هذا التقرير وتطبيق الخطوه الأولىآ
ComboFix 08-07-19.1 - user 07/20/2008 19:13:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.645 [GMT 3:00]
Running from: C:\Documents and Settings\user\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Application Data\addon.dat
C:\Documents and Settings\OTheR\Application Data\addon.dat
C:\Documents and Settings\user\Application Data\addon.dat
C:\windows\system32\blphct4aj0e559.scr
C:\windows\system32\phct4aj0e559.bmp
C:\windows\v10neformatic.dll
E:\u.bat
F:\u.bat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_NetApi000
((((((((((((((((((((((((( Files Created from 2008-06-20 to 2008-07-20 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-20 16:19 4,128,800 --sha-w C:\windows\system32\drivers\fidbox.dat
2008-07-20 16:16 6,164 --sha-w C:\windows\system32\drivers\fidbox2.idx
2008-07-20 16:16 56,348 --sha-w C:\windows\system32\drivers\fidbox.idx
2008-07-20 16:16 54,304 --sha-w C:\windows\system32\drivers\fidbox2.dat
2008-07-20 12:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-19 16:50 --------- d-----w C:\Documents and Settings\user\Application Data\Bifrost
2008-07-19 15:44 --------- d-----w C:\Program Files\Unlocker
2008-07-18 10:20 --------- d-----w C:\Documents and Settings\user\Application Data\LimeWire
2008-07-18 01:21 --------- d-----w C:\Program Files\TeamViewer3
2008-07-17 20:43 --------- d-----w C:\Program Files\RootKit Hook Analyzer
2008-07-17 20:32 --------- d-----w C:\Program Files\Process Master
2008-07-17 19:03 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DivX
2008-07-17 19:01 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Thinstall
2008-07-17 15:49 112,144 ----a-w C:\windows\system32\drivers\kl1.sys
2008-07-17 03:54 --------- d-----w C:\Program Files\LimeWire
2008-07-16 20:32 96,966 ----a-w C:\windows\system32\drivers\klin.dat
2008-07-16 20:32 88,774 ----a-w C:\windows\system32\drivers\klick.dat
2008-07-16 15:31 --------- d-----w C:\Program Files\iVocalize Web Conference 4
2008-07-15 21:12 --------- d-----w C:\Program Files\Ares
2008-07-13 20:48 --------- d-----w C:\Documents and Settings\user\Application Data\Styler
2008-07-11 00:04 --------- d-----w C:\Program Files\Resource Tuner
2008-07-11 00:04 --------- d-----w C:\Program Files\MSN Messenger
2008-07-10 22:39 --------- d-----w C:\Program Files\Firefly Studios
2008-07-08 21:59 --------- d-----w C:\Documents and Settings\user\Application Data\MSNShell
2008-07-07 14:04 --------- d-----w C:\Documents and Settings\user\Application Data\TeamViewer
2008-07-07 13:08 --------- d-----w C:\Documents and Settings\user\Application Data\DMCache
2008-07-07 03:34 --------- d-----w C:\Program Files\CCleaner
2008-07-05 20:06 --------- d-----w C:\Documents and Settings\user\Application Data\Desktopicon
2008-07-05 17:36 --------- d-----w C:\Program Files\Isotope244 Graphics
2008-07-05 16:49 --------- d-----w C:\Program Files\Space Plasma 3D Screensaver
2008-07-05 15:26 --------- d-----w C:\Program Files\Java
2008-07-05 03:10 --------- d-----w C:\Program Files\No-IP
2008-07-05 01:38 --------- d-----w C:\Documents and Settings\user\Application Data\Isotope 244
2008-07-05 00:48 --------- d-----w C:\Documents and Settings\user\Application Data\Resource Tuner
2008-07-05 00:09 --------- d-----w C:\Program Files\BreakPoint Software
2008-07-04 22:26 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-04 21:58 --------- d-----w C:\Documents and Settings\user\Application Data\Thinstall
2008-07-04 18:33 --------- d-----w C:\Program Files\Common Files\BitDefender
2008-07-04 18:29 --------- d-----w C:\Program Files\DivX
2008-07-04 18:27 --------- d-----w C:\Documents and Settings\LocalService\Application Data\McAfee
2008-07-04 18:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-07-04 18:10 --------- d-----w C:\Program Files\ManyCam 2.2
2008-07-04 18:10 --------- d-----w C:\Program Files\Hotspot Shield
2008-07-04 18:09 --------- d-----w C:\Program Files\Pic2Ico
2008-07-04 18:09 --------- d-----w C:\Program Files\mpegable
2008-07-04 17:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-04 17:42 --------- d-----w C:\Program Files\Zend
2008-07-04 17:42 --------- d-----w C:\Program Files\Yahoo!
