ComboFix 09-05-25.08 - acer 05/28/2009 15:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.502.237 [GMT -7:00]
Running from: c:\documents and settings\acer\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1gk8ha.bat
C:\2u.com
C:\3rl3lqbq.bat
C:\6fnlpetp.exe
C:\9.cmd
C:\abk.bat
C:\bo1dhu.bat
c:\docume~1\acer\LOCALS~1\wql.vvw
c:\documents and settings\acer\Application Data\FunWebProducts
c:\documents and settings\LocalService\Application Data\twain_32
c:\documents and settings\LocalService\Application Data\twain_32\user.ds
c:\documents and settings\NetworkService\Application Data\twain_32
c:\documents and settings\NetworkService\Application Data\twain_32\user.ds
C:\ev60a2.cmd
C:\h3.bat
C:\ij.bat
C:\iqe68o.bat
C:\lky.exe
C:\m2nl.bat
C:\m9ma.exe
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\FunWebProducts\Shared\Cache\WebfettiBtn.html
c:\program files\Internet Explorer\msimg32.dll
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\
00034FD6
c:\program files\MyWebSearch\bar\Cache\
00038137
c:\program files\MyWebSearch\bar\Cache\
00038984.bin
c:\program files\MyWebSearch\bar\Cache\
000393D5.bin
c:\program files\MyWebSearch\bar\Cache\
0003976F.bin
c:\program files\MyWebSearch\bar\Cache\
00039B66.bin
c:\program files\MyWebSearch\bar\Cache\
00039E54
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\system32\acpiz.dll
c:\windows\system32\acup.sys
c:\windows\system32\bb1.dat
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\ckvo1.dll
c:\windows\system32\cs.dat
c:\windows\system32\drivers\mrxdavv.sys
c:\windows\system32\gasretyw0.dll
c:\windows\system32\gasretyw1.dll
c:\windows\system32\k86.bin
c:\windows\system32\kamsoft.exe
c:\windows\system32\kwave.sys
c:\windows\system32\paso.el
c:\windows\system32\ps1.dat
c:\windows\system32\rc.dat
c:\windows\system32\sysservice.dll
c:\windows\system32\sysservice.exe
c:\windows\system32\sysservice2.exe
c:\windows\system32\tb.dr
c:\windows\system32\twain_32
c:\windows\system32\twain_32\
00008339.uf
c:\windows\system32\twain_32\
0000A98E.uf
c:\windows\system32\twain_32\
00068EC5.uf
c:\windows\system32\twain_32\
00180B74.uf
c:\windows\system32\twain_32\
0061D857.uf
c:\windows\system32\twain_32\
007E848C.uf
c:\windows\system32\twain_32\
00A7F754.uf
c:\windows\system32\twain_32\
00ADA791.uf
c:\windows\system32\twain_32\
00DEF65E.uf
c:\windows\system32\twain_32\
01A0C83A.uf
c:\windows\system32\twain_32\
01DF0EFA.uf
c:\windows\system32\twain_32\
028CD993.uf
c:\windows\system32\twain_32\
028FBB8D.uf
c:\windows\system32\twain_32\
02DEAA28.uf
c:\windows\system32\twain_32\
030D629B.uf
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twain_32\user.ds.cla
c:\windows\system32\twext.exe
c:\windows\system32\vamsoft.exe
c:\windows\system32\vbsdfe0.dll
c:\windows\system32\vbsdfe1.dll
c:\windows\ynh.dx
C:\xih9.cmd
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-28 )))))))))))))))))))))))))))))))
.
2009-05-28 22:27 . 2009-05-28 22:27 -------- d-----w c:\program files\Trend Micro
2009-05-28 21:09 . 2008-12-23 18:18 104448 ----a-w c:\windows\system32\drivers\br3gmdm.sys
2009-05-27 03:47 . 2007-10-23 16:27 110592 ----a-w c:\documents and settings\acer\Application Data\U3\temp\cleanup.exe
2009-05-27 03:47 . 2008-05-02 17:41 3493888 ---ha-w c:\documents and settings\acer\Application Data\U3\temp\Launchpad Removal.exe
2009-05-27 03:47 . 2009-05-27 03:49 -------- d-----w c:\documents and settings\acer\Application Data\U3
2009-05-26 02:19 . 2009-05-26 05:48 -------- d-----w c:\program files\MessengerPlus! 3(2)
2009-05-24 02:43 . 2009-05-26 05:48 -------- d-----w c:\program files\القرآن الكريم تلاوة وتحفيظا - السديس والشريم
2009-05-12 03:23 . 2009-05-12 03:23 390664 ----a-w c:\documents and settings\acer\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-09 04:49 . 2008-02-15 22:12 24448 ----a-r c:\windows\system32\drivers\ewdcsc.sys
2009-05-09 04:49 . 2008-02-15 22:12 101120 ----a-r c:\windows\system32\drivers\ewusbmdm.sys
2009-05-07 03:08 . 2009-05-09 04:50 -------- d-----w c:\program files\Mobily Connect Card
2009-05-03 06:20 . 2009-05-09 03:59 -------- d-----w c:\program files\REALTEK USB Wireless LAN Driver and Utility
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-28 22:31 . 2008-10-25 18:27 14 ----a-w c:\windows\system32\axt.bin
2009-05-26 05:48 . 2008-08-12 09:32 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-26 05:48 . 2008-08-12 09:31 -------- d-----w c:\program files\MSN Messenger
2009-05-09 03:59 . 2008-09-03 16:30 -------- d-----w c:\program files\Google
2009-05-03 06:19 . 2008-08-12 08:34 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-20 08:34 . 2009-04-20 08:34 -------- d-----w c:\program files\FLV Player
2009-04-06 08:29 . 2009-04-06 08:29 -------- d-----w c:\documents and settings\acer\Application Data\ESET
2009-03-24 13:58 . 2009-03-24 13:58 2678 ----a-w c:\windows\java\Packages\Data\Z9N9737T.DAT
2009-03-24 13:58 . 2009-03-24 13:58 2678 ----a-w c:\windows\java\Packages\Data\IR9RTZ73.DAT
2009-03-24 13:58 . 2009-03-24 13:58 2678 ----a-w c:\windows\java\Packages\Data\NRVFXBFH.DAT
2009-03-24 13:58 . 2009-03-24 13:58 2678 ----a-w c:\windows\java\Packages\Data\KIT7LF5V.DAT
2009-03-24 13:58 . 2009-03-24 13:58 2678 ----a-w c:\windows\java\Packages\Data\FJPBTBF7.DAT
2009-03-16 02:45 . 2009-03-16 02:45 43520 ----a-w c:\windows\system32\sysservice1.exe
2009-03-09 03:23 . 2009-03-09 03:23 89088 --s-a-r c:\windows\system32\psjnmp.dll
2009-03-07 05:21 . 2009-03-07 05:20 43520 ----a-w c:\windows\system32\
0stp.exe
2009-03-01 09:17 . 2009-03-01 09:17 8752 ----a-w c:\windows\system32\drivers\cdaudio.sys
2009-03-01 09:17 . 2009-03-01 09:17 8752 ----a-w c:\windows\system32\eeekp.sys
2009-03-01 09:17 . 2009-03-01 09:17 50851 ----a-w c:\windows\system32\wdh.bin
2009-03-01 09:17 . 2009-03-01 09:17 24175 ----a-w c:\windows\system32\eeekp.dll
2008-04-07 07:07 . 2008-08-12 09:32 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-04-07 07:07 . 2008-08-12 09:32 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-04-07 07:07 . 2008-08-12 09:32 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-04-07 07:07 . 2008-08-12 09:32 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-10-26 03:07 . 2008-10-06 06:31 3838496 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-10-26 03:07 . 2008-10-06 06:31 34848 --sha-w c:\windows\system32\drivers\fidbox2.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-12 185896]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-11 1447168]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-1 568176]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^lsass.exe]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\lsass.exe
backup=c:\windows\pss\lsass.exeCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"55520:UDP"= 55520:UDP:MakerOffline DistributionGallery
"14468:TCP"= 14468:TCP:MakerOffline GlobalizationAgent
"41097:UDP"= 41097:UDP:MakerOffline ShellJava
"14057:TCP"= 14057:TCP:MakerOffline SoftwareComponents
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [30/03/2009 10:17 ص 87264]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [10/06/2008 06:53 م 468224]
S1 acup;VPower Control Service;c:\windows\system32\acup.sys --> c:\windows\system32\acup.sys [?]
S1 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [01/03/2009 02:17 ص 8752]
S2 ERlogon;Backup Image;c:\windows\system32\svchost.exe -k netsvcs [03/08/2004 02:56 م 14336]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [28/05/2009 02:09 م 104448]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [10/01/2009 06:45 م 194304]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ERlogon
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search -
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java -
DPF: {8C159DFD-DC9C-4077-B3B6-114A8D64B6D2} - hxxp://voice7.emkanat.com/cp/files/talk3.cab
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://67.198.202.138/ReadUid.CAB
DPF: {C171FF59-8C55-4796-A398-4F5D02B4C763} - hxxp://76.76.24.78/imscp/talks3n.cab
FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-28 15:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ERlogon]
"ServiceDll"="c:\windows\system32\psjnmp.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2656)
c:\program files\ESET\ESET NOD32 Antivirus\eplgHooks.dll
c:\windows\system32\btmmhook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
.
**************************************************************************
.
Completion time: 2009-05-28 15:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-28 22:54
Pre-Run: 32,297,852,928 bytes free
Post-Run: 33,428,234,240 bytes free
276
