ComboFix 10-02-08.06 - Administrator 02/09/2010 11:13:18.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.155 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Abu-Saad\Application Data\tazebama
c:\documents and settings\Abu-Saad\Application Data\tazebama\zPharaoh.dat
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2010-01-09 to 2010-02-09 )))))))))))))))))))))))))))))))
.
2010-02-09 08:10 . 2005-03-22 10:53 163840 ----a-w- c:\windows\system32\igfxres.dll
2010-02-09 08:07 . 2010-02-09 08:07 -------- d-----w- c:\windows\system32\config\systemprofile\??? ??????
2010-02-09 08:02 . 2001-08-23 12:00 20992 -c--a-w- c:\windows\system32\dllcache\permchk.dll
2010-02-09 08:01 . 2001-08-23 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2010-02-09 08:00 . 2001-08-23 12:00 7168 -c--a-w- c:\windows\system32\dllcache\wamregps.dll
2010-02-09 07:28 . 2001-08-23 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-02-09 07:28 . 2001-08-23 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-02-09 07:28 . 2001-08-23 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-02-09 07:28 . 2001-08-23 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-02-09 07:28 . 2010-02-09 08:08 -------- d-----r- c:\documents and settings\All Users\????? ????
2010-02-09 07:28 . 2010-02-09 07:28 -------- d-----w- c:\documents and settings\All Users\??? ??????
2010-02-09 07:28 . 2010-02-09 07:28 -------- d-----w- c:\documents and settings\Default User\??? ??????
2010-02-09 07:28 . 2010-02-09 07:28 -------- d-----r- c:\documents and settings\Default User\????? ????
2010-02-09 06:34 . 2010-02-09 06:34 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\DOSBox
2010-02-09 06:34 . 2010-02-09 06:34 -------- d-----w- c:\program files\DOSBox-0.73
2010-02-09 05:32 . 2004-08-03 23:56 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-02-08 15:51 . 2009-08-16 15:08 178176 ----a-w- c:\windows\system32\unrar.dll
2010-02-08 15:51 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-02-08 15:51 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-02-08 15:51 . 2009-07-14 00:15 90112 ----a-w- c:\windows\system32\dpl100.dll
2010-02-08 15:51 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-02-08 15:51 . 2008-11-06 16:37 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2010-02-08 15:51 . 2009-07-14 00:15 685056 ----a-w- c:\windows\system32\divx.dll
2010-02-08 15:51 . 2009-12-11 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-02-08 15:51 . 2010-02-08 15:52 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-02-08 15:47 . 2010-02-08 15:48 -------- d-----w- c:\program files\Total Video Converter
2010-02-08 13:31 . 2010-02-08 13:31 -------- d-s---w- c:\documents and settings\Abu-Saad\UserData
2010-02-08 13:15 . 2010-02-08 13:15 410976 ----a-w- c:\windows\system32\deploytk.dll
2010-02-08 13:15 . 2010-02-08 13:15 -------- d-----w- c:\program files\Java
2010-02-08 13:05 . 2003-09-26 07:41 44032 ----a-w- c:\windows\system32\drivers\bcm4sbxp.sys
2010-02-08 10:25 . 2010-02-08 15:37 -------- d-----w- C:\QUARANTINE
2010-02-08 10:24 . 2008-09-29 05:07 64432 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2010-02-08 10:24 . 2008-09-29 05:07 42424 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2010-02-08 10:24 . 2008-09-29 05:07 90360 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-02-08 10:24 . 2008-09-29 05:07 74648 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-02-08 10:24 . 2008-09-29 05:07 62704 ----a-w- c:\windows\system32\drivers\mfetdik.sys
