اخوي boob 77 هذا تقرير الاداة الاولى combofix
ComboFix 08-10-31.02 - Al-shaibani 11/01/2008 20:07:29.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.703 [GMT 3:00]
Running from: F:\برامج\برامج زيزووم\ComboFix 2008\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Al-shaibani\Application Data\FunWebProducts
C:\Program Files\FunWebProducts
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\History\search3
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ASC3360PR
-------\Service_asc3360pr
((((((((((((((((((((((((( Files Created from 2008-10-01 to 2008-11-01 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-01 17:12 36,295,200 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-11-01 17:11 83,624 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-11-01 17:11 735,264 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-11-01 17:11 514,220 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-11-01 17:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-11-01 15:57 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2
2008-11-01 14:58 --------- d-----w C:\Program Files\GVR
2008-11-01 13:59 --------- d-----w C:\Program Files\eMule
2008-11-01 13:58 --------- d-----w C:\Documents and Settings\Al-shaibani\Application Data\Skype
2008-11-01 12:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-10-31 11:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\NVIDIA
2008-10-24 00:32 --------- d-----w C:\Program Files\PremierOpinion
2008-10-24 00:24 --------- d-----w C:\Program Files\CEDP Stealer 6.0 for Messenger
2008-10-23 08:15 --------- d-----w C:\Program Files\Google
2008-10-22 21:49 --------- d-----w C:\Program Files\DivX
2008-10-22 21:46 --------- d-----w C:\Documents and Settings\Al-shaibani\Application Data\DivX
2008-10-17 18:10 --------- d-----w C:\Documents and Settings\Al-shaibani\Application Data\vghd
2008-10-03 03:21 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-10-03 00:21 264 ----a-w C:\TimeSets.dat
2008-09-22 23:38 --------- d-----w C:\Program Files\MSN Messenger
2008-09-19 00:25 --------- d-----w C:\Program Files\Innovative Solutions
2008-09-13 20:56 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-09-09 03:08 --------- d-----w C:\Program Files\Sun
2008-09-09 03:05 --------- d-----w C:\Program Files\Common Files\Java
2008-09-05 15:03 --------- d-----w C:\Program Files\Classic PhoneTools
2008-09-02 00:40 --------- d-----w C:\Program Files\Circle Developement
2008-08-29 04:38 155,995 ----a-w C:\WINDOWS\java\Packages\L3FHVNF5.ZIP
2008-08-18 20:29 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-28 01:11 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\s\index.dat
2008-06-28 01:11 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
2008-06-18 00:40 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061820080619\index.dat
2008-06-28 01:11 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\.IE5\index.dat
.
------- Sigcheck -------
07/22/2007 09:17 AM 814592 9b51cf581e9ea4752e747c3b950dd9c8 C:\WINDOWS\system32\wininet.dll
07/22/2007 09:31 AM 975360 1d23eb782291cb7d3adb33c26ee9583b C:\WINDOWS\explorer.exe
07/22/2007 09:17 AM 68440 1292de840836c2f3a31a8128c1834571 C:\WINDOWS\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [06/18/2008 04:40 AM 4748792]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 09:56 PM 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [06/18/2008 04:46 AM 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM 214416]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [04/19/2007 01:26 PM 7700480]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/18/2008 04:15 AM 180269]
"PremierOpinion"="c:\program files\premieropinion\pmropn.exe" [05/14/2008 03:04 PM 1738240]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [06/28/2007 12:51 PM 218376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/03/2004 09:56 PM 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [06/19/2007 10:17 AM 1241088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"RunNarrator"="Narrator.exe" [07/22/2007 09:15 AM 55808 C:\WINDOWS\system32\narrator.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
gce.exe [2007-07-08 30720]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^gce.exe]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\gce.exe
backup=C:\WINDOWS\pss\gce.exeCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\(Default)
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 10/10/2007 07:51 PM 109424 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
--------- 12/10/2001 05:34 PM 20739 C:\Program Files\Classic PhoneTools\capFax.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/03/2004 09:56 PM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 07/22/2007 09:17 AM 208952 C:\WINDOWS\ime\IMJP8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Download Accelerator]
