combofix 09-06-07.03 - pcw 04/04/2009 1:04.1 - ntfsx86
microsoft windows xp professional 5.1.2600.2.1256.966.1033.18.503.269 [gmt 3:00]
running from: C:\downloads\combofix.exe
av: Avast! Antivirus 4.8.1335 [vps 090607-0] *on-access scanning disabled* (updated) {7591db91-41f0-48a3-b128-1a293fd8233d}
warning -this machine does not have the recovery console installed !!
.
((((((((((((((((((((((((((((((((((((((( other deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\program files\antispy2
c:\program files\antispy2\anti_spy.exe
c:\program files\antispy2\s.txt
c:\program files\antispy2\uninstall\irimg1.jpg
c:\program files\antispy2\uninstall\irimg2.jpg
c:\program files\antispy2\uninstall\irimg3.jpg
c:\program files\antispy2\uninstall\uninstall.dat
c:\program files\antispy2\uninstall\uninstall.xml
c:\windows\ie4 error log.txt
c:\windows\system32\drivers\toshiba_tecra a8_04491-ar_pta83e-01d02.mrk
.
((((((((((((((((((((((((((((((((((((((( drivers/services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\service_tcpsr
((((((((((((((((((((((((( files created from 2009-03-03 to 2009-04-03 )))))))))))))))))))))))))))))))
.
2009-04-03 21:58 . 2009-04-03 21:58 -------- d-----w- c:\windows\system32\wbem\repository
2009-04-03 21:57 . 2009-04-03 21:57 -------- d-----w- c:\program files\common files\xing shared
2009-04-03 21:44 . 2009-04-03 21:53 -------- d-----w- c:\documents and settings\pcw\tracing
2009-04-03 21:34 . 2009-04-03 21:34 -------- d-----w- c:\program files\microsoft sync framework
2009-04-03 21:33 . 2009-04-03 21:33 -------- d-----w- c:\program files\microsoft sql server compact edition
2009-04-03 21:30 . 2009-04-03 21:41 -------- d-----w- c:\wamp
2009-04-03 21:30 . 2009-04-03 21:30 -------- d-----w- c:\program files\microsoft
2009-04-03 21:12 . 2009-04-03 21:12 -------- d-----w- c:\program files\common files\windows live
.
(((((((((((((((((((((((((((((((((((((((( find3m report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-03 22:04 . 2008-11-17 21:02 -------- d-----w- c:\documents and settings\pcw\application data\skype
2009-04-03 21:57 . 2008-03-09 19:32 -------- d-----w- c:\program files\common files\real
2009-04-03 21:40 . 2008-03-09 19:29 -------- d-----w- c:\program files\windows live
2009-04-03 21:24 . 2008-03-09 19:26 -------- d-----w- c:\program files\google
2009-04-03 21:14 . 2008-11-17 21:07 -------- d-----w- c:\documents and settings\pcw\application data\skypepm
2009-04-03 21:13 . 2008-03-09 19:28 -------- d-----w- c:\program files\msn messenger
2009-04-03 21:10 . 2008-04-22 07:54 -------- d-----w- c:\documents and settings\pcw\application data\dna
2009-04-03 21:08 . 2008-03-09 17:30 167264 ----a-w- c:\documents and settings\pcw\local settings\application data\gdipfontcachev1.dat
2009-04-03 21:08 . 2008-04-09 14:50 -------- d-----w- c:\documents and settings\pcw\application data\orbit
2009-02-05 21:11 . 2008-03-12 17:06 1256296 ----a-w- c:\windows\system32\aswboot.exe
2009-02-05 21:08 . 2008-03-12 17:06 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-02-05 21:08 . 2008-03-12 17:06 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-02-05 21:07 . 2008-04-06 22:22 114768 ----a-w- c:\windows\system32\drivers\aswsp.sys
2009-02-05 21:07 . 2008-04-06 22:22 20560 ----a-w- c:\windows\system32\drivers\aswfsblk.sys
2009-02-05 21:06 . 2008-03-12 17:06 51376 ----a-w- c:\windows\system32\drivers\aswtdi.sys
2009-02-05 21:06 . 2008-03-12 17:06 23152 ----a-w- c:\windows\system32\drivers\aswrdr.sys
2009-02-05 21:05 . 2008-03-12 17:06 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-02-05 21:04 . 2008-03-12 17:06 97480 ----a-w- c:\windows\system32\avastss.scr
2005-08-27 12:26 . 2008-03-09 19:36 1581056 ----a-w- c:\program files\flashplayer8.exe
.
