التقرير الاول
ComboFix 08-11-10.01 - xp-2 11/11/2008 12:16:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.226 [GMT 3:00]
Running from: c:\documents and settings\xp-2\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\6x8be16.cmd
C:\autorun.inf
c:\windows\system32\amvo.exe
c:\windows\system32\amvo0.dll
D:\6x8be16.cmd
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 09:17 8,736 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-11 09:17 220,448 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-11 09:12 84,992 --sh--r c:\windows\system32\kav321.dll
2008-11-11 09:12 108,507 --sh--r C:\ogcikeq.com
2008-11-11 08:30 84,992 ------w c:\windows\system32\kav320.dll
2008-11-11 08:30 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-11 08:29 4,724 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-11 08:29 2,336 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-11 07:42 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-11 07:40 91,700 ----a-w c:\windows\system32\drivers\klin.dat
2008-11-11 07:40 85,860 ----a-w c:\windows\system32\drivers\klick.dat
2008-11-11 07:40 --------- d-----w c:\program files\Kaspersky Lab
2008-11-11 07:40 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-11 07:39 --------- d-----w c:\program files\Windows Live
2008-11-11 07:39 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-11 07:38 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-11 07:38 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-11-11 07:38 --------- d-----w c:\program files\Real
2008-11-11 07:38 --------- d-----w c:\program files\Common Files\xing shared
2008-11-11 07:38 --------- d-----w c:\program files\Common Files\Real
2008-11-11 07:28 --------- d-----w c:\program files\Golden Al-Wafi Translator
2008-11-11 07:27 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-11-11 07:27 172,032 ------w c:\windows\Setup1.exe
2008-11-11 07:27 --------- d-----w c:\program files\Common Files\Adobe
2008-11-11 07:25 --------- d-----w c:\program files\iColorFolder
2008-11-11 07:25 --------- d-----w c:\program files\ClocX
2008-11-11 07:24 --------- d-----w c:\program files\Quranzu1
2008-11-11 07:23 --------- d-----w c:\program files\Microsoft.NET
2008-11-11 07:22 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-11 07:21 --------- d-----w c:\program files\mpegable
2008-11-11 07:20 47,104 ------w c:\windows\AKDeInstall.exe
2008-11-11 07:20 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-11 07:13 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-11 07:13 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-11 07:12 --------- d-----w c:\program files\Realtek
2008-11-11 07:10 --------- d-----w c:\program files\Realtek AC97
2008-11-11 07:01 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [09/20/2005 08:05 AM 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [09/20/2005 08:02 AM 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [09/20/2005 08:06 AM 114688]
"ClocX"="c:\program files\ClocX\ClocX.exe" [04/13/2004 05:12 PM 103936]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/11/2008 10:38 AM 185896]
"SoundMan"="SOUNDMAN.EXE" [03/01/2006 01:52 PM 577536 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
«©م، ¢¬نïé Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM 24592]
S3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82c89cf0-afc0-11dd-acf3-0019d109e3cc}]
\Shell\AutoRun\command - F:\6x8be16.cmd
\Shell\explore\Command - F:\6x8be16.cmd
\Shell\open\Command - F:\6x8be16.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aa3fa8e-afc3-11dd-acf6-0019d109e3cc}]
\Shell\AutoRun\command - F:\6x8be16.cmd
\Shell\explore\Command - F:\6x8be16.cmd
\Shell\open\Command - F:\6x8be16.cmd
*Newly Created Service* - PROCEXP90
*Newly Created Service* - USNJSVC
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com.sa/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-11 12:17:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 11/11/2008 12:18:42
ComboFix-quarantined-files.txt 2008-11-11 09:18:39
Pre-Run: 22,299,201,536 bytes free
Post-Run: 22,398,742,528 bytes free
122
---------------------------------------------------------------------------------------------------
التقرير الثاني
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:20:36 م, on 11/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\xp-2\سطح المكتب\Zyzoom_HijackThis.exe
C:\Program Files\internet explorer\iexplore.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: مساعد رابط Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: سرعة تشغيل Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) -
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
--
End of file - 3654 bytes
