الله يجزاك كل خير يالغالي
..
ذا التقرير اللي طلع
ComboFix 08-11-17.01 - spe 11/19/2008 0:34:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.581 [GMT 3:00]
Running from: c:\documents and settings\spe\سطح المكتب\مسار بس غيرته\ومسار ثاني بس تسميتي للمفات من جنبها\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\
0r8RLNK2.exe
c:\documents and settings\All Users\Application Data\6H5h5pF7.exe
c:\documents and settings\All Users\Application Data\N2HNRKX7.exe
c:\documents and settings\LocalService\Application Data\1000544339.exe
c:\documents and settings\LocalService\Application Data\1015618537.exe
c:\documents and settings\LocalService\Application Data\1136998617.exe
c:\documents and settings\LocalService\Application Data\1190610339.exe
c:\documents and settings\LocalService\Application Data\1194018419.exe
c:\documents and settings\LocalService\Application Data\1203194019.exe
c:\documents and settings\spe\Application Data\rhcp24j0eael
c:\documents and settings\spe\My Documents\My Documents.url
c:\documents and settings\spe\My Documents\My Music\My Music.url
c:\documents and settings\spe\My Documents\My Videos\My Video.url
c:\program files\UAV
c:\program files\UAV\uav.ooo
c:\windows\IE4 Error Log.txt
c:\windows\system32\adult.txt
c:\windows\system32\DelSelf.bat
c:\windows\system32\drivers\ati4ruxx.sys
c:\windows\system32\fci.exe.exe
c:\windows\system32\finance.txt
c:\windows\system32\icf.exe.exe
c:\windows\system32\logon.exe
c:\windows\system32\other.txt
c:\windows\system32\pharma.txt
c:\windows\system32\sft.res
c:\windows\system32\sn.txt
c:\windows\yoursearchnet_com.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_Psyche
-------\Legacy_Psyche
-------\Service_PsycheEnqueue
-------\Legacy_PsycheEnqueue
-------\Legacy_ATI4RUXX
-------\Legacy_CBEVTSVC
-------\Legacy_FCI
-------\Legacy_ICF
-------\Service_ati4ruxx
-------\Service_CbEvtSvc
-------\Service_FCI
-------\Service_ICF
((((((((((((((((((((((((( Files Created from 2008-10-18 to 2008-11-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-18 02:55 14,336 ----a-w c:\windows\system32\svchost.exe
2008-11-17 11:47 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-17 07:56 --------- d-----w c:\documents and settings\spe\Application Data\Avira
2008-11-13 08:17 --------- d-----w c:\documents and settings\LocalService\Application Data\Avira
2008-11-13 04:28 --------- d-----w c:\program files\Avira
2008-11-13 04:28 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-11-13 02:52 --------- d-----w c:\program files\Spyware Doctor
2008-11-12 00:49 --------- d-----w c:\program files\Common Files\PC Tools
2008-11-12 00:40 66,952 ----a-w c:\windows\system32\drivers\iksysflt.sys
2008-11-12 00:40 160,792 ----a-w c:\windows\system32\drivers\pctfw2.sys
2008-11-12 00:39 81,288 ----a-w c:\windows\system32\drivers\iksyssec.sys
2008-11-12 00:39 40,840 ----a-w c:\windows\system32\drivers\ikfilesec.sys
2008-11-11 01:43 354,560 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-11-11 01:43 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-11 01:37 --------- d-----w c:\documents and settings\spe\Application Data\TuneUp Software
2008-11-11 01:36 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-11 01:35 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-10 15:38 --------- d-----w c:\program files\InstallShield Installation Information
2008-11-08 22:26 --------- d-----w c:\program files\LtUcx
2008-11-08 19:17 --------- d-----w c:\program files\uTorrent
2008-11-07 20:39 --------- d-----w c:\program files\MSXML 4.0
2008-11-07 17:52 --------- d-----w c:\documents and settings\spe\Application Data\Thinstall
2008-11-05 23:27 --------- d-----w c:\program files\JetAudio
2008-10-30 21:24 --------- d-----w c:\program files\Applications
2008-10-30 00:41 --------- d-----w c:\program files\Hotspot Shield
2008-10-30 00:23 --------- d-----w c:\program files\Hotspot_Shield
2008-10-30 00:16 --------- d-----w c:\program files\Conduit
2008-10-27 18:12 130 ----a-w c:\documents and settings\spe\delself.bat
2008-10-27 13:59 --------- d-----w c:\documents and settings\spe\Application Data\SmartShopper
2008-10-22 00:57 --------- d-----w c:\documents and settings\spe\Application Data\PC Suite
2008-10-22 00:04 --------- d-----w c:\documents and settings\spe\Application Data\BSplayer PRO
2008-10-21 22:15 356,352 ----a-w c:\windows\eSellerateEngine.dll
2008-10-21 22:15 --------- d-----w c:\program files\Deskshare
2008-10-21 22:15 --------- d-----w c:\program files\Common Files\DeskShare Shared
2008-10-21 09:57 --------- d-----w c:\program files\IDA
2008-10-06 06:15 --------- d-----w c:\program files\SPP
2008-10-06 01:24 --------- d-----w c:\documents and settings\All Users\Application Data\MailFrontier
2008-10-05 20:31 --------- d-----w c:\program files\Zone Labs
2008-10-05 20:29 --------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2008-10-04 11:14 --------- d-----w c:\documents and settings\spe\Application Data\MailFrontier
2008-10-04 07:19 1,128,481 ----a-w c:\windows\Internet Logs\tvDebug.Zip
2008-10-01 14:47 --------- d-----w c:\program files\baxmrqc
2008-09-22 04:07 --------- d-----w c:\program files\Micro-Sys Software
2008-09-22 04:07 --------- d-----w c:\documents and settings\spe\Application Data\Micro-Sys
2008-09-15 15:37 1,845,888 ----a-w c:\windows\system32\win32k.sys