((((((((((((((((((((((((((((((((((((( reg loading points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*note* empty entries & legit default entries are not shown
regedit4
[hkey_current_user\software\microsoft\windows\currentversion\run]
"swg"="c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe" [2008-10-03 68856]
"bittorrent dna"="c:\program files\dna\btdna.exe" [2009-04-03 289088]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"sunjavaupdatesched"="c:\program files\java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 132496]
"tkbellexe"="c:\program files\common files\real\update_ob\realsched.exe" [2008-03-09 185896]
"vistadrv"="c:\program files\sicodrivet\vsdrv.exe" [2006-07-30 121089]
"toshkcw.exe"="c:\program files\toshiba\wireless hotkey\toshkcw.exe" [2005-05-17 49152]
"00thotkey"="c:\windows\system32\
00thotkey.exe" [2006-05-18 09:53 253952]
"avast!"="c:\progra~1\alwils~1\avast4\ashdisp.exe" [2009-02-05 81000]
"hp software update"="c:\program files\hp\hp software update\hpwuschd2.exe" [2006-02-18 49152]
"remotecontrol"="c:\program files\cyberlink\powerdvd\pdvdserv.exe" [2004-11-02 32768]
"tfncky"="tfncky.exe" [bu]
"000stthk"="000stthk.exe" - c:\windows\system32\
000stthk.exe [2001-06-23 03:28 24576]
[hkey_users\.default\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
c:\documents and settings\all users\start menu\programs\startup\
bluetooth manager.lnk - c:\program files\toshiba\bluetooth toshiba stack\tosbtmng.exe [2007-5-22 2756608]
hp digital imaging monitor.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe [2006-2-19 288472]
orbit.lnk - c:\program files\orbitdownloader\orbitdm.exe [2008-4-9 1678536]
[hkey_local_machine\system\currentcontrolset\control\safeboot\minimal\ati0pwxx.sys]
@="driver"
[hkey_local_machine\system\currentcontrolset\control\safeboot\minimal\ati7elxx.sys]
@="driver"
[hkey_local_machine\system\currentcontrolset\control\safeboot\minimal\ati7hoxx.sys]
@="driver"
[hkey_local_machine\software\microsoft\security center]
"antivirusdisablenotify"=dword:00000001
"updatesdisablenotify"=dword:00000001
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"c:\\program files\\orbitdownloader\\orbitdm.exe"=
"c:\\program files\\orbitdownloader\\orbitnet.exe"=
"c:\\program files\\mobily connect card\\mobily connect card.exe"=
"c:\\program files\\messenger\\msmsgs.exe"=
"c:\\program files\\dna\\btdna.exe"=
"c:\\program files\\msn messenger\\msnmsgr.exe"=
"c:\\wamp\\bin\\apache\\apache2.2.8\\bin\\httpd.exe"=
"c:\\program files\\skype\\phone\\skype.exe"=
r0 thpdrv;toshiba hdd protection driver;c:\windows\system32\drivers\thpdrv.sys [28/12/2004 01:31 ص 16384]
r0 thpevm;toshiba hdd protection - shock sensor driver;c:\windows\system32\drivers\thpevm.sys [06/06/2006 04:27 م 6144]
r1 aswsp;avast! Self protection;c:\windows\system32\drivers\aswsp.sys [07/04/2008 01:22 ص 114768]
r1 tmei3e;tmei3e;c:\windows\system32\drivers\tmei3e.sys [06/06/2006 04:31 م 5888]
r2 aswfsblk;aswfsblk;c:\windows\system32\drivers\aswfsblk.sys [07/04/2008 01:22 ص 20560]
r2 tmesrv;tmesrv3;c:\program files\toshiba\tme3\tmesrv31.exe [06/06/2006 04:31 م 114688]
s0 ati0pwxx;ati0pwxx;c:\windows\system32\drivers\ati0pwxx.sys --> c:\windows\system32\drivers\ati0pwxx.sys [?]
