ComboFix 09-06-06.04 - Administrator 06/07/2009 19:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1014.596 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\mpg4c32.dll
c:\windows\system32\x64
.
((((((((((((((((((((((((( Files Created from 2009-05-07 to 2009-06-07 )))))))))))))))))))))))))))))))
.
2009-06-06 16:25 . 2009-06-06 16:28 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-06 16:24 . 2009-06-06 16:24 56 --sh--r- c:\windows\system32\55DA2E7447.sys
2009-06-06 16:24 . 2009-06-06 16:24 2098 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-06-06 16:24 . 2009-06-06 16:24 -------- d-----w- c:\program files\DivX
2009-06-06 16:05 . 2004-08-03 20:08 26496 -c--a-w- c:\windows\system32\dllcache\usbstor.sys
2009-06-06 15:50 . 2009-06-06 15:50 -------- d-----w- c:\program files\Wireless WEP Key Password Spy
2009-05-30 05:06 . 2009-05-30 05:06 390664 ----a-w- c:\documents and settings\Administrator\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-30 04:49 . 2009-05-30 04:49 -------- d-----w- c:\program files\Common Files\xing shared
2009-05-30 04:49 . 2009-05-30 04:49 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-30 04:49 . 2009-05-30 04:49 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-30 04:49 . 2009-05-30 04:49 -------- d-----w- c:\program files\Common Files\Real
2009-05-30 04:48 . 2009-05-30 04:48 -------- d-----w- c:\program files\Real
2009-05-30 01:29 . 2009-05-30 01:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\aAvgApi
2009-05-27 17:22 . 2009-05-27 15:10 58952 ----a-w- c:\windows\system32\MsgPlusLoader.dll
2009-05-27 16:09 . 2009-05-27 16:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-27 16:08 . 2009-05-27 16:08 -------- d-----w- c:\program files\Circle Developement
2009-05-27 16:08 . 2009-05-27 16:10 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-27 16:03 . 2009-05-27 16:03 -------- d-----w- c:\documents and settings\Administrator\Contacts
2009-05-27 15:55 . 2009-05-27 15:57 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-05-27 15:55 . 2009-05-27 16:06 -------- d-----w- c:\program files\Windows Live
2009-05-27 15:55 . 2009-05-27 15:55 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-05-27 15:48 . 2009-05-27 15:48 -------- d--h--w- c:\windows\$hf_mig$
2009-05-27 15:41 . 2008-10-16 11:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-05-27 15:11 . 2009-05-27 15:11 -------- d--h--w- C:\$AVG8.VAULT$
2009-05-27 15:10 . 2009-05-27 15:11 -------- d-----w- c:\program files\Adverts
2009-05-27 15:10 . 2009-05-27 15:10 -------- d-----w- c:\program files\MessengerPlus! 3
2009-05-27 15:10 . 2009-05-27 15:10 -------- d-s---w- c:\documents and settings\Administrator\UserData
2009-05-27 15:06 . 2009-05-27 15:09 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-05-26 20:16 . 2009-05-26 20:16 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-26 20:16 . 2009-05-26 20:16 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-26 20:16 . 2009-05-26 20:16 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-26 20:16 . 2009-05-26 20:16 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-26 20:16 . 2009-06-07 15:04 -------- d-----w- c:\windows\system32\drivers\Avg
2009-05-26 20:16 . 2009-06-01 15:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVGTOOLBAR
2009-05-26 20:16 . 2009-05-26 20:16 -------- d-----w- c:\program files\AVG
2009-05-26 20:16 . 2009-05-26 20:16 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-05-26 20:08 . 2009-05-26 20:08 16608 ----a-w- c:\windows\gdrv.sys
2009-05-26 20:05 . 2009-05-26 20:05 45056 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{42929F0F-CE14-47AF-9FC7-FF297A603021}\NewShortcut1_42929F0FCE1447AF9FC7FF297A603021_1.exe
