هذا التقرير حق التنظيف
ComboFix 08-07-26.1 - WIN XP 08/04/2008 14:07:18.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.685 [GMT 3:00]
Running from: C:\Documents and Settings\WIN XP\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-07-04 to 2008-08-04 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-04 11:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-04 11:04 7,979,808 --sha-w C:\windows\system32\drivers\fidbox.dat
2008-08-04 11:04 271,136 --sha-w C:\windows\system32\drivers\fidbox2.dat
2008-08-04 11:04 22,376 --sha-w C:\windows\system32\drivers\fidbox2.idx
2008-08-04 11:04 110,132 --sha-w C:\windows\system32\drivers\fidbox.idx
2008-08-02 06:57 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-08-02 06:56 --------- d-----w C:\Program Files\Opera 9.5 alpha
2008-08-02 06:56 --------- d-----w C:\Program Files\Macromedia
2008-08-02 06:54 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-02 04:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-02 04:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-08-02 04:17 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-08-02 04:02 367 ----a-w C:\Documents and Settings\WIN XP\ie_updates3r.exe
2008-08-01 23:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trans Once Mess Frag
2008-07-31 22:07 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-31 14:37 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\IDM
2008-07-31 14:36 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\DMCache
2008-07-31 08:13 --------- d-----w C:\Program Files\Yahoo!
2008-07-31 08:07 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\CyberScrub
2008-07-31 08:05 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\cleaner
2008-07-30 08:27 --------- d-----w C:\Program Files\iISystem Wiper
2008-07-30 01:56 --------- d-----w C:\Program Files\SWiSHmax
2008-07-26 20:45 --------- d-----w C:\Program Files\Bifrost
2008-07-25 10:43 --------- d-----w C:\Program Files\Microsoft VM
2008-07-24 15:38 --------- d-----w C:\Program Files\swfscanner
2008-07-23 20:54 --------- d-----w C:\Program Files\Circle Developement
2008-07-23 16:13 96,559 ----a-w C:\windows\system32\drivers\klin.dat
2008-07-23 16:13 87,855 ----a-w C:\windows\system32\drivers\klick.dat
2008-07-23 16:13 112,144 ----a-w C:\windows\system32\drivers\kl1.sys
2008-07-23 15:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-07-23 15:38 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-23 12:19 --------- d-----w C:\Program Files\Google
2008-07-23 10:14 --------- d-----w C:\Program Files\Trojan Remover
2008-07-23 10:12 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-23 03:57 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\Simply Super Software
2008-07-22 08:51 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\byteamenlive
2008-07-22 08:48 --------- d-----w C:\Program Files\byteamenlive
2008-07-20 19:33 --------- d-----w C:\Program Files\WMV9_VCM
2008-07-20 19:33 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\MAGIX
2008-07-20 19:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-07-20 19:32 --------- d-----w C:\Program Files\Common Files\Xara
2008-07-20 19:31 --------- d-----w C:\Program Files\Xara
2008-07-20 19:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Xara
2008-07-20 12:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-20 07:43 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\DivX
2008-07-20 04:34 407,129 ----a-w C:\windows\MarioForever_Toolbar_Uninstaller_3578.exe
2008-07-20 04:34 --------- d-----w C:\Program Files\Mario Forever Toolbar
2008-07-20 04:34 --------- d-----w C:\Program Files\Mario Forever
2008-07-19 05:04 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\Yahoo!
