.. آسف يا غالي ع التأخير ..
.. و هذا التقرير
الاداة الاولى ..
ComboFix 08-11-17.01 - vip 11/18/2008 16:22:25.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1256.1.1025.18.265 [GMT 3:00]
Running from: c:\users\vip\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\alexa toolbar
c:\windows\system32\kakle.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-18 to 2008-11-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 02:37 174 --sha-w c:\program files\desktop.ini
2008-11-17 02:27 --------- d-----w c:\program files\Windows Sidebar
2008-11-17 02:27 --------- d-----w c:\program files\Windows Photo Gallery
2008-11-17 02:27 --------- d-----w c:\program files\Windows Mail
2008-11-17 02:27 --------- d-----w c:\program files\Windows Journal
2008-11-17 02:27 --------- d-----w c:\program files\Windows Defender
2008-11-17 02:27 --------- d-----w c:\program files\Windows Collaboration
2008-11-17 02:27 --------- d-----w c:\program files\Windows Calendar
2008-11-17 02:14 82,432 ----a-w c:\windows\System32\axaltocm.dll
2008-11-17 02:14 101,888 ----a-w c:\windows\System32\ifxcardm.dll
2008-11-16 19:23 --------- d-----w c:\program files\Hotspot Shield
2008-11-15 23:26 --------- d-----w c:\program files\Gamevance
2008-11-14 20:07 --------- d-----w c:\users\vip\AppData\Roaming\Any Video Converter
2008-11-13 20:28 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-13 14:00 --------- d-----w c:\program files\Anark
2008-11-12 20:29 --------- d-----w c:\programdata\Microsoft Help
2008-11-12 20:28 212,480 ----a-w c:\windows\system32\drivers\mrxsmb10.sys
2008-11-12 20:27 2,048 ----a-w c:\windows\System32\msxml3r.dll
2008-11-12 20:27 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-11-12 20:26 --------- d-----w c:\program files\MSXML 4.0
2008-11-12 20:25 2,048 ----a-w c:\windows\System32\msxml6r.dll
2008-11-12 20:25 1,334,272 ----a-w c:\windows\System32\msxml6.dll
2008-11-07 15:46 --------- d-----w c:\programdata\WLInstaller
2008-11-01 02:05 --------- d-----w c:\program files\FlashFXP
2008-11-01 01:16 443,392 ----a-w c:\windows\System32\win32spl.dll
2008-11-01 01:16 37,888 ----a-w c:\windows\System32\printcom.dll
2008-10-31 07:05 --------- d-----w c:\program files\Google
2008-10-31 05:19 --------- d-----w c:\users\vip\AppData\Roaming\yahoo!
2008-10-31 05:19 --------- d-----w c:\program files\Yahoo!
2008-10-29 23:47 --------- d-----w c:\program files\Common Files\xing shared
2008-10-29 23:47 --------- d-----w c:\program files\Common Files\Real
2008-10-29 16:16 90,112 ----a-w c:\windows\System32\agsaami.dll
2008-10-29 16:16 610,304 ----a-w c:\windows\System32\agsaamg.dll
2008-10-29 16:16 372,736 ----a-w c:\windows\System32\agsaamc.dll
2008-10-29 16:16 2,535,424 ----a-w c:\windows\System32\agsaamj.dll
2008-10-29 16:16 196,608 ----a-w c:\windows\System32\maag.dll
2008-10-29 16:16 1,986,560 ----a-w c:\windows\System32\akll.dll
2008-10-29 16:16 1,245,184 ----a-w c:\windows\System32\bkll.dll
2008-10-29 16:16 1,212,416 ----a-w c:\windows\System32\ckll.dll
2008-10-29 16:16 --------- d-----w c:\program files\Real_SC
2008-10-28 07:47 --------- d-----w c:\users\vip\AppData\Roaming\MakeUpPilot
2008-10-28 07:44 --------- d-----w c:\users\vip\AppData\Roaming\Micro-Sys
2008-10-28 07:43 --------- d-----w c:\program files\Micro-Sys Software
2008-10-27 22:18 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-10-27 22:18 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-10-27 22:16 288,768 ----a-w c:\windows\system32\drivers\srv.sys
2008-10-27 22:15 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-10-27 22:15 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-10-27 22:12 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-24 18:41 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-24 18:41 --------- d-----w c:\program files\Ulead Systems
2008-10-22 16:03 --------- d-----w c:\users\vip\AppData\Roaming\FairStars Audio Converter
2008-10-22 03:52 --------- d-----w c:\program files\Common Files\Adobe
2008-10-22 02:18 --------- d-----w c:\users\vip\AppData\Roaming\DMCache
2008-10-21 01:48 --------- d-----w c:\program files\ionCube PHP Encoder 6.5 Evaluation
2008-10-20 03:23 --------- d-----w c:\programdata\FLEXnet
2008-10-18 09:49 --------- d-----w c:\programdata\Admin Inter 1 Mags
2008-10-18 09:49 --------- d-----w c:\programdata\Active Slow Hole
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 11:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 10:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-15 11:03 --------- d-----w c:\programdata\MGS
2008-10-14 20:50 --------- d-----w c:\programdata\Winferno
2008-10-10 17:42 --------- d-----w c:\program files\Common Files\Cisco Systems
2008-09-30 13:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-22 18:09 --------- d---a-w c:\programdata\TEMP
2008-09-22 15:44 --------- d-----w c:\programdata\PC Tools
2008-09-21 01:32 --------- d-----w c:\program files\Messenger Plus! Live
2008-09-20 08:07 --------- d-----w c:\users\vip\AppData\Roaming\GlobalSCAPE
2008-09-20 08:07 --------- d-----w c:\programdata\GlobalSCAPE
2008-09-20 08:06 --------- d-----w c:\program files\GlobalSCAPE
2008-09-19 05:31 --------- d-----w c:\program files\Windows Live
2008-09-18 04:45 --------- d-----w c:\users\vip\AppData\Roaming\uTorrent
2008-09-18 02:17 --------- d-----w c:\program files\Microsoft
2008-09-18 02:12 --------- d-----w c:\program files\Common Files\Windows Live
2008-09-16 00:14 3,596,288 ----a-w c:\windows\System32\qt-dx331.dll
2008-09-16 00:12 81,920 ----a-w c:\windows\System32\dpl100.dll
2008-09-16 00:11 683,520 ----a-w c:\windows\System32\divx.dll
2008-09-10 23:27 303,616 ----a-w c:\windows\System32\wmpeffects.dll
2008-09-09 18:31 81,920 ----a-w c:\users\vip\AppData\Roaming\ezpinst.exe
2008-09-09 18:31 47,360 ----a-w c:\users\vip\AppData\Roaming\pcouffin.sys
2008-09-03 14:06 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-09-03 14:06 563,912 ----a-w c:\windows\System32\wuapi.dll
2008-09-03 14:06 36,552 ----a-w c:\windows\System32\wups.dll
2008-08-30 10:37 835,584 ----a-w c:\windows\System32\maae.dll
2008-08-30 10:37 729,088 ----a-w c:\windows\System32\maad.dll
2008-08-30 10:37 450,560 ----a-w c:\windows\System32\maai.dll