2008-08-20 05:36 657,920 ----a-w c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHot0.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
06/24/2008 11:17 PM 1569304 --a------ c:\program files\Hotspot_Shield\tbHot0.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E3EA4FD9-CADE-4ae5-84F7-086EEE888BE4}"= "c:\program files\PandoBar\bar\1.bin\PANDOBAR.DLL" [06/16/2008 05:03 AM 266240]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHot0.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{E3EA4FD9-CADE-4AE5-84F7-086EEE888BE4}"= "c:\program files\PandoBar\bar\1.bin\PANDOBAR.DLL" [06/16/2008 05:03 AM 266240]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHot0.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CLASSES_ROOT\clsid\{e3ea4fd9-cade-4ae5-84f7-086eee888be4}]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/03/2004 11:56 PM 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [09/17/2008 02:50 AM 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [01/02/2004 11:18 AM 185896]
"DSLAGENTEXE"="c:\program files\Conexant\Adsl\dslagent.exe" [08/25/2005 12:47 PM 65536]
"TrialReset"="c:\windows\fix.exe" [04/28/2008 09:57 PM 208353]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [06/12/2008 02:28 PM 266497]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [06/16/2008 05:04 AM 282624]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/03/2004 11:56 PM 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [06/19/2007 10:17 AM 1241088]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wincg61.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winch58.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winkp48.sys]
@="Driver"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Pando Networks\\Pando\\pando.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58490:TCP"= 58490:TCP
ando P2P TCP Listening Port
"58490:UDP"= 58490:UDP
ando P2P UDP Listening Port
R1 pctfw2;pctfw2;\??\c:\windows\system32\drivers\pctfw2.sys [2008-11-12 160792]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-11-13 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-11-13 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;"c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-11-13 41217]
R2 CamelApache;CamelApache;"c:\camel\apache\apache.exe" --ntservice [2004-10-28 20545]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe -k netsvcs [2004-08-03 14336]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys []
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys []
S0 Wincg61;Wincg61;c:\windows\system32\Drivers\Wincg61.sys []
S0 Winch58;Winch58;c:\windows\system32\Drivers\Winch58.sys []
S0 Winkp48;Winkp48;c:\windows\system32\Drivers\Winkp48.sys []
S2 AlerterVSS;Alerter AlerterVSS; srv []
S2 CamelApacheProtectedStorage;CamelApache CamelApacheProtectedStorage; srv []
S2 gusvcMSDTC;Google Updater Service gusvcMSDTC; srv []
S2 NetlogonTermService;Net Logon NetlogonTermService; srv []
S2 WmdmPmSNTrkWks;Portable Media Serial Number Service WmdmPmSNTrkWks; srv []
S2 WmiApSrvTermService;WMI Performance Adapter WmiApSrvTermService; srv []
S3 CamelMysql;CamelMysql;c:\camel\mysql\bin\mysqld-nt.exe --defaults-file="c:\camel\mysql\ini\my.ini" CamelMysql []
S3 RapFile;RapFile;\??\c:\windows\system32\drivers\RapFile.sys [2008-08-03 36644]
S3 RapNet;RapNet;\??\c:\windows\system32\drivers\RapNet.sys [2008-08-03 24344]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\J:\NTGLM7X.sys []
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys []
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-11-11 354560]
S3 Vsp;Vsp;\??\c:\windows\system32\drivers\Vsp.sys [2004-01-02 3351]
S4 black;black;c:\windows\system32\drivers\BlackDrv.sys []
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{590a268b-0fa3-11dd-85a1-000d61e0ad82}]
\Shell\Auto\command - K:\ALMV.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL ALMV.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A744F16C-B2D5-4138-81A2-085CDFCDE83A}]
rundll32 sxmg4.dll,InitModule
.
s of the 'Scheduled Tasks' folder
2008-11-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [04/16/2008 09:59 AM]
2008-11-18 c:\windows\Tasks\Tasks.job
- c:\windows\Tasks [11/11/2008 05:54 AM]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{06663B56-0D73-4f9f-BCC5-4AA941470AFD} - (no file)
HKLM-Explorer_Run-smile - c:\program files\Applications\wcs.exe
Notify-xvysmo - xvysmo.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\spe\Application Data\Mozilla\Firefox\Profiles\m64uj6xs.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPPandBr.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-19 00:43:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AlerterVSS]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CamelApacheProtectedStorage]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gusvcMSDTC]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetlogonTermService]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSNTrkWks]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvTermService]
"ImagePath"=" srv"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Premium\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Premium\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 11/19/2008 0:52:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-18 21:52:12
Pre-Run: 6,673,514,496 bytes free
Post-Run: 7,044,780,032 bytes free
250
وكشف ان نسختي الويندوز مكركه ^_^
