ComboFix 09-07-04.05 - Eman 09/05/2009 4:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.255.58 [GMT -7:00]
Running from: d:\documents and settings\Eman\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\docume~1\Eman\LOCALS~1\Temp\zx1q\zyzoom.exe
d:\documents and settings\Eman\Local Settings\Temp\zx1q\zyzoom.exe
.
((((((((((((((((((((((((( Files Created from 2009-08-05 to 2009-09-05 )))))))))))))))))))))))))))))))
.
2009-09-05 11:02 . 2009-09-05 11:02 -------- d-----w- d:\program files\Trend Micro
2009-09-05 10:57 . 2009-09-05 10:57 266080 ----a-w- d:\documents and settings\Eman\Application Data\IDM\DwnlData\Eman\FxMimail_6\FxMimail.exe
2009-09-05 10:38 . 2009-09-05 10:38 82258 ----a-w- d:\windows\system32\drivers\klin.dat
2009-09-05 10:38 . 2009-09-05 10:38 82258 ----a-w- d:\windows\system32\drivers\klick.dat
2009-09-05 10:37 . 2009-09-05 11:34 -------- d-----w- d:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-05 10:37 . 2009-09-05 11:58 11552 --sha-w- d:\windows\system32\drivers\fidbox2.dat
2009-09-05 10:37 . 2009-09-05 11:58 292896 --sha-w- d:\windows\system32\drivers\fidbox.dat
2009-09-05 10:32 . 2009-09-05 10:32 120240 ----a-w- d:\documents and settings\Eman\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-09-05 10:30 . 2009-09-05 10:56 -------- d-----w- d:\documents and settings\Eman\Application Data\IDM
2009-09-05 10:30 . 2009-09-05 12:05 -------- d-----w- d:\documents and settings\Eman\Application Data\DMCache
2009-09-05 10:30 . 2009-09-05 10:32 -------- d-----w- d:\program files\Internet Download Manager
2009-09-05 10:19 . 2009-09-05 10:19 -------- d-----w- d:\documents and settings\tazebama.dl_
2009-09-05 10:11 . 2009-09-05 10:27 -------- d-----w- d:\program files\Moleskinsoft Clone Remover 3.2
2009-09-05 10:00 . 2009-09-05 10:00 -------- d-----w- d:\program files\Kaspersky Lab
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-05 11:58 . 2009-09-05 10:37 4508 --sha-w- d:\windows\system32\drivers\fidbox.idx
2009-09-05 11:58 . 2009-09-05 10:37 2156 --sha-w- d:\windows\system32\drivers\fidbox2.idx
2009-09-05 11:25 . 2009-09-05 11:17 -------- d-----w- d:\documents and settings\Eman\Application Data\cleaner
2009-09-05 11:17 . 2009-09-05 11:17 -------- d-----w- d:\documents and settings\Eman\Application Data\CyberScrub
2009-09-05 09:57 . 2009-09-05 09:57 -------- d-----w- d:\program files\K-Lite Codec Pack
2009-09-05 09:56 . 2009-09-05 09:35 33848 ----a-w- d:\documents and settings\Eman\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-05 09:55 . 2009-09-05 09:55 -------- d-----w- d:\documents and settings\Eman\Application Data\ATI
2009-09-05 09:55 . 2009-09-05 09:55 127 ----a-w- d:\documents and settings\Eman\Local Settings\Application Data\fusioncache.dat
2009-09-05 09:53 . 2009-09-05 09:53 -------- d-----w- d:\program files\My Company Name
2009-09-05 09:53 . 2009-09-05 09:39 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-09-05 09:53 . 2009-09-05 09:39 -------- d-----w- d:\program files\Common Files\InstallShield
2009-09-05 09:49 . 2009-09-05 09:47 -------- d-----w- d:\program files\ATI Technologies
2009-09-05 09:39 . 2009-09-05 09:39 -------- d-----w- d:\program files\Realtek Sound Manager
2009-09-05 09:39 . 2009-09-05 09:39 -------- d-----w- d:\program files\AvRack
2009-09-05 09:23 . 2009-09-05 09:23 -------- d-----w- d:\program files\microsoft frontpage
2009-09-05 09:20 . 2009-09-05 09:20 86327 ----a-w- d:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-09-05 09:15 . 2009-09-05 09:15 21640 ----a-w- d:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="d:\program files\Internet Download Manager\IDMan.exe" [2009-09-05 2684336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="d:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="d:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="d:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"ATICCC"="d:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"SoundMan"="SOUNDMAN.EXE" - d:\windows\SOUNDMAN.EXE [2003-07-16 129024]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="d:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\الدش\\الاسترا\\EmEdit\\EmEdit.exe"=
"d:\\WINDOWS\\system32\\wscntfy.exe"=
"d:\\WINDOWS\\SOUNDMAN.EXE"=
"d:\\WINDOWS\\system32\\Ati2evxx.exe"=
"d:\\ComboFix\\NirCmd.cfexe"=
"e:\\C?IO\\C?C?E?C\\EmEdit\\EmEdit.exe"=
R3 abp470n5;abp470n5;\??\d:\windows\system32\drivers\klols.sys --> d:\windows\system32\drivers\klols.sys [?]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [4/4/2007 2:58 PM 24344]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-SystemBackup - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: تحميل الكل بـ إنترنت داونلود مانيجر - d:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - d:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - d:\program files\Internet Download Manager\IEGetVL.htm
LSP: d:\windows\system32\idmmbc.dll
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-09-05 05:05
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(912)
d:\windows\system32\Ati2evxx.dll
d:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(972)
d:\windows\system32\idmmbc.dll
- - - - - - - > 'explorer.exe'(1556)
d:\windows\system32\shdoclc.dll
d:\windows\system32\browselc.dll
d:\program files\Internet Download Manager\IDMIECC.dll
d:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Other Running Processes ------------------------
.
d:\windows\system32\ati2evxx.exe
d:\windows\ATKKBService.exe
d:\windows\system32\ati2evxx.exe
d:\program files\Internet Download Manager\IEMonitor.exe
d:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 2009-09-05 5:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-05 12:10
Pre-Run: 4,977,467,392 bytes free
Post-Run: 4,934,569,984 bytes free
158