ComboFix 09-07-14.08 - سمر 07/17/2009 19:52.4.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.382.208 [GMT 3:00]
Running from: c:\documents and settings\سمر\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\سمر\Application Data\addons.dat
C:\google.exe
C:\google2.exe
c:\program files\bifrost
c:\program files\Bifrost\server.exe
C:\syntax.exe
c:\windows\system32\ftx32.dll
.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.
2009-07-14 17:43 . 2009-07-14 17:43 -------- d-----w- c:\documents and settings\سمر\Application Data\QuickScan
2009-07-12 11:54 . 2009-07-12 11:54 351744 ----a-w- c:\documents and settings\سمر\Application Data\WEBSAFESOFT\Soap Hope Mp3.exe
2009-07-12 11:54 . 2009-07-12 11:54 425984 ----a-w- c:\documents and settings\سمر\Application Data\WEBSAFESOFT\BOWS COPY WIN JUMP.exe
2009-07-12 11:54 . 2009-07-17 16:39 962560 ----a-w- c:\documents and settings\All Users\Application Data\BONE ABOUT BOOK BOWS\Axis Second.exe
2009-07-12 11:54 . 2009-07-12 11:54 962560 ----a-w- c:\documents and settings\سمر\Application Data\WEBSAFESOFT\prfetzqj.exe
2009-07-12 11:52 . 2009-07-12 11:52 -------- d-----w- c:\program files\WEBSAFESOFT
2009-07-12 11:52 . 2009-07-12 11:52 544768 ----a-w- c:\documents and settings\سمر\Application Data\WEBSAFESOFT\poptraybore.exe
2009-07-05 11:30 . 2009-07-05 11:30 -------- d-----w- c:\program files\ClocX
2009-06-21 11:58 . 2009-06-21 11:58 -------- d-----w- c:\program files\Ask Search Assistant
2009-06-20 11:23 . 2009-06-20 11:23 -------- d-----w- c:\program files\Patcher 2009
2009-06-20 11:23 . 2009-06-21 15:52 451072 ----a-w- c:\windows\uninstall.exe
2009-06-20 11:23 . 2009-06-20 11:23 -------- d-----w- c:\program files\Uninstall
2009-06-18 17:15 . 2003-01-08 14:26 57344 ----a-w- c:\windows\system32\drivers\WDelMgr20.exe
2009-06-18 17:15 . 2003-01-06 11:30 31532 ----a-w- c:\windows\system32\drivers\NtFsLdf20.sys
2009-06-18 17:13 . 2009-06-18 17:13 -------- d-sh--w- C:\Drive Information
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 02:10 . 2008-06-28 23:51 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-12 16:48 . 2009-06-12 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-12 16:48 . 2009-06-12 16:48 -------- d-----w- c:\program files\File Recover
2009-06-12 15:58 . 2009-06-12 15:58 -------- d-----w- c:\documents and settings\سمر\Application Data\CyberScrub
2009-06-12 15:58 . 2009-06-12 15:58 -------- d-----w- c:\documents and settings\سمر\Application Data\cleaner
2009-06-08 22:18 . 2009-06-08 22:18 -------- d-----w- c:\program files\Alwil Software
2009-06-07 20:39 . 2009-06-07 20:39 -------- d-----w- c:\documents and settings\سمر\Application Data\Malwarebytes
2009-06-07 20:39 . 2009-06-07 20:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-01 21:39 . 2009-06-12 16:48 82432 ----a-w- c:\windows\system32\msxml4r.dll
2009-06-01 21:39 . 2009-06-12 16:48 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-06-01 21:39 . 2009-06-12 16:48 1233920 ----a-w- c:\windows\system32\msxml4.dll
2009-05-29 16:16 . 2009-05-29 16:16 98304 ----a-w- c:\documents and settings\سمر\Application Data\elefundesktops\fantasyworld_wallpaper\wallpaper.exe
2009-05-29 16:16 . 2009-05-29 16:16 57344 ----a-w- c:\documents and settings\سمر\Application Data\elefundesktops\fantasyworld_wallpaper\wallpaper.dll
2009-05-29 16:16 . 2009-05-29 16:16 1638404 ----a-w- c:\documents and settings\سمر\Application Data\elefundesktops\fantasyworld_wallpaper\swfplayer.exe
2009-05-29 16:16 . 2009-05-29 16:16 151552 ----a-w- c:\documents and settings\سمر\Application Data\elefundesktops\fantasyworld_wallpaper\sysinfo.exe