2008-07-19 05:03 --------- d-----w C:\Program Files\DivX
2008-07-18 05:36 --------- d-----w C:\Program Files\NOS
2008-07-18 05:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-07-18 00:38 778,240 ----a-w C:\windows\system32\ALOAudioCompress2.dll
2008-07-15 09:10 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\TurboFTP
2008-07-09 04:23 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\SmartFTP
2008-07-09 04:20 --------- d-----w C:\Documents and Settings\WIN XP\Application Data\BPFTP
2008-07-09 04:16 --------- d-----w C:\Program Files\LeapFTP
2008-07-08 15:19 1,245,184 ----a-w C:\windows\system32\bkll.dll
2008-06-20 10:44 --------- d-----w C:\Program Files\MSN Messenger
2008-06-20 08:51 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-06-18 17:52 161,096 ----a-w C:\windows\system32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 ----a-w C:\windows\system32\DivXsm.exe
2008-06-11 00:07 43,528 ------w C:\windows\system32\drivers\PxHelp20.sys
2008-06-11 00:07 3,596,288 ----a-w C:\windows\system32\qt-dx331.dll
2008-06-11 00:07 129,784 ------w C:\windows\system32\pxafs.dll
2008-06-11 00:07 120,056 ------w C:\windows\system32\pxcpyi64.exe
2008-06-11 00:07 118,520 ------w C:\windows\system32\pxinsi64.exe
2008-06-11 00:04 200,704 ----a-w C:\windows\system32\ssldivx.dll
2008-06-11 00:04 1,044,480 ----a-w C:\windows\system32\libdivx.dll
2008-06-05 10:11 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-06-05 07:14 45,056 ----a-w C:\windows\NCUNINST.EXE
2008-06-05 07:12 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-05-22 22:18 12,288 ----a-w C:\windows\system32\DivXWMPExtType.dll
2008-05-07 12:09 311,296 ----a-w C:\windows\FastFolders.dll
2008-05-07 12:09 28,672 ----a-w C:\windows\FFUninst.exe
2008-05-05 18:06 158,456 ------w C:\windows\system32\pxwma.dll
2008-03-14 20:19 157 ----a-w C:\Program Files\COM.NET.txt
.
(((((((((((((((((((((((((((((
snapshot@Sat 07-26-2008_23.57.18.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-08-31 01:31:28 120,464 ----a-w C:\windows\Downloaded Installations\Macromedia Flash 8\FL_Client_Installer.exe
+ 2005-04-04 11:49:16 2,003,176 ----a-w C:\windows\Downloaded Installations\Macromedia Flash 8\WindowsInstaller-KB884016-v2-x86.exe
+ 2008-08-02 04:17:45 65,536 ----a-r C:\windows\Installer\{236BB7C4-4419-42FD-0409-1E257A25E34D}\NewShortcut1_236BB7C4441942FD04091E257A25E34D.exe
+ 2008-08-02 06:58:45 65,536 ----a-r C:\windows\Installer\{2BD5C305-1B27-4D41-B690-7A61172D2FEB}\ARPPRODUCTICONFL8.exe
+ 2008-08-02 06:55:28 65,536 ----a-r C:\windows\Installer\{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}\EMARPPRODUCTICON.exe
+ 2008-08-02 06:55:46 53,248 ----a-r C:\windows\Installer\{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}\ARPPRODUCTICONFLV1.exe
+ 2008-08-02 04:19:11 65,536 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\AdobeBridge_B74D4E10103300000000000000000001_1.exe
+ 2008-08-02 04:19:11 65,536 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\BridgeCommonShortcut_B74D4E101033000000000001_1.exe
+ 2008-08-02 04:19:11 1,904,640 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\ESLaunchShortcut_B74D4E10103300000000000000000001.exe
+ 2008-08-02 04:19:11 61,440 ----a-r C:\windows\Installer\{B74D4E10-1033-0000-0000-000000000001}\NewShortcut2_B74D4E10103300000000000000000001.exe
+ 2008-08-02 04:22:41 65,536 ----a-r C:\windows\Installer\{E9787678-1033-0000-8E67-000000000001}\AppLanuchShortcut_E9787678103300008E67000000000001_1.exe
+ 2008-08-02 04:22:41 65,536 ----a-r C:\windows\Installer\{E9787678-1033-0000-8E67-000000000001}\ProgramMenuShortcut_E9787678103300008E670000000001_1.exe
- 2004-08-03 22:56:46 8,384,000 -c--a-w C:\windows\system32\dllcache\shell32.dll