2010-02-08 10:24 . 2008-09-29 05:07 340592 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2010-02-08 10:24 . 2008-09-29 05:07 67904 ----a-w- c:\windows\system32\mfevtps.exe
2010-02-08 10:24 . 2010-02-08 10:24 -------- d-----w- c:\program files\Common Files\Cisco Systems
2010-02-08 10:24 . 2010-02-08 10:24 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-02-08 10:23 . 2010-02-08 10:24 -------- d-----w- c:\program files\McAfee
2010-02-08 10:23 . 2010-02-08 10:23 -------- d-----w- c:\program files\Common Files\McAfee
2010-02-08 10:22 . 2010-02-08 10:22 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-02-08 10:22 . 2010-02-08 15:50 -------- d-----w- c:\program files\Common Files\Real
2010-02-08 10:22 . 2010-02-08 15:50 -------- d-----w- c:\program files\Real
2010-02-08 10:20 . 2010-02-08 14:46 -------- d-----w- c:\documents and settings\Abu-Saad\Local Settings\Application Data\Adobe
2010-02-08 10:20 . 2010-02-08 10:20 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-08 10:09 . 2010-02-08 10:09 -------- d-----w- c:\windows\system32\URTTemp
2010-02-08 10:09 . 2010-02-08 10:09 -------- d-----w- c:\program files\ATI Technologies
2010-02-08 10:07 . 2010-02-08 10:51 -------- d-----w- c:\program files\Elantech
2010-02-08 10:06 . 2010-02-08 10:06 -------- d-----w- c:\program files\CONEXANT
2010-02-08 10:06 . 2010-02-08 10:54 -------- d-----w- c:\program files\Launch Manager
2010-02-08 10:05 . 2010-02-08 10:05 -------- d-----w- c:\windows\SMSC
2010-02-08 10:02 . 2006-06-14 06:50 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-02-08 10:02 . 2004-08-03 20:07 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-02-08 10:02 . 2004-08-03 21:56 4096 ----a-w- c:\windows\system32\ksuser.dll
2010-02-08 09:56 . 2004-09-01 20:57 221258 ----a-w- c:\windows\system32\Epm-Po.dll
2010-02-08 09:55 . 2010-02-08 10:05 -------- d-----w- c:\program files\Intel
2010-02-08 09:55 . 2010-02-08 09:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-02-08 09:53 . 2005-04-07 15:08 78208 ----a-w- c:\windows\system32\drivers\epm-shd.sys
2010-02-08 09:53 . 2004-07-19 10:10 4096 ----a-w- c:\windows\system32\drivers\epm-psd.sys
2010-02-08 09:53 . 2010-02-08 09:53 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2010-02-08 09:52 . 2005-09-12 06:49 3298432 ----a-w- c:\windows\system32\drivers\w29n51.sys
2010-02-08 09:52 . 2005-09-05 17:25 1671168 ----a-w- c:\windows\system32\w29mlres.dll
2010-02-08 09:52 . 2005-09-05 17:25 466944 ----a-w- c:\windows\system32\w29NCPA.dll
2010-02-08 09:52 . 2005-12-16 11:32 61440 ----a-w- c:\windows\system32\acerGina.dll
2010-02-08 09:52 . 2010-02-08 09:52 -------- d-----w- c:\documents and settings\Abu-Saad\Application Data\Acer
2010-02-08 09:51 . 2010-02-08 09:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Acer
2010-02-08 09:51 . 2005-09-13 12:34 4392 ----a-w- c:\windows\system32\drivers\NdisFilt.sys
2010-02-08 09:51 . 2005-10-15 15:20 12106 ----a-w- c:\windows\system32\drivers\OsaFsLoc.sys
2010-02-08 09:51 . 2005-01-14 12:57 4010 ----a-w- c:\windows\system32\drivers\osanbm.sys
2010-02-08 09:51 . 2005-06-30 13:58 7296 ----a-w- c:\windows\system32\drivers\osaio.sys
2010-02-08 09:49 . 2010-02-08 09:53 21275 ----a-w- c:\windows\system32\drivers\AegisP.sys
2010-02-08 09:49 . 2004-12-21 22:32 192512 ----a-w- c:\windows\system32\AegisI5.exe
2010-02-08 09:49 . 2004-12-21 22:32 81920 ----a-w- c:\windows\system32\wltrynt.dll
2010-02-08 09:49 . 2004-12-21 22:32 65536 ----a-w- c:\windows\system32\WLTRYSVC.EXE
2010-02-08 09:49 . 2004-12-21 22:32 172032 ----a-w- c:\windows\system32\BCMLogon.dll
2010-02-08 09:49 . 2004-12-21 22:32 647272 ----a-w- c:\windows\system32\WLTRAY.EXE
2010-02-08 09:49 . 2004-12-21 22:32 1396831 ----a-w- c:\windows\system32\AegisE5.dll
2010-02-08 09:49 . 2004-12-21 22:32 827499 ----a-w- c:\windows\system32\BCMWLTRY.EXE
2010-02-08 09:49 . 2004-12-21 22:32 184320 ----a-w- c:\windows\system32\BCMWLU00.EXE
2010-02-08 09:49 . 2004-12-21 22:32 69632 ----a-w- c:\windows\system32\BCMWLD2K.EXE
2010-02-08 09:49 . 2004-12-21 22:32 369024 ----a-w- c:\windows\system32\drivers\BCMWL5.SYS
2010-02-08 09:49 . 2010-02-08 09:50 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-08 09:48 . 2010-02-08 09:55 -------- dc----w- c:\windows\system32\DRVSTORE
2010-02-08 09:46 . 2005-11-08 12:12 997376 ----a-w- c:\windows\system32\drivers\HSF_DPV.sys
2010-02-08 09:46 . 2005-11-08 12:11 242048 ----a-w- c:\windows\system32\drivers\HSFHWICH.sys
2010-02-08 09:46 . 2005-11-08 12:11 723712 ----a-w- c:\windows\system32\drivers\HSF_CNXT.sys
2010-02-08 09:46 . 2005-10-25 05:09 114688 ----a-w- c:\windows\system32\UCI32102.dll
2010-02-08 09:46 . 2005-10-05 12:57 12544 ----a-w- c:\windows\system32\drivers\mdmxsdk.sys
2010-02-08 09:46 . 2005-10-05 12:56 86016 ----a-w- c:\windows\system32\mdmxsdk.dll
2010-02-08 09:46 . 2004-12-09 09:04 5120 ----a-w- c:\windows\system32\FILTRCOI.DLL
2010-02-08 09:46 . 2004-12-08 11:10 16896 ----a-w- c:\windows\system32\drivers\DKbFltr.SYS
2010-02-08 09:45 . 2005-01-10 13:48 147456 ----a-w- c:\windows\UNINST32.EXE
2010-02-08 09:04 . 2001-08-17 13:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2010-02-08 09:04 . 2004-08-03 22:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-02-08 09:01 . 2010-02-09 08:18 -------- d-----w- c:\windows\system32\CatRoot2
2010-02-08 09:01 . 2010-02-09 07:29 -------- d-----w- c:\windows\system32\CatRoot
2010-02-08 09:01 . 2010-02-09 07:28 -------- d-----w- c:\documents and settings\All Users
2010-02-08 09:01 . 2010-02-09 07:28 -------- d--h--w- c:\documents and settings\Default User
2010-02-08 09:01 . 2010-02-09 05:31 -------- d-----w- C:\Documents and Settings
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-09 07:57 . 2010-02-08 06:09 23848 ----a-w- c:\windows\system32\emptyregdb.dat
2010-02-09 07:57 . 2010-02-08 06:08 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-08 13:16 . 2010-02-08 13:16 2232 ----a-w- c:\windows\java\Packages\Data\5BZBXBVB.DAT
2010-02-08 13:16 . 2010-02-08 13:16 155995 ----a-w- c:\windows\java\Packages\I5N737RH.ZIP
2010-02-08 13:16 . 2010-02-08 13:16 2678 ----a-w- c:\windows\java\Packages\Data\13RHBJTB.DAT
2010-02-08 13:16 . 2010-02-08 13:16 2678 ----a-w- c:\windows\java\Packages\Data\QJPZFFV1.DAT
2010-02-08 13:16 . 2010-02-08 13:16 2678 ----a-w- c:\windows\java\Packages\Data\8PB3RDRH.DAT
2010-02-08 13:16 . 2010-02-08 13:16 2678 ----a-w- c:\windows\java\Packages\Data\77D7X3NZ.DAT
2010-02-08 13:16 . 2010-02-08 13:16 2678 ----a-w- c:\windows\java\Packages\Data\HBPZZHR7.DAT
2010-02-08 10:38 . 2010-02-08 10:01 -------- d-----w- c:\program files\AvRack
2010-02-08 10:09 . 2010-02-08 09:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-08 10:01 . 2010-02-08 10:01 -------- d-----w- c:\program files\Realtek Sound Manager
2010-02-08 10:01 . 2010-02-08 10:01 -------- d-----w- c:\program files\Acer Inc
2010-02-08 07:33 . 2010-02-08 07:33 -------- d-----w- c:\program files\Common Files\L&H
2010-02-08 07:33 . 2010-02-08 07:33 -------- d-----w- c:\program files\Microsoft.NET
2010-02-08 07:32 . 2010-02-08 07:32 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-02-08 07:32 . 2010-02-08 07:32 -------- d-----w- c:\program files\Microsoft Works
2010-02-08 07:16 . 2010-02-08 06:11 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-08 06:13 . 2010-02-08 06:13 -------- d-----w- c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2008-03-14 136512]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-09-29 124240]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-08 136600]
"epm-dm"="c:\acer\Empowering Technology\ePower\epm-dm.exe" [2005-11-25 212992]
"SoundMan"="SOUNDMAN.EXE" [2005-03-24 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePower Management]
2005-11-09 08:04 3084288 ----a-w- c:\acer\Empowering Technology\ePower\Acer ePower Management.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMTray.exe]
2005-10-24 13:45 2462208 ----a-w- c:\acer\Empowering Technology\admtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-05-11 00:06 40048 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-03 23:56 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
2005-10-19 06:30 69632 ----a-w- c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPM-DM]
2005-11-25 12:59 212992 ----a-w- c:\acer\Empowering Technology\ePower\epm-dm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-03-24 18:20 77824 ----a-w- c:\windows\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\EngineServer.exe [9/29/2008 8:07 AM 19456]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2/8/2010 1:24 PM 67904]
S3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\qhsgl.sys --> c:\windows\system32\drivers\qhsgl.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2/8/2010 1:24 PM 64432]
.
.
------- Supplementary Scan -------
.
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-HotKeysCmds - c:\windows\system32\hkcmd.exe
MSConfigStartUp-IgfxTray - c:\windows\system32\igfxtray.exe
MSConfigStartUp-KTPWare - c:\program files\Elantech\ktp.exe
MSConfigStartUp-LManager - c:\progra~1\LAUNCH~1\LManager.exe
AddRemove-All ATI Software - c:\program files\ATI Technologies\UninstallAll\AtiCimUn.exe
AddRemove-CNXT_MODEM_PCI_VEN_8086&DEV_266D_CplEFL5k - c:\program files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_266D_CplEFL5k\HXFSETUP.EXE
AddRemove-InstallShield_{15B70821-7893-4607-805A-BB80F3EA8279} - c:\program files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe
AddRemove-InstallShield_{DEE08946-40F0-4890-853E-60A6C3306041} - c:\program files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2010-02-09 11:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\acer\Empowering Technology\admServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\System32\wltrysvc.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\McAfee\VirusScan Enterprise\Mcshield.exe
c:\windows\System32\bcmwltry.exe
c:\program files\McAfee\VirusScan Enterprise\mfeann.exe
c:\windows\system32\WLTRAY.exe
c:\windows\system32\rundll32.exe
c:\program files\McAfee\Common Framework\McTray.exe
.
**************************************************************************
.
Completion time: 2010-02-09 11:22:24 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-09 08:22
Pre-Run: 32,767,229,952 bytes free
Post-Run: 32,844,382,208 bytes free
- - End Of File - - A3C345C69C04E8D66505E4990E40A506