2008-08-30 10:37 335,872 ----a-w c:\windows\System32\maac.dll
2008-08-30 10:37 315,392 ----a-w c:\windows\System32\maab.dll
2008-08-30 10:37 311,296 ----a-w c:\windows\System32\maaf.dll
2008-08-30 10:37 1,843,200 ----a-w c:\windows\System32\maaa.dll
2008-08-30 10:37 1,040,384 ----a-w c:\windows\System32\maah.dll
2008-08-26 13:24 61,440 ----a-w c:\windows\System32\winipsec.dll
2008-08-26 13:24 361,984 ----a-w c:\windows\System32\IPSECSVC.DLL
2008-08-26 13:24 28,672 ----a-w c:\windows\System32\FwRemoteSvr.dll
2008-08-26 13:24 272,896 ----a-w c:\windows\System32\polstore.dll
2008-08-26 13:23 2,048 ----a-w c:\windows\System32\tzres.dll
2008-05-19 03:09 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-05-19 03:09 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
2008-05-19 03:09 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\s\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
11/16/2008 10:23 PM 200192 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ulead AutoDetector"="c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [07/28/2005 08:32 AM 94208]
"Ulead Calendar Checker"="c:\program files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [08/22/2005 09:10 AM 69632]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [10/30/2008 02:46 AM 185872]
"Gamevance"="c:\program files\Gamevance\gamevance32.exe" [11/16/2008 02:25 AM 91648]
"SoundMan"="SOUNDMAN.EXE" [03/09/2007 04:28 PM 598016 c:\windows\SOUNDMAN.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Funk about]
c:\programdata\VC SECT SECT.9voz3 [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 01/19/2008 10:33 AM 125952 c:\windows\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 10/30/2008 02:46 AM 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1241338123-2144440360-421495642-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"= c:\program files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{8D957161-F85C-4765-BFC7-6DBDDBF9EF6A}c:\\program files\\windows live\\messenger\\msnmsgr.exe"= UDP:c:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"TCP Query User{613BCFAA-5D0A-422B-BCF4-3849E0B09620}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\english\setup.exe:Kaspersky Internet Security 2009 Setup
"UDP Query User{444E8B45-28DA-4B7D-B86D-3B6BD6B686D5}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\english\setup.exe:Kaspersky Internet Security 2009 Setup
"{084D59BE-1DF1-43EF-9A35-732DC548F243}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{14DFB042-F864-4BD4-94E6-21292E4AF95A}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{4130E12B-84B0-4DF6-AD41-0CF05FDA41F2}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{70378ED7-A9BB-4142-A561-CFE7E3FB1917}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{A4628940-D93E-4A76-A331-D02A8D1B18CB}"= d:\powerdirector\PDR.EXE:CyberLink PowerDirector
"TCP Query User{F2CD77F6-B269-4F24-81D5-F36B4EAE91E6}c:\\program files\\www.cproxy.com\\cproxy.exe"= Disabled:UDP:c:\program files\
www.cproxy.com\cproxy.exe:CPROXY.com
"UDP Query User{73388807-66D3-4416-9ED1-30AE5CF7FE58}c:\\program files\\www.cproxy.com\\cproxy.exe"= Disabled:TCP:c:\program files\
www.cproxy.com\cproxy.exe:CPROXY.com
"TCP Query User{8287716D-D491-4A1F-9DD7-E4DBA5EA5BC6}c:\\program files\\king fm\\king fm.exe"= UDP:c:\program files\king fm\king fm.exe:KinG FM - Listen to all your favorite radio stations
"UDP Query User{F53E0AEC-6EF5-47AD-8B90-E70905F2A2CC}c:\\program files\\king fm\\king fm.exe"= TCP:c:\program files\king fm\king fm.exe:KinG FM - Listen to all your favorite radio stations
"TCP Query User{B82882EA-D000-449A-A952-0BBCA5FBB88C}c:\\program files\\leapftp\\leapftp.exe"= UDP:c:\program files\leapftp\leapftp.exe:File Transfer Protocol (FTP) Client
"UDP Query User{C76EECB0-182E-4EFF-AFE7-D8788355DA7B}c:\\program files\\leapftp\\leapftp.exe"= TCP:c:\program files\leapftp\leapftp.exe:File Transfer Protocol (FTP) Client
"{CA8CC012-3BC8-4767-8908-DD4A01B6F4BC}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{2E877902-C060-4B46-9429-B484769DEF49}c:\\program files\\king fm v4.0\\king fm v4.0.exe"= UDP:c:\program files\king fm v4.0\king fm v4.0.exe:KinG FM v4.00
"UDP Query User{CECAE7A5-C486-46B1-90B8-FEED9689013D}c:\\program files\\king fm v4.0\\king fm v4.0.exe"= TCP:c:\program files\king fm v4.0\king fm v4.0.exe:KinG FM v4.00
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"= c:\program files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2006-11-02 987648]
R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2006-11-02 251904]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2008-05-02 240128]
S3 tapavpn;Steganos Anonym VPN Adapter;c:\windows\system32\DRIVERS\tapavpn.sys [2007-10-19 24320]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45455bd3-42e9-11dd-ac9c-0016ec37f937}]
\shell\AutoRun\command - F:\jdhc2x2.com
\shell\explore\Command - F:\jdhc2x2.com
\shell\open\Command - F:\jdhc2x2.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45455bd6-42e9-11dd-ac9c-0016ec37f937}]
\shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9e40f42-1ff9-11dd-9394-0016ec37f937}]
\shell\AutoRun\command - F:\n6t1h.cmd
\shell\explore\Command - F:\n6t1h.cmd
\shell\open\Command - F:\n6t1h.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cdab34e3-5969-11dd-aee9-0016ec37f937}]
\shell\AutoRun\command - G:\jdhc2x2.com
\shell\explore\Command - G:\jdhc2x2.com
\shell\open\Command - G:\jdhc2x2.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3792332-872d-11dd-b841-0016ec37f937}]
\shell\AutoRun\command - F:\9yqusig.bat
\shell\explore\Command - F:\9yqusig.bat
\shell\open\Command - F:\9yqusig.bat
*Newly Created Service* - PROCEXP90
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
.
s of the 'Scheduled Tasks' folder
2008-11-18 c:\windows\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart\ErrorSmart.exe []
2008-11-18 c:\windows\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart []
2008-11-18 c:\windows\Tasks\PCConfidential.job
- c:\program files\Winferno\PC Confidential\PCConfidential.exe []
2008-11-04 c:\windows\Tasks\rpc.job
- c:\program files\Winferno\RegistryPowerCleaner\RegPowerClean.exe []
2008-11-18 c:\windows\Tasks\User_Feed_Synchronization-{B5610CE3-C6B8-4778-9A97-6D861E6B0719}.job
- c:\windows\system32\msfeedssync.exe [01/19/2008 10:33 AM]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*
uInternet Settings,ProxyOverride = *.local
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\windows\web\related.htm
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\windows\web\related.htm -
O16 -: {051D0E35-F4E3-4C8D-B411-AB0875F4C683} - hxxp://install.anark.com/client/version4/windows-ie/en/AMClient.cab
c:\windows\Downloaded Program Files\InstallClient.inf
c:\windows\System32\msvcrt.dll - c:\windows\System32\mfc42.dll
c:\windows\System32\olepro32.dll
c:\windows\Downloaded Program Files\imcv1.dll
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413}
hxxp://67.198.192.146/talk.cab
c:\windows\Downloaded Program Files\talk.inf
c:\windows\Downloaded Program Files\ReadUid.ocx - O16 -: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA}
hxxp://67.198.192.146/ReadUid.CAB
c:\windows\Downloaded Program Files\ReadUid.INF
O16 -: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://riverbelle.gameassists.co.uk/riverbelle/FlashAX2.cab
c:\windows\Downloaded Program Files\flashax2.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-18 16:27:41
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Gamevance = c:\program files\Gamevance\gamevance32.exe?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 11/18/2008 16:30:07
ComboFix-quarantined-files.txt 2008-11-18 13:30:03
Pre-Run: 20,932,902,912 bytes free
Post-Run: 20,734,300,160 bytes free
248 --- E O F --- 2008-11-17 02:19:32
