هذا هو التقرير ..
ComboFix 08-07-29.1 - FRESH 2008-07-30 12:57:49.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.971.1033.18.217 [GMT 3:00]
Running from: C:\Documents and Settings\FRESH\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\p92iqrx.dll
C:\WINDOWS\system32\prsgrc.dll
C:\WINDOWS\system32\qyts7oz.dll
C:\WINDOWS\system32\ssprs.dll
C:\WINDOWS\system32\unxxx.bat
.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.
2008-07-27 20:42 . 2008-07-27 20:42 10 --a------ C:\WINDOWS\system32\810429tv4-test.jun
2008-07-17 18:14 . 2008-07-17 18:14 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-07-03 14:55 . 2008-07-03 14:55 1,024 --a------ C:\WINDOWS\system32\h4bcc9u.dll
2008-07-03 14:55 . 2008-07-03 14:55 218 --a------ C:\WINDOWS\system32\qyts7oz.tgz
2008-06-28 22:42 . 2008-06-28 22:46 <DIR> d-------- C:\Program Files\MP3Gain
2008-06-26 01:03 . 2008-06-26 01:06 <DIR> d-------- C:\Program Files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-06-24 17:08 . 2008-06-24 17:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-24 17:04 . 2008-06-24 17:04 <DIR> d-------- C:\Program Files\ImTOO
2008-06-22 18:16 . 2008-06-22 18:16 <DIR> d-------- C:\Documents and Settings\FRESH\Bluetooth Software
2008-06-22 17:53 . 2008-06-22 17:53 <DIR> d-------- C:\Program Files\WIDCOMM
2008-06-22 16:28 . 2006-11-27 21:20 49,152 --a------ C:\WINDOWS\system32\RegistrationLib193.dll
2008-06-22 15:33 . 2007-03-04 14:55 1,936,528 --a------ C:\WINDOWS\system32\ltmm15.dll
2008-06-22 15:33 . 2007-03-04 14:55 135,168 --a------ C:\WINDOWS\system32\DSKernel2.dll
2008-06-21 18:00 . 2008-06-21 18:00 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-06-21 15:19 . 2008-06-21 17:08 <DIR> d-------- C:\Documents and Settings\FRESH\Application Data\Yahoo!
2008-06-21 15:14 . 2008-06-21 17:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-21 15:08 . 2008-06-21 17:08 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-20 20:56 . 2008-06-21 17:01 <DIR> d-------- C:\Program Files\Google
2008-06-20 18:57 . 2008-06-20 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-06-20 17:14 . 2008-06-20 17:14 <DIR> d-------- C:\Program Files\WinPcap
2008-06-20 17:13 . 2008-06-20 17:14 <DIR> d-------- C:\Program Files\stopcut
2008-06-19 12:17 . 2008-06-13 16:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-19 12:17 . 2008-06-13 16:10 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-18 23:54 . 2004-08-03 22:10 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
2008-06-18 23:54 . 2004-08-03 23:56 16,384 --a------ C:\WINDOWS\system32\ipsink.ax
2008-06-18 23:54 . 2004-08-03 22:10 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
2008-06-18 23:54 . 2004-08-03 22:10 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
2008-06-18 23:54 . 2004-08-03 22:10 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
2008-06-18 23:54 . 2004-08-03 21:58 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
2008-06-18 23:53 . 2005-07-30 02:55 90,624 --a------ C:\WINDOWS\system32\kswdmcap.ax
2008-06-18 23:53 . 2004-08-03 22:10 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
2008-06-18 23:53 . 2004-08-03 23:56 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax
2008-06-18 23:53 . 2004-08-03 23:56 53,760 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2008-06-18 23:53 . 2004-08-03 23:56 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax
2008-06-18 23:53 . 2004-08-03 23:56 28,672 --a------ C:\WINDOWS\system32\vidcap.ax
2008-06-18 23:53 . 2004-08-03 22:10 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
2008-06-18 23:50 . 2008-06-18 23:50 <DIR> d-------- C:\WINDOWS\PixArt
2008-06-18 23:50 . 2008-06-18 23:50 <DIR> d-------- C:\Program Files\PC Camer@
2008-06-18 23:50 . 2008-06-18 23:50 <DIR> d-------- C:\Program Files\Common Files\PAC207
2008-06-18 23:50 . 2006-11-03 09:59 48,128 --a------ C:\WINDOWS\system32\Remove.exe
2008-06-18 23:50 . 2007-02-12 00:06 408 --a------ C:\WINDOWS\system32\Remover.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-30 10:03 25,978,656 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-30 10:03 1,316,640 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-30 08:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-30 07:36 353,528 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-30 07:36 127,376 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-29 19:26 --------- d-----w C:\Documents and Settings\FRESH\Application Data\cleaner
2008-07-26 17:24 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-26 17:24 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-16 14:40 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-07-03 11:58 --------- d-----w C:\Documents and Settings\FRESH\Application Data\Thinstall
2008-06-22 18:25 --------- d-----w C:\Documents and Settings\FRESH\Application Data\TeamViewer
