هذا تقرير الاداه
ComboFix 08-09-05.04 - Atheer 2 09/08/2008 3:55:59.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.84 [GMT 3:00]
Running from: C:\Documents and Settings\Atheer 2\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Atheer 2\Application Data\.#
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\prsgrc.dll
C:\WINDOWS\system32\ssprs.dll
C:\WINDOWS\system32\taskmgr.com
.
((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-08 00:59 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-08 00:59 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-08 00:59 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-08 00:59 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-07 17:49 --------- d-----w C:\Program Files\Uniblue
2008-09-06 13:14 --------- d-----w C:\Program Files\Internet Download Manager
2008-08-06 17:28 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-24 12:03 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-17 21:16 --------- d-----w C:\Program Files\Common Files\xing shared
2008-07-17 21:15 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-07-17 21:15 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-07-13 01:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Bluetooth
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-06-29 00:10 4,792,957 ----a-w C:\WINDOWS\REGBK00.ZIP
2008-06-28 20:08 720,896 ----a-w C:\WINDOWS\iun6002.exe
2008-06-24 16:22 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:22 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 07:15 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-23 09:18 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:18 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 20:09 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:22 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-14 17:59 271,616 ----a-w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-12 22:54 306,432 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-06-11 07:45 116 --sh--w C:\Program Files\desktop.ini
2008-06-10 16:57 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-06-10 16:57 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-06-10 16:57 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-06-10 16:57 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-06-10 16:57 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-06-10 16:57 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-06-10 16:57 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-06-10 16:57 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2007-02-20 14:07 5,473,872 ----a-w C:\Program Files\java.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Hide IP Platinum"="C:\Program Files\Hide IP Platinum\hideippla.exe" [08/01/2007 03:50 PM 1572864]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5674352]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [09/07/2008 12:50 PM 2611968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [06/28/2007 12:51 PM 218376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [11/24/2005 01:14 PM 1947872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoFavoritesMenu"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFavoritesMenu"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"ForceStartMenuLogoff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli scecli scecli scecli scecli scecli scecli scecli
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
"STYLEXP"=C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
"MsnMsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe
"PadTouch"=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
"AGRSMMSG"=AGRSMMSG.exe
"TPSMain"=TPSMain.exe
"CeEKEY"=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
"<NO NAME>"=
"TPNF"=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
"TCtryIOHook"=TCtrlIOHook.exe
"Zooming"=ZoomingHook.exe
"SmoothView"=C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
"Tvs"=C:\Program Files\Toshiba\Tvs\TvsTray.exe
"NDSTray.exe"=NDSTray.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"HWSetup"=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
"SVPWUTIL"=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
"rfagent"="C:\Program Files\RFA Platinum\rfagent.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 12:56 AM 14336]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/04/2007 02:58 PM 24344]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [06/13/2008 01:54 AM 306432]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
s of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R0 -: HKCU-Main,Start Page = hxxp://www.google.com
O8 -: Download ALL with IDA
O8 -: Download with IDA
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O16 -: Microsoft XML Parser for Java - C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
-
O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-08 04:01:11
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\sccfg.sys 8192 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 09/08/2008 4:08:03 - machine was rebooted
ComboFix2.txt 2008-05-03 06:54:24
ComboFix-quarantined-files.txt 2008-09-08 01:07:18
Pre-Run: 8,164,433,920 bytes free
Post-Run: 8,106,172,416 bytes free
198