ComboFix 08-11-26.03 - جرب 11/26/2008 13:30:01.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1078 [GMT 3:00]
Running from: c:\documents and settings\جرب\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\Antivirus 2009
c:\program files\Antivirus 2009\av2009.exe
c:\windows\system32\_000003_.tmp.dll
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000011_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\anabeyur.ini
c:\windows\system32\aputevip.ini
c:\windows\system32\atizilov.ini
c:\windows\system32\avajedey.ini
c:\windows\system32\awitepel.ini
c:\windows\system32\bahegope.dll
c:\windows\system32\bebapufe.dll
c:\windows\system32\bevefime.dll
c:\windows\system32\bunosuja.dll
c:\windows\system32\davotudo.dll
c:\windows\system32\dezuzara.dll
c:\windows\system32\dogowuvu.dll
c:\windows\system32\efipitaj.ini
c:\windows\system32\emamigas.ini
c:\windows\system32\erirejos.ini
c:\windows\system32\esuzoron.ini
c:\windows\system32\fohiyizo.dll
c:\windows\system32\fohomugu.dll
c:\windows\system32\gitadodi.dll
c:\windows\system32\gojowahu.dll
c:\windows\system32\habemoya.dll
c:\windows\system32\hehewora.dll
c:\windows\system32\hufemute.dll
c:\windows\system32\huwakalu.dll
c:\windows\system32\ibadupav.ini
c:\windows\system32\igeyimot.ini
c:\windows\system32\ihihepuv.ini
c:\windows\system32\ihuwohak.ini
c:\windows\system32\iyotuguy.ini
c:\windows\system32\izohanek.ini
c:\windows\system32\japidahu.dll
c:\windows\system32\jatipife.dll
c:\windows\system32\kahowuhi.dll
c:\windows\system32\kelarozo.dll
c:\windows\system32\lagoguze.dll
c:\windows\system32\leheliyo.dll.vir
c:\windows\system32\luvigaki.dll
c:\windows\system32\mevozeha.dll
c:\windows\system32\mohemabu.dll
c:\windows\system32\nilimuvo.dll
c:\windows\system32\norozuse.dll
c:\windows\system32\nujugeze.dll
c:\windows\system32\odimoray.ini
c:\windows\system32\olefufoz.ini
c:\windows\system32\oruwuhuz.ini
c:\windows\system32\ovumilin.ini
c:\windows\system32\oyegegey.ini
c:\windows\system32\oziyihof.ini
c:\windows\system32\pivetupa.dll
c:\windows\system32\pofokago.dll
c:\windows\system32\ratifuya.dll
c:\windows\system32\ribenepo.dll
c:\windows\system32\rigebevu.dll
c:\windows\system32\ruginefo.dll
c:\windows\system32\ruyebana.dll
c:\windows\system32\ruyopaku.dll
c:\windows\system32\sakudozu.dll
c:\windows\system32\seyohehu.dll
c:\windows\system32\sijorera.dll
c:\windows\system32\subalavi.dll
c:\windows\system32\tituzeki.dll
c:\windows\system32\tomiyegi.dll
c:\windows\system32\tuvibibu.dll
c:\windows\system32\ubibivut.ini
c:\windows\system32\ububimem.ini
c:\windows\system32\ugumohof.ini
c:\windows\system32\uhehoyes.ini
c:\windows\system32\ukapoyur.ini
c:\windows\system32\utoyulew.ini
c:\windows\system32\uzodukas.ini
c:\windows\system32\vapudabi.dll
c:\windows\system32\vatimete.dll
c:\windows\system32\vupehihi.dll
c:\windows\system32\weyonoru.dll
c:\windows\system32\wolugeri.dll
c:\windows\system32\yajezadi.dll
c:\windows\system32\yaromido.dll
c:\windows\system32\yedejava.dll
c:\windows\system32\yimogate.dll.vir
c:\windows\system32\zahuzihi.dll
----- BITS: Possible infected sites -----
hxxp://77.74.48.105
.
((((((((((((((((((((((((( Files Created from 2008-10-26 to 2008-11-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-30 16:10 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-26 10:40 38,180,384 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-26 10:40 1,072,160 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-26 10:40 --------- d-----w c:\documents and settings\جرب\Application Data\Orbit
2008-11-26 10:36 520,676 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-26 10:36 106,712 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-26 09:02 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-11-25 17:16 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-25 17:13 --------- d-----w c:\program files\Microsoft Games
2008-11-25 12:49 --------- d-----w c:\documents and settings\جرب\Application Data\Products
2008-11-21 20:38 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Messenger Plus!
2008-11-20 18:38 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-20 17:19 --------- d-----w c:\program files\Yahoo!
2008-11-20 17:15 --------- d-----w c:\program files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-11-20 17:14 --------- d-----w c:\program files\IEPro
2008-11-20 17:13 --------- d-----w c:\program files\Common Files\Apple
2008-11-18 16:07 --------- d-----w c:\documents and settings\جرب\Application Data\Screenshot Sender
2008-11-18 10:25 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Grisoft
2008-11-18 10:25 --------- d-----w c:\documents and settings\جرب\Application Data\Grisoft
2008-11-16 21:32 --------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2008-11-14 13:32 --------- d-----w c:\program files\Digital Physiognomy
2008-11-13 13:22 --------- d-----w c:\documents and settings\جرب\Application Data\Apple Computer
2008-11-13 13:08 --------- d-----w c:\program files\iTunes
2008-11-13 13:08 --------- d-----w c:\program files\iPod
2008-11-13 13:08 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer
2008-11-13 13:08 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-13 13:07 --------- d-----w c:\program files\Bonjour
2008-11-13 13:05 --------- d-----w c:\program files\QuickTime
2008-11-13 13:01 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2008-11-13 12:11 --------- d-----w c:\program files\Google
2008-11-11 17:39 --------- d-----w c:\program files\Paltalk Messenger
2008-11-11 17:39 --------- d-----w c:\documents and settings\جرب\Application Data\Paltalk
2008-11-09 23:42 --------- d-----w c:\program files\Ares
2008-11-08 07:56 0 ----a-w C:\osy3.sys
2008-11-06 14:17 --------- d-----w c:\program files\Orbitdownloader
2008-11-05 06:12 --------- d-----w c:\program files\Khayal IE
2008-10-28 04:07 --------- d-----w c:\program files\Total Video Converter
2008-10-28 03:30 --------- d-----w c:\documents and settings\جرب\Application Data\Hide IP NG
2008-10-27 02:39 --------- d-----w c:\program files\Mininova
2008-10-27 02:39 --------- d-----w c:\program files\Conduit
2008-10-25 04:43 --------- d-----w c:\program files\VirtualDJ
2008-10-25 03:59 --------- d-----w c:\program files\WinPcap
2008-10-22 04:00 --------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\MumboJumbo
2008-10-02 23:42 --------- d-----w c:\program files\Super Internet TV
2008-10-02 23:41 --------- d-----w c:\documents and settings\xp\Application Data\Paltalk
2008-10-02 23:39 --------- d-----w c:\program files\BitSpirit
2008-09-30 22:50 --------- d-----w c:\documents and settings\جرب\Application Data\skypePM
2008-09-11 01:52 44,544 ------w c:\windows\AWuninstall.exe
2008-08-29 00:11 155,995 ----a-w c:\windows\java\Packages\D3XZ13VL.ZIP
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
"ares"="c:\program files\Ares\Ares.exe" [02/26/2007 03:40 AM 969728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/02/2008 02:18 PM 185872]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [09/06/2008 03:09 PM 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [10/01/2008 06:57 PM 289576]
"!AVG Anti-Spyware"="c:\zyzoom_avg_anti-spyware_plus_7.5.1.43_portable\avgas.exe" [10/03/2007 04:00 AM 6731312]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [12/18/2007 12:43 AM 227856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [03/25/2008 05:32 AM 218496]
c:\documents and settings\All Users.WINDOWS\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-18 113664]
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2008-05-10 1690824]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2008-08-29 11704832]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
07/22/2005 10:46 PM 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^Orbit.lnk]
path=c:\documents and settings\All Users.WINDOWS\قائمة ابدأ\البرامج\بدء التشغيل\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=c:\documents and settings\All Users.WINDOWS\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
--a------ 02/26/2007 03:40 AM 969728 c:\program files\Ares\Ares.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares destiny]
--a------ 08/27/2007 05:02 PM 2973184 c:\program files\Ares Destiny\Ares.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 12/18/2007 12:43 AM 227856 c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/04/2004 03:56 AM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 07/11/2007 04:09 PM 20480 c:\windows\FixCamera.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2std]
--a------ 09/28/2007 04:32 PM 344064 c:\windows\vsnp2std.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 11/01/2008 07:36 AM 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp2std]
--a------ 05/12/2007 11:19 AM 270336 c:\windows\tsnp2std.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"d:\\SLEP\\اللعبه\\empires2.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Ares Destiny\\Ares.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\SLEP\\اللعبه\\age2_x1.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\ZCfgSvc.exe"=
"c:\\Program Files\\Orbitdownloader\\Grab.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"=
"c:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"=
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2008-09-18 12212864]
.
s of the 'Scheduled Tasks' folder
2008-11-25 c:\windows\Tasks\At241.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At242.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At243.job
- c:\windows\system32\q283tTH0.exe []
2008-11-26 c:\windows\Tasks\At244.job
- c:\windows\system32\q283tTH0.exe []
2008-11-26 c:\windows\Tasks\At245.job
- c:\windows\system32\q283tTH0.exe []
2008-11-24 c:\windows\Tasks\At246.job
- c:\windows\system32\q283tTH0.exe []
2008-11-24 c:\windows\Tasks\At247.job
- c:\windows\system32\q283tTH0.exe []
2008-11-24 c:\windows\Tasks\At248.job
- c:\windows\system32\q283tTH0.exe []
2008-11-24 c:\windows\Tasks\At249.job
- c:\windows\system32\q283tTH0.exe []
2008-11-24 c:\windows\Tasks\At250.job
- c:\windows\system32\q283tTH0.exe []
2008-11-26 c:\windows\Tasks\At251.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At252.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At253.job
- c:\windows\system32\q283tTH0.exe []
2008-11-26 c:\windows\Tasks\At254.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At255.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At256.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At257.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At258.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At259.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At260.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At261.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At262.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At263.job
- c:\windows\system32\q283tTH0.exe []
2008-11-25 c:\windows\Tasks\At264.job
- c:\windows\system32\q283tTH0.exe []
.
- - - - ORPHANS REMOVED - - - -
BHO-{eb33f618-3a51-4eb2-b26d-384b2135267d} - c:\windows\system32\vatimete.dll
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\جرب\Application Data\Mozilla\Firefox\Profiles\esa8fu53.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-26 13:39:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1344)
c:\windows\system32\klogon.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Orbitdownloader\orbitnet.exe
c:\program files\iPod\bin\iPodService.exe
c:\documents and settings\c:\windows\system32\notepad.exe
c:\windows\system32\wbem\wmiadap.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 11/26/2008 13:44:57 - machine was rebooted [جرب]
ComboFix-quarantined-files.txt 2008-11-26 10:44:50
Pre-Run: 6,152,798,208 bytes free
Post-Run: 6,717,304,832 bytes free
343 --- E O F --- 2008-11-09 23:57:40
ولعبت فيني :no: هالصفحة ما افتح شي غير ناقزه في وجهي:bleh:
