هذا التقرير الاول:
ComboFix 08-08-25.01 - user 2008-08-26 18:41:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.642 [GMT 3:00]
Running from: C:\Documents and Settings\TEMP\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\user\Application Data\macromedia\Flash Player\#Shareds\6RP9WFYZ\bin.clearspring.com
C:\Documents and Settings\user\Application Data\macromedia\Flash Player\#Shareds\6RP9WFYZ\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\user\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\user\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\WINDOWS\system32\appcert
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\wbnawnq.dll . . . . failed to delete
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_VWXGHOGR
-------\Service_vwxghogr
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.
2008-08-26 18:51 . 2008-08-26 18:51 268 --ah----- C:\sqmdata02.sqm
2008-08-26 18:51 . 2008-08-26 18:51 244 --ah----- C:\sqmnoopt02.sqm
2008-08-26 18:03 . 2008-08-26 18:03 <DIR> d-------- C:\Documents and Settings\Administrator
2008-08-26 18:01 . 2008-08-26 18:01 <DIR> d--h----- C:\WINDOWS\system32\WLANProfiles
2008-08-26 18:01 . 2008-08-26 18:01 <DIR> d--h----- C:\Settings
2008-08-26 18:01 . 2008-08-26 18:01 711 --a------ C:\Settings.ini
2008-08-26 17:54 . 2008-08-26 17:54 <DIR> d-------- C:\Documents and Settings\TEMP\Application Data\CyberScrub
2008-08-26 17:53 . 2008-08-26 17:53 <DIR> d-------- C:\Documents and Settings\TEMP\Application Data\cleaner
2008-08-26 17:46 . 2008-08-26 17:46 <DIR> d-------- C:\Program Files\Ace Utilities
2008-08-26 17:46 . 2008-08-26 17:56 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-26 17:23 . 2008-08-26 17:23 <DIR> d-------- C:\Documents and Settings\TEMP\Application Data\phgtgvhp
2008-08-26 16:32 . 2008-08-26 16:32 <DIR> d-------- C:\Documents and Settings\TEMP\Application Data\Phone joy
2008-08-26 14:03 . 2008-08-26 14:03 <DIR> d-------- C:\Documents and Settings\TEMP\Application Data\Intel
2008-08-26 13:59 . 2008-08-26 14:00 <DIR> d-------- C:\Documents and Settings\TEMP
2008-08-26 01:54 . 2008-08-26 01:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-25 21:04 . 2006-09-05 19:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-08-25 20:54 . 2008-08-25 20:54 <DIR> d-------- C:\Program Files\Phone joy
2008-08-25 20:00 . 2008-08-25 20:00 <DIR> d-------- C:\Program Files\ESTsoft
2008-08-25 20:00 . 2008-08-25 20:00 <DIR> d-------- C:\Documents and Settings\user\Application Data\ESTsoft
2008-08-25 19:42 . 2008-08-25 21:29 <DIR> d-------- C:\Documents and Settings\user\Application Data\IDM
2008-08-21 22:30 . 2008-08-21 22:30 <DIR> d-------- C:\Program Files\FDRLab
2008-08-20 01:24 . 2008-08-20 01:24 <DIR> d-------- C:\Documents and Settings\user\Application Data\Media Player Classic
2008-08-20 01:17 . 2008-08-20 01:17 1,440,054 --a------ C:\WINDOWS\ACD Wallpaper.bmp
2008-08-19 06:14 . 2008-08-25 20:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web
2008-08-19 06:13 . 2008-08-19 06:13 <DIR> d-------- C:\Program Files\Circle Developement
2008-08-19 06:13 . 2008-08-25 20:55 <DIR> d-------- C:\Documents and Settings\user\Application Data\Phone joy
2008-08-16 09:34 . 2008-08-19 06:09 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-08-16 08:44 . 2008-08-26 08:48 <DIR> d-------- C:\Documents and Settings\user\Tracing
2008-08-15 05:40 . 2008-08-15 05:40 <DIR> d-------- C:\Program Files\DirectVobSub
2008-08-15 05:38 . 2008-08-25 20:22 <DIR> d-------- C:\Program Files\Zoom Player
2008-08-11 18:28 . 2008-08-11 18:28 <DIR> d-------- C:\Program Files\4arabnetwork
2008-08-10 08:56 . 2008-08-10 08:56 <DIR> d-------- C:\Program Files\GeoVid
2008-08-10 08:56 . 2008-08-10 08:56 <DIR> d-------- C:\Documents and Settings\user\Application Data\GeoVid
2008-08-10 08:56 . 2004-08-04 15:00 1,700,352 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-08-10 08:56 . 2003-03-19 08:19 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2008-08-10 08:56 . 2003-03-19 08:12 1,047,552 --a------ C:\WINDOWS\system32\mfc71u.dll