2008-07-04 16:46 --------- d-----w C:\Program Files\Opera
2008-07-04 16:43 --------- d-----w C:\Program Files\Offline Explorer Enterprise
2008-06-30 16:46 --------- d-----w C:\Documents and Settings\user\Application Data\AntsSoft
2008-06-30 15:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
2008-06-30 15:18 --------- d-----w C:\Documents and Settings\OTheR\Application Data\CyberLink
2008-06-30 03:13 --------- d-----w C:\Documents and Settings\user\Application Data\Alien Skin
2008-06-30 02:07 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-06-30 01:57 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Uniblue
2008-06-30 01:35 --------- d-----w C:\Documents and Settings\OTheR\Application Data\Yahoo!
2008-06-29 13:09 --------- d-----w C:\Documents and Settings\OTheR\Application Data\Talkback
2008-06-29 00:47 --------- d-----w C:\Documents and Settings\OTheR\Application Data\DivX
2008-06-28 23:19 --------- d-----w C:\Documents and Settings\user\Application Data\Uniblue
2008-06-27 15:58 --------- d-----w C:\Program Files\WMV9_VCM
2008-06-27 15:57 --------- d-----w C:\Program Files\Xara
2008-06-27 14:33 --------- d-----w C:\Documents and Settings\user\Application Data\IDM
2008-06-27 08:58 --------- d-----w C:\Program Files\Google
2008-06-27 08:57 --------- d-----w C:\Documents and Settings\user\Application Data\clipboard_recorder
2008-06-27 04:22 --------- d-----w C:\Program Files\MSBuild
2008-06-27 04:16 --------- d-----w C:\Program Files\Reference Assemblies
2008-06-27 04:14 --------- d-----w C:\Program Files\SourceTec
2008-06-27 03:25 --------- d-----w C:\Documents and Settings\user\Application Data\Talkback
2008-06-27 03:22 --------- d-----w C:\Documents and Settings\user\Application Data\Offline Explorer
2008-06-27 01:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\pure coal bone thunk
2008-06-27 00:30 --------- d-----w C:\Program Files\Uniblue
2008-06-13 12:39 --------- d-----w C:\Program Files\VNCon
2008-06-12 20:26 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-12 10:29 --------- d-----w C:\Program Files\ALJAWAL 3.5G HSDPA DATA CARD
2008-06-08 03:03 --------- d-----w C:\Documents and Settings\user\Application Data\uTorrent
2008-05-23 11:25 --------- d-----w C:\Documents and Settings\user\Application Data\Toshiba
2008-05-22 18:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-05-22 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-05-22 17:08 --------- d-----w C:\Program Files\ReflexiveArcade
2008-05-22 09:38 --------- d-----w C:\Documents and Settings\user\Application Data\DivX
2008-05-21 21:28 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-21 19:45 --------- d-----w C:\Program Files\Windows Live
2008-05-15 13:40 155,995 ----a-w C:\windows\java\Packages\TBFTBFRR.ZIP
2008-05-15 12:56 47,104 ------w C:\windows\AKDeInstall.exe
2008-06-27 02:36 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll
.