2009-05-29 16:16 . 2009-05-29 16:16 1153816 ----a-w- c:\documents and settings\سمر\Application Data\elefundesktops\fantasyworld_wallpaper\flash.exe
2009-05-29 16:16 . 2009-05-29 16:16 -------- d-----w- c:\documents and settings\سمر\Application Data\elefundesktops
2009-04-24 04:52 . 2009-03-25 07:21 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-06-07_19.38.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-12-01 21:08 . 2006-12-01 21:08 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 49152 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 61440 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 57344 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 65536 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 45056 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 21:08 . 2006-12-01 21:08 40960 c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 19:56 . 2006-12-01 19:56 96256 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2008-06-30 15:01 . 2009-01-07 15:21 26144 c:\windows\system32\spupdsvc.exe
+ 2008-09-19 18:41 . 2009-01-07 15:20 16928 c:\windows\system32\spmsg.dll
+ 2006-06-29 05:05 . 2009-01-07 15:20 23552 c:\windows\system32\normaliz.dll
- 2006-06-29 05:05 . 2006-06-29 05:05 23552 c:\windows\system32\normaliz.dll
- 2006-06-28 14:59 . 2006-06-28 14:59 24576 c:\windows\system32\nlsdl.dll
+ 2006-06-28 14:59 . 2009-01-07 15:20 24576 c:\windows\system32\nlsdl.dll
+ 2007-08-13 15:39 . 2009-03-08 01:32 36864 c:\windows\system32\ieudinit.exe
- 2004-08-03 18:56 . 2007-08-13 15:45 78336 c:\windows\system32\ieencode.dll
+ 2009-06-11 17:10 . 2007-08-13 15:45 78336 c:\windows\system32\ieencode.dll
+ 2006-06-29 05:05 . 2009-01-07 15:20 26112 c:\windows\system32\idndl.dll
- 2006-06-29 05:05 . 2006-06-29 05:05 26112 c:\windows\system32\idndl.dll
- 2009-04-12 20:17 . 2009-04-27 10:32 55640 c:\windows\system32\drivers\avgntflt.sys
+ 2009-04-12 20:17 . 2009-03-24 13:08 55640 c:\windows\system32\drivers\avgntflt.sys
- 2008-09-12 18:47 . 2006-07-14 15:51 121856 c:\windows\system32\xmllite.dll
+ 2008-09-12 18:47 . 2009-01-07 15:21 121856 c:\windows\system32\xmllite.dll
+ 2009-01-07 15:20 . 2009-01-07 15:20 265720 c:\windows\system32\msdbg2.dll
+ 2009-06-09 14:20 . 2009-06-09 14:20 262144 c:\windows\system32\config\systemprofile\NtUser.dat
+ 2008-07-03 18:04 . 1998-10-29 13:45 306688 c:\windows\IsUninst.exe
- 2008-07-03 18:04 . 1998-10-29 11:45 306688 c:\windows\IsUninst.exe
+ 2009-05-03 10:50 . 2009-05-03 10:50 804864 c:\windows\Installer\d8016.msi
+ 2009-05-03 10:38 . 2009-05-03 10:38 467968 c:\windows\Installer\d8004.msi
+ 2008-08-07 10:01 . 2008-08-07 10:01 111104 c:\windows\Installer\9c27c.msi
+ 2009-01-13 21:14 . 2009-01-13 21:14 360448 c:\windows\Installer\73fe89.msi
+ 2009-04-12 20:02 . 2009-04-12 20:02 228352 c:\windows\Installer\410e51.msi
+ 2009-06-12 16:46 . 2009-06-12 16:46 331264 c:\windows\Installer\27cf7c.msi
+ 2008-11-21 15:25 . 2008-11-21 15:25 532992 c:\windows\Installer\2640b.msi
+ 2009-01-18 14:42 . 2009-01-18 14:42 874496 c:\windows\Installer\111501d.msi
- 2008-09-12 18:51 . 2006-09-06 14:43 213216 c:\windows\ie7\spuninst\spuninst.exe
+ 2009-06-11 17:10 . 2006-09-06 14:43 213216 c:\windows\ie7\spuninst\spuninst.exe
+ 2007-02-22 20:41 . 2007-02-22 20:41 304544 c:\windows\Downloaded Program Files\MessengerStatsPAClient.dll
+ 2004-08-03 18:56 . 2004-02-23 17:42 1386496 c:\windows\system32\MSVBVM60.DLL
+ 2009-06-08 22:18 . 2003-03-18 20:20 1060864 c:\windows\system32\MFC71.dll
+ 2008-10-22 19:46 . 2008-10-22 19:47 2710528 c:\windows\Installer\a88cf.msi
+ 2007-03-30 19:20 . 2007-03-30 19:20 5800960 c:\windows\Installer\77f007.msp
+ 2008-06-05 10:56 . 2008-06-05 10:56 5111808 c:\windows\Installer\77eff0.msp
+ 2008-02-15 05:54 . 2008-02-15 05:54 9736192 c:\windows\Installer\4791f7.msp
+ 2008-04-11 15:08 . 2008-04-11 15:08 6302720 c:\windows\Installer\479172.msp
+ 2008-04-25 17:14 . 2008-04-25 17:14 5052928 c:\windows\Installer\479157.msp
+ 2008-04-18 11:56 . 2008-04-18 11:56 6215680 c:\windows\Installer\479140.msp
+ 2008-11-21 15:25 . 2008-11-21 15:25 3620864 c:\windows\Installer\26404.msi
+ 2008-12-26 20:30 . 2008-12-26 20:30 2109440 c:\windows\Installer\14160a9.msi
+ 2009-01-18 14:42 . 2009-01-18 14:42 3207680 c:\windows\Installer\1115017.msi
+ 2005-09-23 04:48 . 2005-09-23 04:48 24863744 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\netfx.msi
+ 2008-06-30 14:28 . 2007-01-19 10:20 16633344 c:\windows\Installer\MSN Messenger 8.1.0178\MsnMsgs.Msi
+ 2008-05-20 22:30 . 2008-05-20 22:30 14308864 c:\windows\Installer\c27ef9.msp
+ 2008-02-25 12:07 . 2008-02-25 12:07 11772416 c:\windows\Installer\4791e1.msp
+ 2008-01-28 15:09 . 2008-01-28 15:09 11896320 c:\windows\Installer\4791ca.msp
+ 2008-01-28 15:10 . 2008-01-28 15:10 14201344 c:\windows\Installer\4791b2.msp
+ 2008-04-11 15:07 . 2008-04-11 15:07 13257728 c:\windows\Installer\47918b.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 09:22 1172792 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Basehide"="c:\docume~1\سمر\APPLIC~1\WEBSAF~1\poptraybore.exe" [2009-07-12 544768]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Amazing3DAquariumWallpaper"="" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\«ê©\Start Menu\Programs\Startup\
13.exe [2009-7-2 100053]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
13.exe [2009-7-2 100053]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BlueSoleil.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BlueSoleil.lnk
backup=c:\windows\pss\BlueSoleil.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^سمر^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\سمر\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\System32\\USMT\\migwiz.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Nero\\Nero ControlCenter\\SetupX.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\TeamViewer3\\TeamViewer.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Paltalk Messenger\\PALTALK.EXE"=
R1 NtFsLdf20;NtFsLdf20;c:\windows\system32\drivers\NtFsLdf20.sys [18/06/2009 08:15 م 31532]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [29/06/2008 08:12 م 194304]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [22/10/2008 10:36 م 714240]
S1 oxser;OX16C95x Serial port driver;c:\windows\system32\drivers\OXSER.SYS [30/06/2008 11:03 م 51169]
S3 DM9USB;DM9601 USB To Fast Ethernet Adapter;c:\windows\system32\drivers\dm9usb.sys [22/10/2008 10:49 م 21376]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyServer = 212.118.133.150:8080
FF - ProfilePath - c:\documents and settings\سمر\Application Data\Mozilla\Firefox\Profiles\qe775sne.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2004933&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.plusnetwork.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-17 19:56
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-07-17 19:58
ComboFix-quarantined-files.txt 2009-07-17 16:58
ComboFix2.txt 2009-06-07 19:40
ComboFix3.txt 2008-07-06 00:11
ComboFix4.txt 2008-07-03 20:18
Pre-Run: 18,421,710,848 bytes free
Post-Run: 18,532,499,456 bytes free
216 --- E O F --- 2008-09-21 00:05