2008-08-10 08:56 . 2003-03-19 06:05 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2008-08-10 08:56 . 2005-06-07 15:11 60,416 --a------ C:\WINDOWS\system32\dsetup.dll
2008-08-10 08:39 . 2008-08-10 08:43 <DIR> d-------- C:\Program Files\EO Video
2008-08-10 08:39 . 2008-08-10 08:38 724,992 --a------ C:\WINDOWS\iun6002.exe
2008-08-08 02:32 . 2008-08-08 02:42 <DIR> d-------- C:\Program Files\SWiSHmax
2008-08-06 08:20 . 2008-08-06 08:22 186 --a------ C:\MicroSoft.vbs
2008-08-03 16:12 . 2008-08-03 16:12 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Intel
2008-08-02 22:23 . 2008-08-02 22:24 <DIR> d-------- C:\Program Files\SWiSH Max2
2008-08-02 22:23 . 2004-03-29 16:23 90,112 --a------ C:\WINDOWS\unvise32.exe
2008-07-29 23:33 . 2008-07-29 23:33 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-29 20:08 . 2008-08-06 08:22 30 --a------ C:\MicroSoft.bat
2008-07-29 11:13 . 2008-07-29 11:13 <DIR> d--h----- C:\WINDOWS\PIF
2008-07-29 10:41 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-07-29 10:40 . 2008-07-29 10:40 <DIR> d-------- C:\Program Files\MSBuild
2008-07-29 10:40 . 2008-07-29 10:40 <DIR> d-------- C:\Program Files\Microsoft Works
2008-07-29 10:34 . 2008-07-29 10:39 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-07-29 10:32 . 2008-07-29 10:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-29 10:29 . 2008-07-29 10:29 <DIR> dr-h----- C:\MSOCache
2008-07-29 09:59 . 2008-07-29 10:00 <DIR> d-------- C:\Program Files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-07-29 09:53 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-29 09:44 . 2008-07-29 09:44 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-07-29 07:42 . 2008-08-26 12:23 <DIR> d-------- C:\Program Files\GetSmile
2008-07-28 22:15 . 2008-07-28 22:15 <DIR> d---s---- C:\Documents and Settings\user\UserData
2008-07-28 21:40 . 2006-08-04 18:10 67 --a------ C:\WINDOWS\IDMan.INI
2008-07-28 21:38 . 2008-08-25 19:42 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-07-28 21:38 . 2008-08-26 13:32 <DIR> d-------- C:\Documents and Settings\user\Application Data\DMCache
2008-07-28 21:26 . 2008-07-29 09:39 <DIR> d-------- C:\Documents and Settings\user\Application Data\COWON
2008-07-28 21:19 . 2008-07-28 21:19 <DIR> d-------- C:\Documents and Settings\user\Application Data\Intel
2008-07-28 21:18 . 2008-07-28 21:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Intel
2008-07-28 21:18 . 2008-07-28 21:18 21,275 --a------ C:\WINDOWS\system32\drivers\AegisP.sys
2008-07-28 21:11 . 2008-08-10 04:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-28 21:04 . 2008-08-25 20:29 <DIR> d-------- C:\Program Files\Windows Live
2008-07-28 21:04 . 2008-08-25 20:53 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-07-28 19:56 . 2008-08-26 17:48 <DIR> d-------- C:\TempEI4
2008-07-28 19:56 . 2008-07-28 19:56 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-07-28 19:29 . 2008-08-26 03:17 1,555 --a------ C:\WINDOWS\ata live update.ini
2008-07-28 19:27 . 2008-07-28 19:27 <DIR> d-------- C:\Documents and Settings\user\Application Data\ACD Systems
2008-07-28 18:57 . 2008-07-28 18:57 <DIR> d-------- C:\Documents and Settings\user\Application Data\Ahead
2008-07-28 18:54 . 2008-07-28 18:54 268 --ah----- C:\sqmdata00.sqm
2008-07-28 18:54 . 2008-07-28 18:54 244 --ah----- C:\sqmnoopt00.sqm
2008-07-28 18:51 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-07-28 18:50 . 2008-07-28 18:50 <DIR> d-------- C:\Program Files\CyberLink
2008-07-28 18:49 . 2008-07-28 18:49 2,535,424 --a------ C:\WINDOWS\system32\agsaamj.dll
2008-07-28 18:49 . 2008-07-28 18:49 1,986,560 --a------ C:\WINDOWS\system32\akll.dll
2008-07-28 18:49 . 2008-07-28 18:49 1,245,184 --a------ C:\WINDOWS\system32\bkll.dll
2008-07-28 18:49 . 2008-07-28 18:49 1,212,416 --a------ C:\WINDOWS\system32\ckll.dll
2008-07-28 18:49 . 2008-07-28 18:49 610,304 --a------ C:\WINDOWS\system32\agsaamg.dll
2008-07-28 18:49 . 2008-07-28 18:49 372,736 --a------ C:\WINDOWS\system32\agsaamc.dll
2008-07-28 18:49 . 2008-07-28 18:49 196,608 --a------ C:\WINDOWS\system32\maag.dll
2008-07-28 18:49 . 2008-07-28 18:49 90,112 --a------ C:\WINDOWS\system32\agsaami.dll