s0 ati7elxx;ati7elxx;c:\windows\system32\drivers\ati7elxx.sys --> c:\windows\system32\drivers\ati7elxx.sys [?]
s0 ati7hoxx;ati7hoxx;c:\windows\system32\drivers\ati7hoxx.sys --> c:\windows\system32\drivers\ati7hoxx.sys [?]
s3 ifxtpm;ifxtpm;c:\windows\system32\drivers\ifxtpm.sys [06/06/2006 04:49 م 35968]
.
Contents of the 'scheduled tasks' folder
.
- - - - orphans removed - - - -
notify-xspgvnb - xspgvnb.dll
safeboot-procexp90.sys
.
------- supplementary scan -------
.
Ustart page = hxxp://www.google.com.sa/
usearch page = hxxp://www.google.com
usearch bar = hxxp://www.google.com/ie
mdefault_search_url = hxxp://www.google.com/ie
mstart page = hxxp://home.sweetim.com
usearchassistant = hxxp://www.google.com/ie
usearchurl,(default) = hxxp://www.google.com/search?q=%s
msearchassistant = hxxp://www.google.com/ie
ie: &download by orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
ie: &grab video by orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
ie: Do&wnload selected by orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
ie: Down&load all by orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
ie: E&xport to microsoft excel - c:\progra~1\micros~2\office11\excel.exe/3000
tcp: {3c891932-6f76-44f0-b33c-439a8a9da8f7} = 84.23.101.84 84.23.101.85
filter: X-sdch - {b1759355-3eec-4c1e-b0f1-b719fe26e377} - c:\program files\google\google toolbar\component\fastsearch_a8904fb862bd9564.dll
dpf: Microsoft xml parser for java -
ff - profilepath - c:\documents and settings\pcw\application data\mozilla\firefox\profiles\6eo2g26i.default\
ff - prefs.js: Browser.search.selectedengine - mystart search
ff - prefs.js: Browser.startup.homepage - hxxp://mystart.hiyo.com/
ff - prefs.js: Keyword.url - hxxp://mystart.hiyo.com/?loc=ff_address&search=
ff - component: C:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 w2k/xp/vista - rootkit/stealth malware detector by gmer,
rootkit scan 2009-04-04 00:06
windows 5.1.2600 service pack 2 ntfs
scanning hidden processes ...
Scanning hidden autostart entries ...
Scanning hidden files ...
Scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- dlls loaded under running processes ---------------------
- - - - - - - > 'explorer.exe'(1776)
c:\windows\system32\msi.dll
.
------------------------ other running processes ------------------------
.
C:\program files\intel\wireless\bin\evteng.exe
c:\program files\intel\wireless\bin\s24evmon.exe
c:\program files\alwil software\avast4\aswupdsv.exe
c:\program files\alwil software\avast4\ashserv.exe
c:\program files\toshiba\configfree\cfsvcs.exe
c:\program files\common files\microsoft shared\vs7debug\mdm.exe
c:\windows\system32\hpzipm12.exe
c:\program files\intel\wireless\bin\regsrvc.exe
c:\windows\system32\thpsrv.exe
c:\program files\toshiba\bluetooth toshiba stack\tosbtsrv.exe
c:\windows\system32\wdfmgr.exe
c:\program files\toshiba\toshiba controls\tfncky.exe
c:\program files\orbitdownloader\orbitnet.exe
c:\program files\toshiba\bluetooth toshiba stack\tosa2dp.exe
c:\program files\toshiba\bluetooth toshiba stack\tosbthid.exe
c:\program files\toshiba\bluetooth toshiba stack\tosbthsp.exe
c:\program files\hp\digital imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2009-04-03 0:11 - machine was rebooted
combofix-quarantined-files.txt 2009-04-03 21:10
pre-run: 34,130,460,672 bytes free
post-run: 45,609,201,664 bytes free
184