2009-05-26 20:05 . 2009-05-26 20:05 10134 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{42929F0F-CE14-47AF-9FC7-FF297A603021}\ARPPRODUCTICON.exe
2009-05-26 20:05 . 2009-05-26 20:05 -------- d-----w- c:\windows\system32\vmm32
2009-05-26 20:00 . 2006-10-26 16:58 30512 ----a-w- c:\windows\system32\mdimon.dll
2009-05-26 19:59 . 2006-10-26 16:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-05-26 19:58 . 2009-05-26 19:59 -------- d-----w- c:\program files\Microsoft Works
2009-05-26 19:58 . 2009-05-26 19:58 -------- d-----w- c:\program files\MSBuild
2009-05-26 19:54 . 2009-05-26 19:58 -------- d-----w- c:\windows\SHELLNEW
2009-05-26 19:54 . 2009-05-26 19:54 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help
2009-05-26 19:54 . 2009-05-26 20:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-26 19:53 . 2009-05-26 19:53 -------- d--h--r- C:\MSOCache
2009-05-26 19:51 . 2007-05-16 13:49 172032 ----a-r- c:\windows\system32\igfxres.dll
2009-05-26 19:48 . 2009-05-26 19:48 -------- d-----w- c:\program files\Marvell
2009-05-26 19:48 . 2009-05-26 19:48 -------- d-----w- C:\Intel
2009-05-26 19:47 . 2009-05-26 19:47 -------- d-----w- c:\documents and settings\Administrator\Bluetooth Software
2009-05-26 19:46 . 2007-03-23 07:50 37280 ----a-w- c:\windows\system32\drivers\btwmodem.sys
2009-05-26 19:46 . 2007-03-31 10:02 55352 ----a-w- c:\windows\system32\drivers\btwhid.sys
2009-05-26 19:46 . 2007-03-23 07:50 149123 ----a-w- c:\windows\system32\drivers\btwdndis.sys
2009-05-26 19:46 . 2007-03-23 07:50 37424 ----a-w- c:\windows\system32\drivers\btport.sys
2009-05-26 19:46 . 2007-03-31 10:02 876384 ----a-w- c:\windows\system32\drivers\btkrnl.sys
2009-05-26 19:46 . 2007-03-23 07:49 539072 ----a-w- c:\windows\system32\drivers\btaudio.sys
2009-05-26 19:46 . 2009-05-26 19:46 -------- d-----w- c:\program files\WIDCOMM
2009-05-26 19:43 . 2007-02-19 11:27 90112 ----a-r- c:\windows\system32\stacsv.exe
2009-05-26 19:43 . 2007-02-19 11:26 303104 ----a-r- c:\windows\stsystra.exe
2009-05-26 19:43 . 2007-02-19 11:26 1601536 ----a-r- c:\windows\system32\stlang.dll
2009-05-26 19:43 . 2007-02-19 11:27 1228296 ----a-r- c:\windows\system32\drivers\sthda.sys
2009-05-26 19:43 . 2007-02-19 11:26 266240 ----a-r- c:\windows\system32\stacapi.dll
2009-05-26 19:43 . 2007-02-19 11:26 142848 ----a-r- c:\windows\system32\staco.dll
2009-05-26 19:42 . 2006-12-06 14:40 108032 ----a-r- c:\windows\system32\drivers\IntcHdmi.sys
2009-05-26 19:42 . 2004-08-03 20:08 60288 -c--a-w- c:\windows\system32\dllcache\drmk.sys
2009-05-26 19:42 . 2004-08-03 20:08 60288 ----a-w- c:\windows\system32\drivers\drmk.sys
2009-05-26 19:41 . 2009-05-26 19:41 -------- d-----w- c:\program files\CONEXANT
2009-05-26 19:41 . 2007-07-24 12:08 217088 ----a-r- c:\windows\system32\UCI32M21.dll
2009-05-26 19:41 . 2006-06-19 11:26 94208 ----a-r- c:\windows\system32\mdmxsdk.dll
2009-05-26 19:41 . 2007-08-02 14:35 989952 ----a-r- c:\windows\system32\drivers\HSF_DPV.sys
2009-05-26 19:41 . 2007-08-02 14:34 211200 ----a-r- c:\windows\system32\drivers\HSFHWAZL.sys
2009-05-26 19:41 . 2006-06-19 11:26 12672 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys
2009-05-26 19:41 . 2007-08-02 14:34 731136 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys
2009-05-26 19:28 . 2007-03-23 07:50 67960 ----a-w- c:\windows\system32\drivers\btwusb.sys
2009-05-26 19:28 . 2007-03-23 07:50 106557 ----a-r- c:\windows\system32\btw_ci.dll
2009-05-26 19:27 . 2008-01-23 11:56 38400 ----a-r- c:\windows\system32\drivers\rixdptsk.sys
2009-05-26 19:27 . 2008-01-23 11:56 172032 ----a-r- c:\windows\system32\rixdicon.dll