+ 2007-10-25 16:42:42 8,445,952 ----a-w C:\windows\system32\dllcache\shell32.dll
- 2008-07-21 00:30:13 469,984 ----a-w C:\windows\system32\FNTCACHE.DAT
+ 2008-08-03 20:16:18 30,576 ----a-w C:\windows\system32\FNTCACHE.DAT
- 2007-11-20 13:52:00 2,884,992 ----a-w C:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2005-08-27 11:08:06 1,398,408 ----a-w C:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2008-07-26 20:03:04 41,170 ----a-w C:\windows\system32\perfc009.dat
+ 2008-08-04 11:10:17 41,170 ----a-w C:\windows\system32\perfc009.dat
- 2008-07-26 20:03:04 314,842 ----a-w C:\windows\system32\perfh009.dat
+ 2008-08-04 11:10:17 314,842 ----a-w C:\windows\system32\perfh009.dat
+ 2005-08-05 05:52:14 1,642,496 ----a-w C:\windows\system32\QuickTime\MMxptResources.dll
- 2004-08-03 22:56:46 8,384,000 ----a-w C:\windows\system32\shell32.dll
+ 2007-10-25 16:42:42 8,445,952 ----a-w C:\windows\system32\shell32.dll
- 2006-09-06 14:43:16 14,048 ------w C:\windows\system32\spmsg.dll
+ 2007-03-06 01:22:33 14,048 ------w C:\windows\system32\spmsg.dll
- 1999-12-17 05:13:04 86,016 ----a-w C:\windows\unvise32.exe
+ 2004-03-29 12:23:44 90,112 ----a-w C:\windows\unvise32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/15/2008 03:26 AM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
C:\Documents and Settings\WIN XP\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-14 23:39:40 113664]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-14 23:39:40 113664]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/04/2004 01:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 08/04/2004 01:06 AM 1667584 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start Save]
--a------ 07/22/2008 11:48 AM 515072 C:\DOCUME~1\WINXP~1\APPLIC~1\BYTEAM~1\Settings sixth beep.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 03/15/2008 03:26 AM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Macromedia\\Flash MX\\Flash.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\windows\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\windows\system32\DRIVERS\klim5.sys [03/25/2008 08:07 PM]
R3 tapvpn;TAP VPN Adapter;C:\windows\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM]
S2 TBFTPSyncService;TurboFTP Sync Service;C:\Program Files\TurboFTP\tftpsvc.exe [03/22/2008 09:55 PM]
S4 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [06/26/2008 10:24 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{85d1c95f-015d-11dd-ab14-001dd9e6dda7}]
\Shell\AutoRun\command - fooool.exe
\Shell\explore\Command - fooool.exe
\Shell\open\Command - fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cca6ee8e-f2d6-11dc-aad7-001dd9e6dda7}]
\shell\explore\Command - H:\boot.exe
\shell\open\Command - H:\boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ecc2a6cb-2520-11dd-abb2-001dd9e6dda7}]
\shell\explore\Command - F:\boot.exe
\shell\open\Command - F:\boot.exe
.
s of the 'Scheduled Tasks' folder
2008-08-04 C:\windows\Tasks\A9EB68D291911A96.job - s"!9c:\docume1\winxp1\applic1\byteam1\fast defy junk.exeWIN XP0 []
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com.sa/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7RNWN
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
C:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-04 14:10:24
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\windows\explorer.exe
-> ?:\WINDOWS\system32\iphlpapi.dll
.
Completion time: 08/04/2008 14:11:55
ComboFix-quarantined-files.txt 2008-08-04 11:11:46
ComboFix2.txt 2008-08-03 23:51:59
ComboFix3.txt 2008-08-03 23:41:35
Pre-Run: 23,476,494,336 bytes free
Post-Run: 23,473,491,968 bytes free
220
ارجووو الفائدهـ
