وهذا تقرير البرنامج اللي عطيتني اياه
ComboFix 08-07-20.5 - User 07/21/2008 6:20:36.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.97 [GMT 3:00]
Running from: C:\Documents and Settings\User\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\User\Application Data\addon.dat
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\#Shareds\QUV9FM66\iforex.com
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\#Shareds\QUV9FM66\iforex.com\Emerp\Events\flash_.swf\user_data.sol
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\User\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\winitn.dll
.
---- Previous Run -------
.
C:\WINDOWS\system32\cgsqatyu.sys
C:\WINDOWS\system32\ciwdaapi.sys
C:\WINDOWS\system32\dtzfajke.sys
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\fxcbbime.sys
C:\WINDOWS\system32\fxwlbime.sys
C:\WINDOWS\system32\fxzxbime.sys
C:\WINDOWS\system32\fzmsbwin.sys
C:\WINDOWS\system32\gajzalit.sys
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\gpzhatde.sys
C:\WINDOWS\system32\gsdhadwd.sys
C:\WINDOWS\system32\ijsgajba.sys
C:\WINDOWS\system32\ijzhatde.sys
C:\WINDOWS\system32\pmjhbhlp.sys
C:\WINDOWS\system32\pzdyapaw.sys
C:\WINDOWS\system32\pzwlaime.sys
C:\WINDOWS\system32\rnmxajkl.sys
C:\WINDOWS\system32\sdjsakaq.sys
C:\WINDOWS\system32\smmhbsrv.sys
C:\WINDOWS\system32\spmybapi.sys
C:\WINDOWS\system32\spwdbapi.sys
C:\WINDOWS\system32\sqjsakaq.sys
C:\WINDOWS\system32\wymxajkl.sys
C:\WINDOWS\system32\xsdjbbmp.sys
C:\WINDOWS\system32\xzcsbhlp.sys
.
((((((((((((((((((((((((( Files Created from 2008-06-21 to 2008-07-21 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-21 03:26 8,224 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-21 03:26 10,784 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-21 03:26 1,164 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-21 03:26 1,108 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-21 02:51 --------- d-----w C:\Documents and Settings\User\Application Data\cvzsa
2008-07-13 00:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-07-12 01:55 --------- d-----w C:\Documents and Settings\User\Application Data\CyberScrub
2008-07-12 01:54 --------- d-----w C:\Documents and Settings\User\Application Data\cleaner
2008-07-10 02:31 --------- d-----w C:\Program Files\aimchicjugs
2008-07-06 03:07 --------- d-----w C:\Documents and Settings\User\Application Data\TeamViewer
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:39 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-18 06:52 215,552 ----a-w C:\WINDOWS\system32\ALOWMVFile.dll
2008-06-18 06:52 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-06-18 06:51 90,112 ----a-w C:\WINDOWS\system32\ALOAudioFormatSettings3.dll
2008-06-18 06:51 877,568 ----a-w C:\WINDOWS\system32\ALOAudioFile2.dll
2008-06-18 06:51 780,288 ----a-w C:\WINDOWS\system32\ALOVideoCompress.dll
2008-06-18 06:51 778,240 ----a-w C:\WINDOWS\system32\ALOAudioCompress2.dll
2008-06-18 06:51 495,104 ----a-w C:\WINDOWS\system32\ALOVideoCoreM.dll
2008-06-18 06:51 403,968 ----a-w C:\WINDOWS\system32\ALOWMAFile2.dll
2008-06-18 06:51 382,464 ----a-w C:\WINDOWS\system32\ALOAVIFile.dll
2008-06-18 06:51 249,856 ----a-w C:\WINDOWS\system32\ALOQuickTimeFile.dll
2008-06-18 06:51 2,846,720 ----a-w C:\WINDOWS\system32\ALOAudioCompress3.dll
2008-06-18 06:51 188,416 ----a-w C:\WINDOWS\system32\ALOVideoFile.dll
2008-06-18 05:54 987,136 ----a-w C:\WINDOWS\system32\agsaamh.dll
2008-06-18 05:54 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-06-18 05:54 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-06-18 05:54 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-06-18 05:54 331,776 ----a-w C:\WINDOWS\system32\agsaama.dll
2008-06-18 05:54 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-06-18 05:54 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-06-18 05:54 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-06-18 05:54 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-06-17 10:28 --------- d-----w C:\Program Files\MySql