2009-05-26 19:26 . 2008-01-23 11:56 45568 ----a-r- c:\windows\system32\drivers\rimmptsk.sys
2009-05-26 19:26 . 2005-02-25 03:35 22752 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-26 19:26 . 2009-05-26 19:26 -------- d-----w- c:\program files\Hewlett-Packard
2009-05-26 19:25 . 2009-05-26 19:25 -------- d-----w- C:\SWSetup
2009-05-26 19:22 . 2009-05-26 19:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-05-26 19:22 . 2008-01-23 11:56 90112 ----a-r- c:\windows\system32\snymsico.dll
2009-05-26 19:22 . 2008-01-23 11:56 43008 ----a-r- c:\windows\system32\drivers\rimsptsk.sys
2009-05-26 19:21 . 2009-05-26 19:21 -------- d-----w- C:\dell
2009-05-26 19:21 . 2009-05-26 19:21 -------- d-----w- c:\program files\SigmaTel
2009-05-26 19:21 . 2009-05-26 19:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-26 19:20 . 2009-05-26 19:25 -------- d-----w- c:\program files\Common Files\InstallShield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-06 16:26 . 2009-06-06 16:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-05-27 16:07 . 2009-05-26 16:55 369456 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-27 15:51 . 2009-05-27 15:51 2232 ----a-w- c:\windows\java\Packages\Data\BJDZJR3T.DAT
2009-05-27 15:51 . 2009-05-27 15:51 155995 ----a-w- c:\windows\java\Packages\40E8UBFT.ZIP
2009-05-27 15:51 . 2009-05-27 15:51 2678 ----a-w- c:\windows\java\Packages\Data\O81NZ1ND.DAT
2009-05-27 15:51 . 2009-05-27 15:51 2678 ----a-w- c:\windows\java\Packages\Data\3RNXVXVV.DAT
2009-05-27 15:51 . 2009-05-27 15:51 2678 ----a-w- c:\windows\java\Packages\Data\DB3F9F57.DAT
2009-05-27 15:51 . 2009-05-27 15:51 2678 ----a-w- c:\windows\java\Packages\Data\BTJJF5JN.DAT
2009-05-27 15:51 . 2009-05-27 15:51 2678 ----a-w- c:\windows\java\Packages\Data\22A6YX3T.DAT
2009-05-26 19:23 . 2009-05-26 19:23 -------- d-----w- c:\program files\Dell
2009-05-26 16:56 . 2009-05-26 16:03 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-26 16:04 . 2009-05-26 16:04 -------- d-----w- c:\program files\microsoft frontpage
2009-05-26 16:01 . 2009-05-26 16:01 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.
------- Sigcheck -------
[-] 2008-01-19 17:46 1580544 9F960FAC5166F8626B9CDE4DD9A0EB84 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-09 2183168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-05-16 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-05-16 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-05-16 137752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-26 1947928]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-30 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-02-19 303104]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-26 20:16 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\MsgPlusLoader.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 ulsata2;ulsata2;c:\windows\system32\drivers\ulsata2.sys [15/01/2008 10:19 ص 124928]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [26/05/2009 11:16 م 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [26/05/2009 11:16 م 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [26/05/2009 11:16 م 298776]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [26/05/2009 10:42 م 108032]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-07 19:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(960)
c:\windows\system32\MsgPlusLoader.dll
c:\windows\System32\BCMLogon.dll
- - - - - - - > 'lsass.exe'(1016)
c:\windows\system32\MsgPlusLoader.dll
.
Completion time: 2009-06-07 19:34
ComboFix-quarantined-files.txt 2009-06-07 16:34
Pre-Run: 14,208,028,672 bytes free
Post-Run: 14,704,373,760 bytes free
198
