الاخ الغالي : demo-dash
تفضل هذا هو التقرير:
ComboFix 08-09-15.02 - abu jihad 09/17/2008 1:09:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.196 [GMT 3:00]
Running from: C:\Documents and Settings\abu jihad\Desktop\11\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\x64
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IPRIP
-------\Service_Iprip
((((((((((((((((((((((((( Files Created from 2008-08-16 to 2008-09-16 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-16 22:09 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\DMCache
2008-09-16 00:39 --------- d-----w C:\Program Files\IObit
2008-09-15 23:57 --------- d-----w C:\Program Files\Microsoft Encarta
2008-09-13 01:48 --------- d-----w C:\Program Files\MSConfig CleanUp
2008-09-13 01:03 --------- d-----w C:\Program Files\Uniblue
2008-09-13 01:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Uniblue
2008-09-13 01:03 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\Uniblue
2008-09-12 23:36 --------- d-----w C:\Program Files\Common Files\TerraGame Shared
2008-09-11 21:06 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-11 21:05 --------- d-----w C:\Program Files\ma-config.com
2008-09-11 21:05 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\ma-config.com
2008-09-11 20:58 2,015 ---h--r C:\WINDOWS\system32\drivers\hosts
2008-09-11 20:58 --------- d-----w C:\Program Files\RogueRemover PRO
2008-09-11 20:26 --------- d-----w C:\Program Files\MSN Messenger
2008-09-11 20:26 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-11 08:08 --------- d-----w C:\Program Files\Sun
2008-09-11 08:07 --------- d-----w C:\Program Files\Java
2008-09-11 08:06 --------- d-----w C:\Program Files\Common Files\Java
2008-09-11 01:15 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\MiniDm
2008-09-11 01:13 --------- d-----w C:\Program Files\IEPro
2008-09-08 23:25 --------- d-----w C:\Program Files\VS Revo Group
2008-09-08 23:25 --------- d-----w C:\Program Files\Speed Startup
2008-09-08 21:43 --------- d-----w C:\Program Files\aMSN
2008-09-04 19:10 --------- d-----w C:\Program Files\Avira
2008-09-04 19:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-08-29 22:21 --------- d-----w C:\Program Files\Hide IP Platinum
2008-08-29 07:10 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\uTorrent
2008-08-22 14:56 --------- d-----w C:\Program Files\Trojan Remover
2008-08-21 21:03 --------- d-----w C:\Program Files\Changer XP
2008-08-20 14:57 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\Forexyard
2008-08-19 09:36 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-15 22:32 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\Nokia
2008-08-12 18:40 --------- d-----w C:\Program Files\FLVPlayer4Free
2008-08-12 17:02 --------- d-----w C:\Program Files\Microsoft Works
2008-08-09 12:22 --------- d-----w C:\Documents and Settings\Guest\Application Data\PC Suite
2008-08-01 12:33 --------- d-----w C:\Program Files\Nokia
2008-08-01 12:33 --------- d-----w C:\Program Files\Common Files\Nokia
2008-08-01 12:28 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-08-01 12:28 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-08-01 12:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nokia
2008-08-01 12:23 --------- d-----w C:\Program Files\MSXML 6.0
2008-08-01 12:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-07-29 15:40 --------- d-----w C:\Program Files\Common Files\xing shared
2008-07-29 15:40 --------- d-----w C:\Program Files\Common Files\Real
2008-07-29 15:39 --------- d-----w C:\Program Files\Real
2008-07-29 15:38 --------- d-----w C:\Documents and Settings\abu jihad\Application Data\FairStars Audio Converter
2008-07-29 15:37 --------- d-----w C:\Program Files\FairStars Audio Converter
2008-07-29 07:32 --------- d-----w C:\Program Files\uTorrent
2008-07-23 05:52 --------- d-----w C:\Program Files\VerbAce
2008-07-18 18:39 586,240 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-06-19 12:55 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-19 05:18 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-19 05:18 172,032 ------w C:\WINDOWS\Setup1.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 10:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [09/04/2008 11:10 PM 266497]
"MSConfig"="C:\WINDOWS\PcHealth\HelpCtr\Binaries\msconfig.exe" [08/04/2004 10:56 AM 158208]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [08/04/2004 10:56 AM 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [11/09/2006 05:15 PM 1634304]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [03/22/2007 07:29 PM 39264]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 07/03/2008 07:07 AM 932864 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 07/01/2008 03:27 AM 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
--a------ 07/23/2008 01:16 PM 1927448 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\IEPro\\MiniDM.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [09/04/2008 11:10 PM 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [09/04/2008 11:10 PM 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [09/04/2008 11:10 PM 41217]
R3 PAC207;PC Camera;C:\WINDOWS\system32\DRIVERS\PFC027.SYS [05/29/2007 11:30 PM 508160]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [08/04/2004 10:56 AM 14336]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [08/04/2004 10:56 AM 14336]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [08/04/2004 10:56 AM 14336]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [08/04/2004 10:56 AM 14336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R0 -: HKLM-Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-17 01:12:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\snmp.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 09/17/2008 1:16:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-16 22:16:48
Pre-Run: 17,847,119,872 bytes free
Post-Run: 17,785,962,496 bytes free
164 --- E O F --- 2008-09-12 22:35:57
k:
