ComboFix 09-06-23.01 - sajeda 06/24/2009 20:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1526.1169 [GMT 3:00]
Running from: c:\documents and settings\sajeda\My Documents\Downloads\Programs\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\sajeda\Application Data\ShoppingReport
c:\documents and settings\sajeda\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\sajeda\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\sajeda\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\sajeda\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\sajeda\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\program files\ShoppingReport
C:\autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 )))))))))))))))))))))))))))))))
.
2009-06-18 19:09 . 2009-06-18 19:09 -------- d-----w- c:\program files\Windows Defender
2009-06-18 19:02 . 2009-06-18 19:02 -------- d-----w- c:\windows\system32\vmm32
2009-06-18 19:02 . 2009-06-18 19:02 -------- d-----w- c:\program files\Dell
2009-06-18 07:27 . 2009-06-18 18:45 -------- d-----w- c:\program files\WebGoo 5.0 Browser
2009-06-18 07:27 . 2009-06-18 07:27 -------- d-----w- c:\windows\WebGoo 5.0 Browser
2009-06-16 01:59 . 2009-06-16 01:59 -------- d-sh--w- c:\documents and settings\sajeda\IECompatCache
2009-06-16 01:59 . 2009-06-16 01:59 -------- d-sh--w- c:\documents and settings\sajeda\PrivacIE
2009-06-16 01:59 . 2009-06-16 01:59 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-16 01:59 . 2009-06-16 01:59 -------- d-sh--w- c:\documents and settings\sajeda\IETldCache
2009-06-16 01:55 . 2009-06-16 01:57 -------- dc-h--w- c:\windows\ie8
2009-06-15 20:12 . 2009-06-16 10:25 -------- d-----w- c:\documents and settings\sajeda\Application Data\DivX
2009-06-15 18:28 . 2009-06-15 18:28 -------- d-----w- c:\documents and settings\sajeda\Application Data\Off Road
2009-06-15 18:18 . 2009-06-15 18:18 -------- d-----w- c:\program files\Avira
2009-06-15 18:18 . 2009-06-15 18:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-06-15 18:18 . 2009-03-30 07:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-15 18:18 . 2009-03-24 13:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-15 18:18 . 2009-02-13 09:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-15 18:18 . 2009-02-13 09:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-12 23:17 . 2008-10-16 11:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-06-11 06:16 . 2008-04-14 00:12 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-11 02:36 . 2009-06-11 02:36 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-11 02:35 . 2009-06-15 20:18 -------- d-----w- c:\windows\system32\LogFiles
2009-06-11 02:35 . 2009-06-11 02:36 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-06-11 02:02 . 2009-06-11 02:02 -------- d-----w- c:\windows\system32\scripting
2009-06-11 02:02 . 2009-06-11 02:02 -------- d-----w- c:\windows\l2schemas
2009-06-11 02:02 . 2009-06-11 02:02 -------- d-----w- c:\windows\system32\en
2009-06-11 02:02 . 2009-06-11 02:02 -------- d-----w- c:\windows\system32\bits
2009-06-11 01:59 . 2009-06-11 01:59 -------- d-----w- c:\windows\ServicePackFiles
2009-06-11 01:44 . 2004-08-03 20:29 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2009-06-09 12:11 . 2009-06-09 12:11 -------- d-----w- c:\documents and settings\sajeda\Local Settings\Application Data\Help
2009-06-08 23:13 . 2009-06-08 23:13 -------- d-----w- c:\program files\MSBuild
2009-06-08 23:13 . 2009-06-11 07:38 83704 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-08 23:10 . 2009-06-11 07:38 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-08 23:10 . 2009-06-08 23:10 -------- d-----w- c:\program files\Reference Assemblies
2009-06-08 23:09 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-06 19:55 . 2009-06-06 19:55 -------- d-----w- c:\program files\GameTop.com
2009-06-04 22:03 . 2009-06-04 22:03 -------- d-----w- c:\windows\Downloaded Installations
2009-06-04 21:57 . 2009-06-04 21:57 -------- d-----w- c:\program files\Total Video Converter
2009-06-04 08:17 . 2009-06-04 08:17 -------- d-----w- c:\documents and settings\sajeda\Local Settings\Application Data\Identities
2009-06-03 19:44 . 2009-06-09 18:52 -------- d-----w- c:\documents and settings\sajeda\Local Settings\Application Data\Google
2009-06-03 19:44 . 2009-06-03 19:44 -------- d-----w- c:\program files\Google
2009-06-02 22:09 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-06-02 21:21 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-06-02 21:14 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-06-02 19:19 . 2009-06-02 19:19 -------- d-----w- c:\program files\CCleaner
2009-06-02 13:01 . 2009-01-07 15:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-06-02 03:53 . 2009-06-02 03:53 -------- d-----w- c:\documents and settings\sajeda\Local Settings\Application Data\Adobe
2009-06-02 03:52 . 2009-06-02 03:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-01 23:04 . 2009-06-01 23:04 -------- d-----w- C:\downloads
2009-06-01 23:04 . 2009-06-01 23:04 -------- d-----w- c:\documents and settings\sajeda\Application Data\GrabPro
2009-06-01 23:04 . 2009-06-01 23:05 -------- d-----w- c:\program files\Orbitdownloader
2009-06-01 23:04 . 2009-06-01 23:04 -------- d-----w- c:\documents and settings\sajeda\Application Data\Orbit
2009-06-01 13:47 . 2009-06-01 13:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-06-01 12:52 . 2009-06-01 12:57 -------- d-----w- c:\documents and settings\sajeda\Local Settings\Application Data\WMTools Downloaded Files
2009-06-01 12:17 . 2009-06-01 12:17 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-01 12:17 . 2009-06-11 07:47 27656 ----a-w- c:\documents and settings\sajeda\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-01 12:11 . 2009-06-01 12:11 446976 ----a-w- c:\windows\system32\ShellMPD.dll