2008-07-28 18:49 . 2008-07-28 18:49 53,760 --a------ C:\WINDOWS\system\ppacklib.dll
2008-07-28 18:48 . 2008-07-28 18:48 <DIR> d-------- C:\WINDOWS\system32\RMBin
2008-07-28 18:48 . 2008-07-28 18:49 <DIR> d-------- C:\Program Files\Real_SC
2008-07-28 18:42 . 2008-07-28 18:42 <DIR> d-------- C:\Program Files\Nero
2008-07-28 18:39 . 2008-07-28 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-28 18:36 . 2008-07-29 10:05 <DIR> d-------- C:\Program Files\JetAudio
2008-07-28 18:35 . 2008-07-28 18:35 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-07-28 18:35 . 2008-07-28 18:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-28 18:35 . 2004-10-14 08:33 2,024,448 --a------ C:\WINDOWS\system32\divx.dll
2008-07-28 18:35 . 2003-06-23 02:44 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll
2008-07-28 18:35 . 2004-01-27 13:53 1,024,000 --a------ C:\WINDOWS\system32\3ivx.dll
2008-07-28 18:35 . 2005-11-24 06:43 843,776 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-07-28 18:35 . 2003-04-21 15:09 245,408 --a------ C:\WINDOWS\system32\unicows.dll
2008-07-28 18:35 . 2004-01-22 19:06 157,696 --a------ C:\WINDOWS\system32\unrar.dll
2008-07-28 18:35 . 2005-11-24 06:44 151,552 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-07-28 18:35 . 2005-10-17 20:58 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-07-28 18:35 . 2005-10-17 20:57 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-07-28 18:35 . 2001-09-17 13:20 19,968 --a------ C:\WINDOWS\system32\cpuinf32.dll
2008-07-28 18:32 . 2008-07-29 09:40 <DIR> d-------- C:\Program Files\GRETECH
2008-07-28 18:31 . 2008-08-19 18:34 211 --a------ C:\WINDOWS\cdplayer.ini
2008-07-28 18:28 . 2008-07-28 18:28 <DIR> d-------- C:\Program Files\Real
2008-07-28 18:28 . 2008-07-29 09:44 <DIR> d-------- C:\Program Files\Common Files\Real
2008-07-28 18:28 . 2008-07-28 18:28 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-07-28 18:28 . 2008-07-28 18:28 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-07-28 18:26 . 2008-07-28 18:26 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-07-28 18:26 . 2008-07-28 18:26 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-07-28 18:26 . 2008-07-28 18:26 <DIR> d-------- C:\Program Files\ACD Systems
2008-07-28 18:26 . 2008-07-28 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-07-28 18:26 . 2008-07-28 18:26 10,368 --a------ C:\WINDOWS\system32\drivers\pfc.sys
2008-07-28 18:24 . 2008-07-29 09:52 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-28 18:17 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-07-28 18:17 . 2008-07-28 18:17 376 --a------ C:\WINDOWS\ODBC.INI
2008-07-28 18:08 . 2008-07-28 18:08 <DIR> d-------- C:\WINDOWS\speech
2008-07-28 18:07 . 2008-07-28 18:07 <DIR> d-------- C:\Program Files\Golden Al-Wafi Translator
2008-07-28 18:07 . 2008-07-28 18:07 172,032 --------- C:\WINDOWS\Setup1.exe
2008-07-28 18:07 . 2008-07-28 18:07 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-07-28 18:01 . 2001-08-23 07:59 57,344 --a------ C:\WINDOWS\system32\WMErrAra.dll
2008-07-28 18:01 . 2001-08-19 03:58 34,356 --a------ C:\WINDOWS\WMPrfAra.prx
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 15:52 677,664 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-26 15:52 16,038,432 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-26 15:51 66,644 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-26 15:51 217,940 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-26 15:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-07 21:25 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-29 06:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-28 17:45 --------- d-----w C:\Program Files\Wireless Console 2
2008-07-28 17:13 --------- d-----w C:\Program Files\Analog Devices
2008-07-28 17:07 --------- d-----w C:\Program Files\CONEXANT
2008-07-28 15:47 155,995 ----a-w C:\WINDOWS\java\Packages\G8MXNBVT.ZIP
2008-07-28 15:46 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-28 15:46 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-28 15:36 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-28 14:59 --------- d-----w C:\Program Files\Kaspersky Lab
