hi tnx for ur help.during these two weeks i tried ewido & McAfee free ware eds & they picked up "new folder" and also "folder options" resume again.is it righ to uninstall these two as well?urs hosein.
Scanner results(
http://virusscan.jotti.org)
Scan taken on 20 May 2008 18:16:01 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing
------------------------------------------------------------------
ComboFix 08-05-19.4 - baba 2008-05-20 22:03:57.5 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.459 [GMT 3.5:30]
Running from: C:\Documents and Settings\baba\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\baba\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 )))))))))))))))))))))))))))))))
.
2008-05-18 14:15 . 2008-05-18 14:16 <DIR> d-------- C:\Program Files\Wondershare
2008-05-15 15:46 . 2008-05-15 15:46 <DIR> d--hs---- C:\Documents and Settings\baba\Phone Browser
2008-05-14 16:53 . 2008-05-14 16:53 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-05-14 16:53 . 2008-05-14 16:53 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2008-05-14 16:53 . 2008-05-14 16:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-05-14 16:53 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-05-14 16:53 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-05-14 16:53 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-05-14 16:53 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-05-14 16:53 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-05-14 16:53 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-05-14 16:53 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-05-13 19:43 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-05-13 19:43 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-05-13 19:43 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-05-13 19:43 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-05-13 19:43 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-05-13 19:43 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-05-13 19:34 . 2008-05-13 19:34 <DIR> d-------- C:\Documents and Settings\baba\Application Data\Lavasoft
2008-05-08 16:22 . 2008-05-08 16:22 <DIR> d--hs---- C:\FOUND.002
2008-05-06 14:53 . 2008-05-06 14:53 17 --a------ C:\WINDOWS\cdplayer.ini
2008-05-04 13:59 . 2008-05-04 13:59 <DIR> d-------- C:\Documents and Settings\hadi\Application Data\PC Suite
2008-05-04 13:59 . 2008-05-04 13:59 <DIR> d-------- C:\Documents and Settings\hadi
2008-05-04 13:59 . 2008-05-20 21:56 1,024 --ah----- C:\Documents and Settings\hadi\ntuser.dat.LOG
2008-04-30 20:42 . 2008-04-30 20:42 <DIR> d--hs---- C:\FOUND.001
2008-04-30 20:27 . 2008-04-30 20:27 <DIR> d-------- C:\Program Files\Combo-Fix
2008-04-28 13:43 . 2008-04-28 13:43 1,315 --a------ C:\WINDOWS\system32\Setup.lnk
2008-04-27 22:06 . 2008-04-27 22:06 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-04-26 13:49 . 2008-05-13 19:26 537 --a------ C:\WINDOWS\wininit.ini
2008-04-26 08:19 . 2008-04-26 08:19 <DIR> d--hs---- C:\FOUND.000
2008-04-25 09:49 . 2008-04-25 09:49 <DIR> d-------- C:\Documents and Settings\baba\Application Data\Nokia Multimedia Player
2008-04-25 08:37 . 2008-04-25 08:37 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-04-25 08:37 . 2006-09-16 03:02 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-04-25 08:35 . 2008-04-25 08:35 <DIR> d-------- C:\Documents and Settings\baba\Application Data\Nokia
2008-04-25 08:35 . 2008-04-25 08:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\Program Files\Nokia
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\Program Files\DIFX
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-04-25 08:34 . 2008-04-25 08:34 <DIR> d-------- C:\Documents and Settings\baba\Application Data\PC Suite
2008-04-25 08:34 . 2006-10-10 08:54 138,240 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-04-25 08:34 . 2006-10-10 08:54 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-04-25 08:34 . 2006-10-10 08:54 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-04-25 08:34 . 2006-10-10 08:54 12,800 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-04-25 08:34 . 2006-10-10 08:54 12,800 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-04-25 08:34 . 2006-10-10 08:54 9,216 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-04-25 08:34 . 2006-10-10 08:54 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll
2008-04-25 08:33 . 2008-04-25 08:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-04-22 08:21 . 2008-04-22 08:21 276,320 --a------ C:\Documents and Settings\baba\Application Data\GDIPFONTCACHEV1.DAT
2008-04-21 22:42 . 2001-08-23 16:30 19,456 --a------ C:\WINDOWS\system32\dllcache\agt040d.dll
2008-04-21 22:42 . 2001-08-23 16:30 19,456 --a------ C:\WINDOWS\system32\dllcache\agt0401.dll
2008-04-21 21:54 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-21 19:14 . 2008-04-21 19:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-21 19:12 . 2008-04-21 20:09 286,720 --------- C:\WINDOWS\Setup1.exe
2008-04-21 19:12 . 2008-04-21 20:09 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-04-21 19:11 . 2008-04-21 19:11 <DIR> d-------- C:\Program Files\Yahoo!
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-21 14:53 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-21 14:53 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-04-21 14:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-04-21 14:49 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-04-21 14:37 --------- d-----w C:\Program Files\Common Files\Adobe
2008-04-21 14:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 14:28 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-04-21 14:28 --------- d-----w C:\Program Files\JetAudio
2008-04-21 14:27 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-21 14:26 --------- d-----w C:\Program Files\Common Files\L&H
2008-04-21 14:20 --------- d-----w C:\Documents and Settings\baba\Application Data\COWON
2008-04-21 14:19 --------- d-----w C:\Program Files\Real
2008-04-21 14:19 --------- d-----w C:\Program Files\Common Files\Real
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2007-04-15 23:25 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe" [2008-04-21 17:49 146432]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 13:27 222208]
"ShStatEXE"="D:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
"McAfeeUpdaterUI"="D:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304]
C:\Documents and Settings\baba\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"StartMenuLogOff"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.jxvd"= JetMPVx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\program files\\McAfee\\Common Framework\\FrameworkService.exe"=
R1 ewido security suite driver;ewido security suite driver;d:\Program Files\ewido anti-malware\guard.sys [2005-12-30 14:42]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-20 17:00:02 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\Web\OfficeUpdate.exe
"2008-05-20 08:00:02 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\Web\OfficeUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-05-20 22:05:52
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-20 22:06:47
ComboFix-quarantined-files.txt 2008-05-20 18:36:42
ComboFix4.txt 2008-05-05 15:16:42
ComboFix3.txt 2008-05-05 18:28:12
ComboFix2.txt 2008-05-20 18:30:12
Pre-Run: 13,595,230,208 bytes free
Post-Run: 13,587,103,744 bytes free
142
------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:15:29 PM, on 5/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\ewido anti-malware\ewidoctrl.exe
d:\Program Files\ewido anti-malware\ewidoguard.exe
D:\Program Files\McAfee\Common Framework\FrameworkService.exe
D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
D:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://go.microsoft.com/fwlink/?LinkId=74005O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - D:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [ShStatEXE] "D:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "D:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Office Update.lnk = C:\WINDOWS\Web\OfficeUpdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
http://downloads.ewido.net/ewidoOnlineScan.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{EBFA27EC-83A0-452D-B81A-D66F4A201B98}: NameServer = 213.217.60.170 213.217.60.202
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - d:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - D:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - D:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5181 bytes