------- d-----w c:\program files\Common Files\Apple
2009-04-22 12:02 . 2008-10-09 13:48 -------- d-----w c:\program files\Safari
2009-04-16 06:47 . 2009-04-16 06:47 -------- d-----w c:\program files\iColorFolder
2009-04-15 22:20 . 2009-04-15 22:18 -------- d-----w c:\program files\SWiSHmax
2009-04-15 16:01 . 2009-04-14 14:15 44544 ------w c:\windows\AWuninstall.exe
2009-04-14 14:15 . 2009-04-14 14:15 -------- d-----w c:\program files\Lokas
2009-04-14 13:59 . 2009-04-14 13:59 -------- d-----w c:\program files\Alien Skin
2009-04-08 13:10 . 2009-04-08 13:10 -------- d-----w c:\program files\BandRich
2009-03-19 13:32 . 2008-01-29 09:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:20 . 2004-08-04 00:55 283136 ----a-w c:\windows\system32\pdh.dll
2009-02-28 19:07 . 2009-02-03 13:30 664 ----a-w c:\windows\system32\d3d9caps.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-18 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-30 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-30 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-30 138008]
"CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-07-17 949376]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-07 185872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-17 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Mobily Connect Card\\Mobily Connect Card.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\AppServ\\Apache2.2\\bin\\httpd.exe"=
"c:\\AppServ\\MySQL\\bin\\mysqld-nt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9141:TCP"= 9141:TCP:BitComet 9141 TCP
"9141:UDP"= 9141:UDP:BitComet 9141 UDP
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [17/07/2008 10:22 ص 15424]
R2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [09/01/2007 07:17 م 20539]
R2 Prvflder;Prvflder;c:\windows\system32\drivers\prvflder.sys [21/04/2006 08:22 ص 70912]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [08/04/2009 04:10 م 100096]
.
Contents of the 'Scheduled Tasks' folder
2009-05-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 09:34]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-DRV ACID - c:\docume~1\C0F9~1\APPLIC~1\LONGFO~1\StartInside.exe
HKLM-Run-Device Detector - DevDetect.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\windows\system32\imon.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-21 17:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mysql]
"ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1993962763-1532298954-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="a"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):68,62,fc,46,9b,97,6f,c6,aa,89,c9,5f,9b,cd,f3,30,cf,68,9a,63,92,
2a,51,fe,f2,41,cd,7e,5a,29,14,cc,4e,3e,fc,d0,11,ee,7a,b1,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{999ab619-21ef-4514-a332-593dc8c693ff}]
@Denied: (Full) (Everyone)
"Model"=dword:000000e3
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(1012)
c:\windows\system32\imon.dll
.
Completion time: 2009-05-21 17:30
ComboFix-quarantined-files.txt 2009-05-21 14:29
Pre-Run: 26,757,808,128 bytes free
Post-Run: 33,926,983,680 bytes free
160 --- E O F --- 2009-05-13 21:04