2008-06-16 17:53 --------- d-----w C:\Documents and Settings\User\Application Data\Alchemy Mindworks
2008-06-14 17:59 271,616 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-14 17:59 271,616 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-07 20:02 --------- d-----w C:\Program Files\TGTSoft
2008-06-06 23:56 465,920 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-06 23:43 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-05-29 16:49 88,774 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-05-28 14:56 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-05-24 12:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-24 12:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-05-23 18:50 --------- d-----w C:\Program Files\ARAR
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:14 1,285,632 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:14 1,285,632 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-25 15:22 206,088 ----a-w C:\WINDOWS\system32\klogon.dll
2004-08-08 22:52 1,040 --sh--w C:\WINDOWS\system32\vlhxaklo.sys
2004-08-08 22:50 1,040 --sh--w C:\WINDOWS\system32\xbfsbjbo.sys
2004-08-08 22:51 520 --sh--w C:\WINDOWS\system32\nttzapaq.sys
2004-08-08 22:50 520 --sh--w C:\WINDOWS\system32\xscqbhlp.sys
2004-08-08 22:51 1,040 --sh--w C:\WINDOWS\system32\ictxaiua.sys
2004-08-08 22:51 520 --sh--w C:\WINDOWS\system32\smdsbsrv.sys
2004-08-08 22:51 520 --sh--w C:\WINDOWS\system32\snfybbyt.sys
2004-08-08 22:52 1,560 --sh--w C:\WINDOWS\system32\erjxakin.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"ares"="C:\Program Files\Ares\Ares.exe" [02/20/2008 05:33 PM 963072]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 07:24 PM 1694208]
"htmtool"="C:\DOCUME~1\User\APPLIC~1\AIMCHI~1\driveflag.exe" [07/10/2008 05:30 AM 573440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/05/2008 08:33 PM 185896]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [04/25/2008 06:21 PM 201992]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:00 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\English\\setup.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [03/25/2008 08:07 PM]
S2 cdralw;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\system32\DRIVERS\nvmini.sys []
S3 eth8023;eth8023;C:\WINDOWS\system32\drivers\eth8023.sys []
S4 PHPGeekUtil;PHPGeekUtil;c:\apache\APACHE.EXE []
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9D71D88C-C598-4935-C5D1-43AA4DB90836}]
C:\Program Files\Bifrost\server.exe s
.
s of the 'Scheduled Tasks' folder
"2008-07-21 03:00:08 C:\WINDOWS\Tasks\AD37E4F6919896CE.job"
- c:\docume~1\user\applic~1\aimchi~1\Tick stupid intra.exe
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKU-Default-Run-msnmsgr - C:\Program Files\MSN Messenger\msnmsgr.exe
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com.sa/
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413} - hxxp://66.186.33.242/talk.cab
C:\WINDOWS\Downloaded Program Files\talk.inf
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\mfc42.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\Downloaded Program Files\imcv1.dll
C:\WINDOWS\Downloaded Program Files\IMSInfo.dll
C:\Program Files\LtUcx\1003\imcv1.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-21 06:28:09
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MySql\MySqlServer\bin\mysqld-nt.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
.
**************************************************************************
.
Completion time: 07/21/2008 6:32:42 - machine was rebooted [User]
ComboFix-quarantined-files.txt 2008-07-21 03:32:20
Pre-Run: 10,644,357,120 bytes free
Post-Run: 10,637,017,088 bytes free
204 --- E O F --- 2008-07-13 00:07:33
