ComboFix 08-08-25.01 - dell 08/26/2008 23:48:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.493 [GMT 3:00]
Running from: F:\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\WINDOWS\system32\actskn43.ocx
C:\WINDOWS\system32\blphcjfdj0e7fg.scr
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\lphcjfdj0e7fg.exe
C:\WINDOWS\system32\phcjfdj0e7fg.bmp
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 20:55 2,695,200 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-26 20:53 104,480 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-26 20:53 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-26 20:52 40,208 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-26 20:52 11,840 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-26 20:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-26 19:39 3,026 ----a-w C:\WINDOWS\system32\tmp.reg
2008-08-26 16:55 --------- d-----w C:\Program Files\Spyware Doctor
2008-08-26 16:49 0 ----a-w C:\osy3.sys
2008-08-26 16:47 --------- d-----w C:\Program Files\Common Files\delet
2008-08-26 08:14 --------- d-----w C:\Documents and Settings\dell\Application Data\PC Tools
2008-08-26 08:07 --------- d-----w C:\Documents and Settings\dell\Application Data\uTorrent
2008-08-26 08:01 104,452 ----a-w C:\WINDOWS\system32\msxml71.dll
2008-08-26 07:34 --------- d-----w C:\Program Files\uTorrent
2008-08-25 06:19 --------- d-----w C:\Program Files\WinAVI FLV Converter
2008-08-24 07:23 --------- d-----w C:\Documents and Settings\dell\Application Data\WinAVI
2008-08-24 05:24 92,661 --sh--r C:\mnl6on3.com
2008-08-22 22:42 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-08-21 18:45 --------- d-----w C:\Program Files\mpegable
2008-08-20 07:19 --------- d-----w C:\Documents and Settings\dell\Application Data\Media Player Classic
2008-08-19 08:13 --------- d-----w C:\Documents and Settings\dell\Application Data\ACD Systems
2008-08-18 19:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-08-18 18:58 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-18 18:58 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-08-18 18:58 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-18 18:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-08-18 18:53 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-18 18:49 --------- d-----w C:\Documents and Settings\dell\Application Data\Apple Computer
2008-08-18 18:38 --------- d-----w C:\Program Files\QuickTime
2008-08-18 18:38 --------- d-----w C:\Program Files\iTunes
2008-08-18 18:38 --------- d-----w C:\Program Files\iPod
2008-08-18 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-18 18:33 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-18 18:32 --------- d-----w C:\Program Files\Quranzu1
2008-08-18 18:31 --------- d-----w C:\Program Files\FlashPlayer Plus
2008-08-18 18:27 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-08-18 18:08 --------- d-----w C:\Program Files\Windows Live
2008-08-18 08:55 --------- d-----w C:\Program Files\ClocX
2008-08-12 11:56 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2008-08-12 08:33 --------- d-----w C:\Documents and Settings\dell\Application Data\CyberLink
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [11/20/2007 03:03 PM 171448]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/09/2006 03:41 PM 4617720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEM02Mon.exe"="C:\WINDOWS\OEM02Mon.exe" [02/02/2007 01:00 AM 36864]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [11/20/2007 03:05 PM 180269]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [03/16/2007 06:10 PM 1392640]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 10:50 AM 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 08:24 PM 32768]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [05/16/2007 04:50 PM 137752]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [05/16/2007 04:50 PM 162328]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [05/16/2007 04:50 PM 137752]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [10/06/2005 06:03 PM 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [08/18/2008 09:38 PM 155648]
"ClocX"="C:\Program Files\ClocX\ClocX.exe" [04/13/2004 05:12 PM 103936]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [04/10/2008 03:14 PM 1107848]
"SigmatelSysTrayApp"="stsystra.exe" [05/06/2007 05:10 PM 405504 C:\WINDOWS\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-02-03 14:52:55 113664]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 18:28:28 622653]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 11/02/2004 08:24 PM 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/09/2006 03:41 PM 4617720 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;C:\WINDOWS\system32\drivers\IntcHdmi.sys [12/06/2006 05:40 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM]
R3 OEM02Afx;Provides a software interface to control audio effects of M08 Internal webcam.;C:\WINDOWS\system32\Drivers\OEM02Afx.sys [01/10/2007 05:43 PM]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\WINDOWS\system32\DRIVERS\OEM02Dev.sys [03/20/2007 01:00 AM]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\WINDOWS\system32\DRIVERS\OEM02Vfx.sys [03/05/2007 06:45 PM]
S3 AVPsys;AVPsys;C:\WINDOWS\system32\drivers\tdi.sys []
.
s of the 'Scheduled Tasks' folder
2008-08-26 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [09/27/2006 05:39 PM]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-lphcjfdj0e7fg - C:\WINDOWS\system32\lphcjfdj0e7fg.exe
HKLM-Run-Device Detector - DevDetect.exe
MSConfigStartUp-MonAppli - C:\windows\system32\msnmsg.exe
MSConfigStartUp-Skype - C:\Program Files\Skype\Phone\Skype.exe
.
------- Supplementary Scan -------
.
O8 -: &Download FLV by WinAVI... - C:\Program Files\WinAVI FLV Converter\flv_link.htm
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-26 23:54:29
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\system32\WTSAPI32.dll
-> ?:\WINDOWS\system32\WTSAPI32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\stacsv.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 08/27/2008 0:00:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-26 21:00:17
Pre-Run: 60,735,770,624 bytes free
Post-Run: 60,349,284,352 bytes free
179
بس تراه ظبط الجهاز بعد الاداة الاولى
k: