تقرير الـ ComboFix
ComboFix 08-11-26.01 - Administrator 11/25/2008 14:49:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.707 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system\oeminfo.ini
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\kakle.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ISODRIVE
-------\Service_ISODrive
((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 12:45 3,408,797,696 ----a-w c:\program files\First Hard Disk.vhd
2008-11-25 12:45 12,668 ----a-w c:\program files\First.vmc
2008-11-25 12:45 107,796,504 ----a-w c:\program files\First.vsv
2008-11-25 08:23 --------- d-----w c:\program files\a-squared Free
2008-11-25 08:14 --------- d-----w c:\program files\DrWeb
2008-11-25 01:25 --------- d-----w c:\program files\SWiSHmax
2008-11-23 08:02 --------- d-----w c:\documents and settings\Administrator\Application Data\Resource Tuner
2008-11-22 23:29 --------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2008-11-22 23:26 --------- d-----w c:\program files\Mohamed
2008-11-22 23:24 --------- d-----w c:\program files\stardock
2008-11-22 23:15 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-22 22:29 8,882 ----a-w c:\program files\Third.vmc
2008-11-22 22:29 197,332,880 ----a-w c:\program files\Second.vsv
2008-11-22 22:29 12,658 ----a-w c:\program files\Second.vmc
2008-11-22 22:28 --------- d-----w c:\program files\Microsoft Virtual PC
2008-11-22 22:21 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-22 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-22 10:47 --------- d-----w c:\program files\Common Files\Doctor Web
2008-11-22 10:47 --------- d-----w c:\documents and settings\All Users\Application Data\Doctor Web
2008-11-22 10:03 2,059,999,744 ----a-w c:\program files\Second Hard Disk.vhd
2008-11-22 09:26 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-22 08:47 --------- d-----w c:\program files\ma-config.com
2008-11-22 08:47 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2008-11-22 06:12 --------- d-----w c:\documents and settings\Administrator\Application Data\PE Explorer
2008-11-22 04:43 --------- d-----w c:\program files\Internet Download Manager
2008-11-21 12:31 --------- d-----w c:\documents and settings\Administrator\Application Data\uTorrent
2008-11-21 12:11 --------- d-----w c:\program files\Bit Che
2008-11-21 12:11 --------- d-----w c:\documents and settings\Administrator\Application Data\Convivea
2008-11-21 11:58 --------- d-----w c:\documents and settings\Administrator\Application Data\IndigoRose
2008-11-21 10:14 --------- d-----w c:\program files\No-IP
2008-11-21 02:01 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2008-11-21 01:04 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-21 01:00 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-21 00:25 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-21 00:21 --------- d-----w c:\program files\Windows Live
2008-11-21 00:14 --------- d-----w c:\program files\Microsoft
2008-11-21 00:12 --------- d-----w c:\program files\Common Files\Windows Live
2008-11-20 23:46 --------- d-----w c:\documents and settings\Administrator\Application Data\Media Player Classic
2008-11-20 23:20 --------- d-----w c:\documents and settings\Administrator\Application Data\Thinstall
2008-11-20 23:20 --------- d-----w c:\documents and settings\Administrator\Application Data\Avant Profiles
2008-11-20 23:14 93,696 ----a-w c:\program files\Third Hard Disk.vhd
2008-11-20 23:08 --------- d-----w c:\program files\Alwil Software
2008-11-20 23:03 --------- d-----w c:\program files\Circle Developement
2008-11-20 22:57 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-20 22:53 --------- d-----w c:\program files\Avira
2008-11-20 22:53 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-11-20 13:18 --------- d-----w c:\program files\Unlocker
2008-11-20 13:18 --------- d-----w c:\program files\IcoFX 1.6
2008-11-20 13:18 --------- d-----w c:\documents and settings\Administrator\Application Data\IcoFX
2008-11-20 13:16 --------- d-----w c:\program files\KanastaCorp
2008-11-20 13:05 --------- d-----w c:\program files\TechniSat DVB
2008-11-20 13:05 --------- d-----w c:\program files\DVBViewerTE
2008-11-20 13:05 --------- d-----w c:\program files\BreakPoint Software
2008-11-20 13:04 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-20 13:04 --------- d-----w c:\program files\Common Files\Sonic Shared
2008-11-20 13:03 --------- d-----w c:\program files\ArabicSounde
2008-11-20 13:01 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-20 12:56 --------- d-----w c:\documents and settings\Administrator\Application Data\LimeWire
2008-11-20 12:55 --------- d-----w c:\program files\CyberLink
2008-11-20 12:55 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-20 12:50 720,896 ----a-w c:\windows\iun6002.exe
2008-11-20 12:50 --------- d-----w c:\program files\zyzoom_filters
2008-11-20 12:50 --------- d-----w c:\program files\USB Disk Security
2008-11-20 12:50 --------- d-----w c:\program files\JetAudio
2008-11-20 12:49 --------- d-----w c:\program files\NoVirusThanks.org
2008-11-20 12:47 --------- d-----w c:\program files\Common Files\xing shared
2008-11-20 12:47 --------- d-----w c:\program files\Common Files\Real
2008-11-20 12:46 --------- d-----w c:\program files\Real
2008-11-20 12:46 --------- d-----w c:\documents and settings\Administrator\Application Data\Paltalk
2008-11-20 12:45 --------- d-----w c:\program files\BitComet
2008-11-20 12:44 --------- d-----w c:\program files\Ozone
2008-11-20 12:42 --------- d-----w c:\program files\VDOWNLOADER
2008-11-20 12:42 --------- d-----w c:\program files\Java
2008-11-20 12:40 --------- d-----w c:\program files\Paltalk Messenger
2008-11-20 12:38 --------- d-----w c:\program files\LimeWire
2008-11-20 12:38 --------- d-----w c:\program files\Google
2008-11-20 12:37 --------- d-----w c:\program files\Craagle v3.0
2008-11-20 12:34 --------- d-----w c:\program files\Common Files\Adobe
2008-11-20 06:00 --------- d-----w c:\program files\AutoIt3
2008-11-20 05:59 --------- d-----w c:\program files\Resource Tuner
2008-11-20 05:58 --------- d-----w c:\program files\PE Explorer
2008-11-20 05:58 --------- d-----w c:\program files\AutoPlay Media Studio 7.0
2008-11-20 05:57 --------- d-----w c:\documents and settings\All Users\Application Data\IndigoRose
2008-11-20 05:57 --------- d-----w c:\documents and settings\Administrator\Application Data\Downloaded Installations
2008-11-20 05:56 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-11-20 05:56 172,032 ----a-w c:\windows\Setup1.exe
2008-11-20 05:56 --------- d-----w c:\program files\Golden Al-Wafi Translator
2008-11-20 05:55 --------- d-----w c:\program files\Your Uninstaller 2008
2008-11-20 05:54 --------- d-----w c:\program files\SoftwareDoctor
2008-11-20 05:54 --------- d-----w c:\documents and settings\Administrator\Application Data\URSoft
2008-11-20 05:53 --------- d-----w c:\program files\UltraISO
2008-11-20 05:53 --------- d-----w c:\program files\Common Files\EZB Systems
2008-11-20 05:53 --------- d-----w c:\program files\Arabic Reader v1.3
2008-11-20 05:52 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-20 05:51 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-20 05:51 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-20 05:51 --------- d-----w c:\documents and settings\Administrator\Application Data\TuneUp Software
2008-11-20 05:49 --------- d-----w c:\program files\CCleaner
2008-11-20 05:48 --------- d-----w c:\program files\Ashampoo
2008-11-20 05:47 --------- d-----w c:\documents and settings\Administrator\Application Data\Ashampoo
.
------- Sigcheck -------
04/13/2008 09:20 PM 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\SoftwareDistribution\Download\59fc8f12b80caa991163249076d0bcca\tcpip.sys
10/09/2007 02:58 AM 359040 1745b00fc1141404b28f4b94f69a8871 c:\windows\system32\drivers\tcpip.sys
04/14/2008 02:12 AM 111104 ed7262e52c31cf1625b65039102bc16c c:\windows\SoftwareDistribution\Download\59fc8f12b80caa991163249076d0bcca\wuauclt.exe
08/03/2004 11:56 PM 165376 af20af21d33bc82fd278e755fd4551a7 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [10/18/2007 11:34 AM 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuNotification"="c:\program files\ShadowStor\ShadowUser\suatshut.exe" [01/12/2005 11:49 PM 40960]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [05/02/2008 06:15 AM 15872]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/20/2008 02:47 PM 185872]
"Resume copy"="copyfstq.exe" [03/24/2002 01:54 PM 46080 c:\windows\COPYFSTQ.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/03/2004 11:56 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sunotify]
01/12/2005 11:49 PM 90112 c:\windows\system32\sunotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=vsmvhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVP"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\share max\\1\\sharemax.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\share max\\النسخه 5.7 ShareMax\\ShareMax5.7\\sharemax.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16840:TCP"= 16840:TCP:BitComet 16840 TCP
"16840:UDP"= 16840:UDP:BitComet 16840 UDP
R0 DwProt;DrWeb Protection;c:\windows\system32\drivers\dwprot.sys [2008-11-22 96112]
R0 Shadow;Shadow;c:\windows\system32\drivers\Shadow.sys [2005-01-25 114624]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-21 110160]
R1 Cinemsup;Cinemsup;c:\windows\system32\drivers\Cinemsup.sys [2002-07-19 6656]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-21 20560]
R2 DrWebEngine;Dr.Web ® Scanning Engine (DrWebEngine);"c:\program files\Common Files\Doctor Web\Scanning Engine\dwengine.exe" [2008-10-17 869688]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\DRIVERS\SkyNET.SYS [2008-10-28 349184]
S2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe -k netsvcs [2004-08-03 14336]
S3 AVPsys;AVPsys;\??\c:\windows\system32\drivers\tdi.sys [2004-08-03 18560]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-04-04 24344]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-09-02 191656]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-11-20 355584]
S4 AntiVirMailService;Avira AntiVir Premium MailGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-11-21 164097]
S4 antivirwebservice;Avira AntiVir Premium WebGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-11-21 258305]
S4 AVEService;Avira AntiVir Premium MailGuard helper service;"c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-11-21 41217]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e15df8c-b6c7-11dd-94a2-001a4d60bad5}]
\Shell\AutoRun\command - H:\ph.com
\Shell\explore\Command - H:\ph.com
\Shell\open\Command - H:\ph.com
.
s of the 'Scheduled Tasks' folder
2008-11-25 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [06/20/2008 09:09 AM]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\867hlbd9.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-25 14:53:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Avira\AntiVir PersonalEdition Premium\sched.exe
c:\windows\system32\netdde.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Java\jre6\bin\jqs.exe
.
**************************************************************************
.
Completion time: 11/25/2008 14:56:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-25 12:56:47
Pre-Run: 22,777,507,840 bytes free
Post-Run: 23,088,205,824 bytes free
258
