ComboFix 09-07-22.03 - pc 07/23/2009 10:11.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.487.201 [GMT 3:00]
Running from: c:\documents and settings\pc\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Documents\My Music\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\My Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sample Music\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sample Playlists\00096219\Desktop_.ini
c:\documents and settings\All Users\Documents\My Music\Sample Playlists\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Desktop_.ini
c:\documents and settings\All Users\Documents\My Pictures\Sample Pictures\Desktop_.ini
c:\documents and settings\All Users\Documents\My Videos\Desktop_.ini
c:\documents and settings\pc\Application Data\tazebama
c:\documents and settings\pc\Application Data\tazebama\zPharaoh.dat
c:\documents and settings\pc\Desktop\MySQL 4.1\Desktop_.ini
c:\documents and settings\pc\Desktop\MySQL 4.1\Linux Server\Desktop_.ini
c:\documents and settings\pc\Desktop\MySQL 4.1\Windows Server\Desktop_.ini
c:\psterm4\Desktop_.ini
c:\windows\system32\autorun.ini
d:\تعاريف dx7300\Audio\Desktop_.ini
d:\تعاريف dx7300\Audio\MSHDQFE\Desktop_.ini
d:\تعاريف dx7300\Audio\MSHDQFE\Win2K_XP\Desktop_.ini
d:\تعاريف dx7300\Audio\MSHDQFE\Win2K_XP\us\Desktop_.ini
d:\تعاريف dx7300\Audio\MSHDQFE\Win2K3\Desktop_.ini
d:\تعاريف dx7300\Audio\MSHDQFE\Win2K3\us\Desktop_.ini
d:\تعاريف dx7300\Audio\Realtek\Config\Desktop_.ini
d:\تعاريف dx7300\Audio\Realtek\Desktop_.ini
d:\تعاريف dx7300\Audio\Realtek\WDM\Desktop_.ini
d:\تعاريف dx7300\Audio\WDM\Desktop_.ini
d:\تعاريف dx7300\chipset\Desktop_.ini
d:\تعاريف dx7300\Dotnet\Desktop_.ini
d:\تعاريف dx7300\Intel MSM\Desktop_.ini
d:\تعاريف dx7300\Misc3\Desktop_.ini
d:\تعاريف dx7300\Misc5\Desktop_.ini
d:\تعاريف dx7300\Modular_KeyboardLayout\Desktop_.ini
d:\تعاريف dx7300\MSD\Desktop_.ini
d:\تعاريف dx7300\NIC\Desktop_.ini
d:\تعاريف dx7300\NIC\PROSETDX\Desktop_.ini
d:\تعاريف dx7300\NIC\PROSETDX\DRIVERS\Desktop_.ini
d:\تعاريف dx7300\NIC\RIS_INF\Desktop_.ini
d:\تعاريف dx7300\OEMSTART\Desktop_.ini
d:\تعاريف dx7300\sw_ver\Desktop_.ini
d:\تعاريف dx7300\Video\Desktop_.ini
f:\على خطى الحبيب\Desktop_.ini
f:\kaspersky 2010\Desktop_.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IPRIP
-------\Service_Iprip
((((((((((((((((((((((((( Files Created from 2009-06-23 to 2009-07-23 )))))))))))))))))))))))))))))))
.
2009-07-22 08:16 . 2009-07-22 08:16 -------- d-----w- c:\program files\Trend Micro
2009-07-22 08:13 . 2009-07-08 15:59 62507297 ----a-w- C:\av-i386-cumul.zip
2009-07-11 07:57 . 2009-07-11 07:57 4096 ----a-w- c:\windows\d3dx.dat
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 07:17 . 2009-04-01 17:28 4723744 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-23 07:16 . 2009-04-01 17:28 272672 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-23 07:16 . 2009-04-01 17:28 75680 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-23 07:16 . 2009-04-01 17:28 31808 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-23 05:00 . 2007-03-25 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-05-23 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-11 185896]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^pc^Start Menu^Programs^Startup^Ela-Salaty.lnk]
path=c:\documents and settings\pc\Start Menu\Programs\Startup\Ela-Salaty.lnk
backup=c:\windows\pss\Ela-Salaty.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\ntvdm.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP
eer Name Resolution Protocol (PNRP)
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R?2 OracleCSService;OracleCSService;c:\oracle\product\10.1.0\db_1\bin\ocssd.exe service --> c:\oracle\product\10.1.0\db_1\bin\ocssd.exe service [?]
R0 Achernar;Achernar - SCSI Command Filters;c:\windows\system32\drivers\Achernar.sys [09/09/2007 06:27 م 16855]
R3 Aldebaran;Aldebaran - SCSI Command Filters;c:\windows\system32\drivers\Aldebaran.sys [09/09/2007 06:27 م 21808]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/12/2007 01:28 م 24592]
S2 OracleOraDb10g_home1TNSListener;OracleOraDb10g_home1TNSListener;c:\oracle\product\10.1.0\db_1\BIN\TNSLSNR --> c:\oracle\product\10.1.0\db_1\BIN\TNSLSNR [?]
S3 OracleOraDb10g_home1SNMPPeerEncapsulator;OracleOraDb10g_home1SNMPPeerEncapsulator;c:\oracle\product\10.1.0\db_1\bin\encsvc.exe [03/05/2009 06:15 ص 187392]
S3 OracleOraDb10g_home1SNMPPeerMasterAgent;OracleOraDb10g_home1SNMPPeerMasterAgent;c:\oracle\product\10.1.0\db_1\bin\agntsvc.exe [03/05/2009 06:15 ص 254464]
S4 ProgressSoft Center Changes Importer;ProgressSoft Center Changes Importer;c:\windows\system32\PS_CSync.exe [13/07/2007 10:03 م 102400]
S4 ProgressSoft Security Interface;ProgressSoft Security Interface;c:\windows\system32\PSSecLog.exe [13/07/2007 10:03 م 45056]
S4 ProgressSoft Sync Communicator;ProgressSoft Sync Communicator;c:\windows\system32\PS_Comm.exe [13/07/2007 10:03 م 73728]
S4 ProgressSoft Sync Exporter;ProgressSoft Sync Exporter;c:\windows\system32\PS_RSync.exe [13/07/2007 10:03 م 102400]
S4 ProgressSoft Sync Importer;ProgressSoft Sync Importer;c:\windows\system32\PS_LSync.exe [13/07/2007 10:03 م 98304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = yes
uInternet Connection Wizard,ShellNext = 0a000000
uInternet Connection Wizard,ShellNext = yes
uInternet Connection Wizard,ShellNext = 01000000
uInternet Connection Wizard,ShellNext = yes
uInternet Connection Wizard,ShellNext = 1a000000
uInternet Connection Wizard,ShellNext = 1a000000
uInternet Connection Wizard,ShellNext = Microsoft Corporation
uInternet Connection Wizard,ShellNext = MICROSO
uInternet Connection Wizard,ShellNext = 6.0.2600.0000
uInternet Connection Wizard,ShellNext = no
uInternet Settings,ProxyOverride = <local>
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-23 10:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 4.1\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 4.1\my.ini\" MySQL"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OracleOraDb10g_home1TNSListener]
"ImagePath"="c:\oracle\product\10.1.0\db_1\BIN\TNSLSNR "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1160)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1264)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(3896)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll
c:\windows\system32\msi.dll
c:\windows\system32\hnetcfg.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
c:\program files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
c:\windows\system32\igfxpph.dll
c:\windows\system32\hccutils.DLL
c:\windows\system32\igfxres.dll
c:\windows\system32\igfxress.dll
c:\windows\system32\igfxsrvc.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
c:\oracle\product\10.1.0\db_1\bin\ocssd.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2009-07-23 10:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-23 07:21
Pre-Run: 16,559,841,280 bytes free
Post-Run: 16,480,649,216 bytes free
184