2009-06-01 12:11 . 2009-06-01 12:11 -------- d-----w- c:\documents and settings\sajeda\Application Data\MSN Pictures Displayer
2009-06-01 12:09 . 2009-06-01 12:11 -------- d-----w- c:\program files\MSN Pictures Displayer
2009-06-01 01:50 . 2009-06-01 01:50 -------- d-s---w- c:\documents and settings\sajeda\UserData
2009-06-01 00:22 . 2009-06-01 00:22 -------- d-sh--w- c:\windows\ftpcache
2009-06-01 00:22 . 2009-06-01 00:22 -------- d-----w- c:\program files\FLV-Media Player
2009-05-31 23:57 . 2009-05-31 23:57 -------- d-----w- c:\documents and settings\sajeda\Application Data\Media Player Classic
2009-05-31 23:57 . 2007-09-04 16:56 164352 ----a-w- c:\windows\system32\unrar.dll
2009-05-31 23:56 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2009-05-31 23:56 . 2008-05-22 22:22 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2009-05-31 23:56 . 2008-01-10 12:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
2009-05-31 23:56 . 2008-01-10 12:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
2009-05-31 23:56 . 2008-06-12 18:36 7680 ----a-w- c:\windows\system32\ff_vfw.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-24 17:25 . 2009-05-31 21:22 -------- d-----w- c:\documents and settings\sajeda\Application Data\DMCache
2009-06-17 20:31 . 2009-05-31 21:22 -------- d-----w- c:\documents and settings\sajeda\Application Data\IDM
2009-06-15 20:10 . 2009-06-15 20:10 -------- d-----w- c:\program files\DivX
2009-06-15 20:10 . 2009-06-15 20:10 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-15 18:18 . 2009-05-31 21:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Rising
2009-06-15 18:15 . 2009-05-31 21:00 -------- d-----w- c:\program files\Rising
2009-06-14 18:52 . 2009-05-31 21:22 -------- d-----w- c:\program files\Internet Download Manager
2009-06-11 02:04 . 2009-05-31 20:51 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-31 23:56 . 2009-05-31 21:26 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-31 21:34 . 2009-05-31 21:34 0 ----a-w- c:\windows\nsreg.dat
2009-05-31 21:29 . 2009-05-31 21:28 -------- d-----w- c:\program files\QuickTime Alternative
2009-05-31 21:28 . 2009-05-31 21:28 -------- d-----w- c:\program files\Media Player Classic
2009-05-31 21:28 . 2009-05-31 21:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-31 21:28 . 2009-05-31 21:27 -------- d-----w- c:\program files\MpcStar
2009-05-31 21:24 . 2009-05-31 21:24 -------- d-----w- c:\program files\Windows Live
2009-05-31 21:22 . 2009-05-31 21:22 198064 ----a-w- c:\documents and settings\sajeda\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-31 21:18 . 2009-05-31 21:18 477808 ------w- c:\windows\system32\kmon.dll
2009-05-31 21:09 . 2009-05-31 21:09 -------- d-----w- c:\program files\Broadcom
2009-05-31 21:06 . 2009-05-31 21:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-31 21:06 . 2009-05-31 21:06 -------- d-----w- c:\program files\Analog Devices
2009-05-31 21:06 . 2009-05-31 21:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-31 21:00 . 2009-05-31 21:00 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-31 21:00 . 2009-05-31 21:00 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-31 21:00 . 2009-05-31 21:00 1060864 ----a-w- c:\windows\system32\mfc71.dll
2009-05-31 20:52 . 2009-05-31 20:52 -------- d-----w- c:\program files\microsoft frontpage
2009-05-31 20:49 . 2009-05-31 20:49 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-07 15:32 . 2004-08-04 10:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 21:03 . 2009-06-15 20:10 9464 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-05-01 21:03 . 2009-06-15 20:10 9336 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-05-01 21:03 . 2009-06-15 20:10 43528 ------w- c:\windows\system32\drivers\PxHelp20.sys
2009-05-01 21:03 . 2009-06-15 20:10 129784 ------w- c:\windows\system32\pxafs.dll
2009-05-01 21:03 . 2009-06-15 20:10 120056 ------w- c:\windows\system32\pxcpyi64.exe
2009-05-01 21:03 . 2009-06-15 20:10 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll
2009-04-17 12:26 . 2004-08-04 10:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 10:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-03 19:44 . 2009-06-03 19:44 109568 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-19 2811312]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\documents and settings\sajeda\Start Menu\Programs\Startup\
MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2009-6-1 4708864]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
«©م، ¢¬نïé Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dwwinxp.exe]
"Debugger"=c:\windows\system32\winxp.exe
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [15/06/2009 09:18 م 108289]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 07:19 م 13592]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-06-24 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-regdiit - c:\windows\system32\winxp.exe
ShellExecuteHooks-{32CD708B-60A7-4C00-9377-D73EAA495F0F} - c:\windows\system32\RavExt.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &Google Search - c:\program files\Google\googletoolbar.dll/cmsearch.html
IE: Backward &Links - c:\program files\Google\googletoolbar.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - c:\program files\Google\googletoolbar.dll/cmcache.html
IE: Si&milar Pages - c:\program files\Google\googletoolbar.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\googletoolbar.dll/cmtrans.html
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} -
FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-24 20:28
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(656)
c:\windows\system32\MSVCP60.dll
.
Completion time: 2009-06-24 20:29
ComboFix-quarantined-files.txt 2009-06-24 17:29
Pre-Run: 9,588,035,584 bytes free
Post-Run: 9,617,825,792 bytes free
219 --- E O F --- 2009-06-24 15:00