2008-07-28 14:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-28 14:49 --------- d-----w C:\Program Files\Intel
2008-07-28 14:40 --------- d-----w C:\Program Files\Generic
2008-07-28 14:30 --------- d-----w C:\Program Files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{B41CA32D-9F96-4C13-9E2D-D4EB44BDC116}]
2001-08-23 13:00 119808 --a------ c:\windows\system32\wbnawnq.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-11-07 15:34 3739672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-02-23 07:40 106496]
"Power_Gear"="C:\Program Files\Generic\Power4 Gear\BatteryLife.exe" [2006-03-06 17:13 86016]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-11-28 08:55 98304]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-11-28 08:52 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-11-28 08:55 118784]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 17:09 987136]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56 602182]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2005-12-28 12:00 569413]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-08-25 21:14 6731312]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-07-29 09:43 180269]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-29 09:52:04 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]
Generic ChkMail.lnk - C:\Program Files\Generic\Generic ChkMail\ChkMail.exe [2008-07-28 17:40:38 32768]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"VIDC.3iv2"= C:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL
"VIDC.VP60"= C:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP61"= C:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP62"= C:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP70"= C:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll
"VIDC.VP31"= C:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll
"VIDC.FFDS"= C:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll
"msacm.ac3acm"= C:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm
"msacm.l3fhg"= C:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\axis web cake second]
--a------ 2008-08-26 17:58 530432 C:\Documents and Settings\All Users\Application Data\Book Slow Axis Web\Real Pop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--------- 2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*
isabled
xpsp2res.dll,-22009
R0 lndkqhkv;lndkqhkv;C:\WINDOWS\system32\drivers\lndkqhkv.sys [2001-08-23 13:00]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6389D943-EFD7-5245-8BD8-CAB8D937B0E0}]
C:\DOCUME~1\user\LOCALS~1\Temp\server.com
.
s of the 'Scheduled Tasks' folder
2008-08-26 C:\WINDOWS\Tasks\AC2277319181EE45.job
- c:\docume~1\user\applic~1\phonej~1\greatopenfile.exe [2008-08-25 20:55]
.
- - - - ORPHANS REMOVED - - - -
Toolbar-ID - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
O8 -: ت&صدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-26 18:53:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
.
**************************************************************************
.
Completion time: 2008-08-26 18:58:15 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-26 15:58:09
Pre-Run: 24,870,948,864 bytes free
Post-Run: 29,213,278,208 bytes free
283
وهدا التقرير التاني :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:15 PM, on 8/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\Generic\Power4 Gear\BatteryLife.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Generic\Generic ChkMail\ChkMail.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\TEMP\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {B41CA32D-9F96-4C13-9E2D-D4EB44BDC116} - c:\windows\system32\wbnawnq.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\Generic\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Generic ChkMail.lnk = C:\Program Files\Generic\Generic ChkMail\ChkMail.exe
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: ???C? ??? OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: ??&?C? ??? OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 6879 bytes