--a------ 02/14/2008 06:08 PM 2179072 C:\Program Files\IDA\ida.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 10/06/2005 06:03 PM 360448 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--------- 02/07/2007 04:21 PM 128560 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lrrpfgcp]
--a------ 07/08/2007 09:50 PM 8192 C:\WINDOWS\lrrpfgcp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 06/18/2008 04:46 AM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 04/19/2007 01:26 PM 7700480 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 04/19/2007 01:26 PM 86016 C:\WINDOWS\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 06/18/2007 03:10 PM 349184 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 08/03/2004 07:32 PM 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 08/03/2004 07:32 PM 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 06/18/2008 04:17 AM 237568 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 03/14/2007 09:01 PM 140848 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 05/07/2007 10:32 AM 23395368 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 06/18/2008 04:15 AM 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 06/18/2008 04:40 AM 4748792 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--------- 12/12/2005 09:50 AM 88204 C:\WINDOWS\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 05/03/2005 01:43 PM 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 04/19/2007 01:26 PM 1626112 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 05/28/2007 11:32 AM 16132608 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"c:\\program files\\premieropinion\\pmropn.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\ClockGuard\\cgc.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\yupdater.exe"=
"C:\\Java\\jre1.6.0_07\\bin\\jusched.exe"=
"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\
000.fcl [11/02/2006 04:51 PM 13560]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/04/2007 02:58 PM 24344]
S3 tap0801;TAP-Win32 Adapter V8;C:\WINDOWS\system32\DRIVERS\tap0801.sys [10/01/2006 03:37 PM 26624]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e9e06bb-a1dc-11dd-90d9-af6ecd4a254f}]
\Shell\AutoRun\command - I:\xih9.cmd
\Shell\explore\Command - I:\xih9.cmd
\Shell\open\Command - I:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{727dccf0-47a9-11dd-8e2b-d2a4771f5c4e}]
\Shell\AutoRun\command - H:\invwft2h.com
\Shell\explore\Command - H:\invwft2h.com
\Shell\open\Command - H:\invwft2h.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f4813ed-550c-11dd-ab44-a19aedbe48d2}]
\Shell\AutoRun\command - wscript.exe .\.vbs
\Shell\open\command - wscript.exe .\.vbs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c778e547-9c16-11dd-90cf-9b4afaf8db54}]
\Shell\AUtoplAy\cOMMand - I:\cgrjx.pif
\Shell\AutoRun\command - I:\cgrjx.pif
\Shell\eXPlorE\cOMmAnD - I:\cgrjx.pif
\Shell\oPen\comManD - I:\cgrjx.pif
*Newly Created Service* - ASC3360PR
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
MSConfigStartUp-JustVoip - C:\Program Files\JustVoip.com\JustVoip\JustVoip.exe
MSConfigStartUp-NBKeyScan - E:\Nero 11\Nero 8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-SunJavaUpdateSched - C:\Java\jre1.5.0\bin\jusched.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Al-shaibani\Application Data\Mozilla\Firefox\Profiles\7titi53d.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF -: plugin - C:\Java\jre1.6.0_07\bin\npjava11.dll
FF -: plugin - C:\Java\jre1.6.0_07\bin\npjava12.dll
FF -: plugin - C:\Java\jre1.6.0_07\bin\npjava13.dll
FF -: plugin - C:\Java\jre1.6.0_07\bin\npjava14.dll
FF -: plugin - C:\Java\jre1.6.0_07\bin\npjava32.dll
FF -: plugin - C:\Java\jre1.6.0_07\bin\npjpi160_07.dll
FF -: plugin - C:\Java\jre1.6.0_07\bin\npoji610.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npida.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npnul32.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin2.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin3.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin4.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin5.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin6.dll
FF -: plugin - C:\Program Files\Mozilla Firefox 3 Beta 2\plugins\npqtplugin7.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-01 20:12:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\
000.fcl"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 11/01/2008 20:17:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-01 17:17:36
Pre-Run: 32,594,575,360 bytes free
Post-Run: 32,481,501,184 bytes free
232
