ComboFix 09-03-19.02 - kawther sharro 03/20/2009 20
42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.1014.800 [GMT -8:00]
Running from: c:\documents and settings\kawther sharro\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ASC3360PR
-------\Service_asc3360pr
((((((((((((((((((((((((( Files Created from 2009-02-21 to 2009-03-21 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-21 04:06 --------- d-----w c:\program files\ESET
2009-03-21 04:02 512,096 ----a-w c:\windows\system32\drivers\amon.sys
2009-03-21 04:02 298,104 ----a-w c:\windows\system32\imon.dll
2009-03-21 04:02 15,424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2009-03-21 03:28 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 04:00 AM 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [08/04/2004 04:00 AM 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/04/2004 04:00 AM 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/04/2004 04:00 AM 455168]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 04:00 AM 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Documents and Settings\\kawther sharro\\Desktop\\ComboFix.exe"=
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-03-20 15424]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c1707f4-15c9-11de-9807-001558913961}]
\sHell\autoPLAy\cOmmand - I:\dbeb.pif
\sHell\AutoRun\command - I:\dbeb.pif
\sHell\expLORE\COmMand - I:\dbeb.pif
\sHell\oPen\comMaND - I:\dbeb.pif
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-nod32kui - c:\program files\Eset\nod32kui.exe
.
------- Supplementary Scan -------
.
LSP: c:\windows\system32\imon.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-03-20 20
11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(584)
c:\windows\system32\imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 03/20/2009 20:16:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-21 04:16:24
Pre-Run: 17,858,441,216 bytes free
Post-Run: 17,822,568,448 bytes free
83
24 م, on 20/03/2009