2008-06-22 12:56 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-06-21 14:59 --------- d-----w C:\Program Files\Common Files\Real
2008-06-21 14:56 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-21 14:56 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-20 17:36 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:44 360,960 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:32 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-18 20:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-03 16:06 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-05-19 18:58 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-19 18:58 172,032 ------w C:\WINDOWS\Setup1.exe
2008-05-07 04:55 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-15 20:00 335872]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-21 17:56 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:56 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38 39264]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^FRESH^Start Menu^Programs^Startup^StopCut home.lnk]
backup=C:\WINDOWS\pss\StopCut home.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 02:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-06-01 12:32 94208 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-06-21 17:56 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService]
--a------ 2003-11-08 02:00 4608 C:\WINDOWS\system32\carpserv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Documents and Settings\\FRESH\\My Documents\\My Games\\ألعاب حربية\\c-strike 1\\CSTRIKE.EXE"=
"C:\\Documents and Settings\\FRESH\\My Documents\\My Games\\مقاتلون حتى الموت\\QUAKE3.EXE"=
"F:\\العاب\\games\\FIFA2005 AHLY ZAMALEK\\FIFA2005.EXE"=
"F:\\العاب\\games\\fifa 2005\\FIFA2005.EXE"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"C:\\Documents and Settings\\FRESH\\My Documents\\My Programs\\الإختصارات\\الهاماشي\\hamachi.exe"=
"D:\\PES 6\\Pro Evolution Soccer 6\\Eng-emad.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"D:\\عمر\\omar\\Mozilla Firefox 3 Beta 4_En_ Port._by Hamdy.exe"=
"D:\\Half Life\\half life\\HLDS.EXE"=
"D:\\???\\omar\\Mozilla Firefox 3 Beta 4_En_ Port._by Hamdy.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24457:TCP"= 24457:TCP:BitComet 24457 TCP
"24457:UDP"= 24457:UDP:BitComet 24457 UDP
"15530:TCP"= 15530:TCP:BitComet 15530 TCP
"15530:UDP"= 15530:UDP:BitComet 15530 UDP
R2 AntiArpNdisProt;AntiARP NDIS Protocol Driver;C:\WINDOWS\system32\DRIVERS\AntiArpNdisProt.sys [2007-04-18 19:16]
R3 ALiIRDA;ALi Infrared Device Driver;C:\WINDOWS\system32\DRIVERS\alifir.sys [2001-08-17 12:49]
R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 15:12]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 13:58]
R3 xAntiArp;xAntiArpSpoof Service;C:\WINDOWS\system32\DRIVERS\xAntiArp.sys [2007-08-11 23:06]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 20:31]
S3 PAC207;PC
Camer@;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-06-12 10:39]
S3 scrcap;scrcap;C:\WINDOWS\system32\DRIVERS\scrcap.sys []
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
2008-07-29 C:\WINDOWS\Tasks\hamachi.job
- C:\Documents and Settings\FRESH\My Documents\My Programs\ [2008-07-07 18:32]
2008-07-30 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [2000-08-01 21:58]
2008-07-16 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [2000-08-01 21:58]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
MSConfigStartUp-!AVG Anti-Spyware - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\zyzoom.exe
MSConfigStartUp-AntiARPStandalone - C:\Program Files\AntiARP Stand-alone Edition\AntiArp.exe
MSConfigStartUp-NS Agnt - msagnts.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com.eg/
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com/
R0 -: HKLM-Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
R1 -: HKCU-SearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*
O8 -: &D&ownload &with BitComet
O8 -: &D&ownload all video with BitComet
O8 -: &D&ownload all with BitComet
O8 -: &Download All with FlashGet
O8 -: &Download with FlashGet
O8 -: E&xport to Microsoft Excel
O8 -: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O17 -: HKLM\CCS\Interface\{BA792E94-A15E-4E7F-9AFF-5EB4977FDBAE}: NameServer = 217.52.47.130,217.52.47.140
O16 -: Microsoft XML Parser for Java - C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
C:\WINDOWS\Downloaded Program Files\SysReqLab3.osd
C:\WINDOWS\Downloaded Program Files\sysreqlab3.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-30 13:03:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-30 13:08:53
ComboFix-quarantined-files.txt 2008-07-30 10:08:25
Pre-Run: 3,162,972,160 bytes free
Post-Run: 3,166,298,112 bytes free
225 --- E O F --- 2008-07-30 06:35:41
.png)
.png)