------- Sigcheck -------
08/04/2004 12:55 AM 799744 23b013ff71a404e9a401353260e04dd0 C:\windows\system32\wininet.dll
08/04/2004 12:55 AM 799744 23b013ff71a404e9a401353260e04dd0 C:\windows\system32\dllcache\wininet.dll
08/04/2004 12:56 AM 540672 ef34827229b786e17000c5ccd091775f C:\windows\system32\winlogon.exe
08/04/2004 12:56 AM 540672 ef34827229b786e17000c5ccd091775f C:\windows\system32\dllcache\winlogon.exe
08/04/2004 12:56 AM 1549824 a5145822d943c01ce9953e1a3148f801 C:\windows\explorer.exe
08/04/2004 12:56 AM 1549824 a5145822d943c01ce9953e1a3148f801 C:\windows\system32\dllcache\explorer.exe
08/04/2004 12:56 AM 25088 d1442b32e926bbd6a3f5674aaac9ea0e C:\windows\system32\ctfmon.exe
08/04/2004 12:56 AM 25088 d1442b32e926bbd6a3f5674aaac9ea0e C:\windows\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ares"="C:\Program Files\Ares\Ares.exe" [12/31/2007 05:29 PM 962560]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05/15/2008 03:41 PM 185896]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [06/28/2007 12:51 PM 218376]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Program Files\\ALJAWAL 3.5G HSDPA DATA CARD\\ALJAWAL 3.5G HSDPA DATA CARD.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msimg32.dll"=
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\windows\system32\DRIVERS\klim5.sys [04/04/2007 02:58 PM]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\windows\system32\DRIVERS\ManyCam.sys [01/14/2008 01:06 PM]
R3 tapvpn;TAP VPN Adapter;C:\windows\system32\DRIVERS\tapvpn.sys [12/16/2006 11:37 PM]
S3 V0330VID;WebCam Vista/Live! Cam Chat;C:\windows\system32\DRIVERS\V0330Vid.sys [08/08/2007 01:48 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b3427ba-3871-11dd-ae0e-0019d25dfb53}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b342909-3871-11dd-ae0e-0019d25dfb53}]
\Shell\AutoRun\command - J:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c7a335d-43cd-11dd-ae16-0019d25dfb53}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL exiplorer.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c7a430a-43cd-11dd-ae16-0019d25dfb53}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c7a4319-43cd-11dd-ae16-0019d25dfb53}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6d96a44-3869-11dd-ae0d-00037ae70ad4}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6d96b03-3869-11dd-ae0d-00037ae70ad4}]
\Shell\AutoRun\command - H:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e03f0572-227b-11dd-86d8-00037ae70ad4}]
\Shell\AutoRun\command - H:\g83816.com
\Shell\explore\Command - H:\g83816.com
\Shell\open\Command - H:\g83816.com
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4ECFBA68-FE91-C0E1-CD8F-E7E429CC0B4C}]
C:\Program Files\solar\ir.exe s
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{623F3D9A-AC0B-6173-EE5B-0090C6C85B7D}]
C:\Program Files\Bifrost\server.exe s
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{62B0746A-E4D0-C7AA-FC7D-2537A22A8724}]
C:\DOCUME~1\user\LOCALS~1\Temp\temp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{64FD7DB1-3824-B351-A011-264B1D64FFA5}]
C:\Program Files\Bifrost\server.exe s
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{654CD49E-3519-7C7C-56F2-30D37C0B6C13}]
C:\windows\system32:mnj.bat
.
s of the 'Scheduled Tasks' folder
"2008-07-20 16:00:00 C:\windows\Tasks\AFC9581D91B6CA51.job"
- c:\docume~1\user\applic~1\transf~1\Name Option Defy.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-20 19:19:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
.
**************************************************************************
.
Completion time: 07/20/2008 19:27:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-20 16:27:04
Pre-Run: 14,455,947,264 bytes free
Post-Run: 14,647,889,920 bytes free
216 --- E O F --- 2008-07-12 00:02:23
________________________________________
وجآري تطبيق الخطوه الثانيه
