عبدالحق سعد
زيزوومي نشيط
غير متصل
تقرير الفحص
===========
ezo 11/28/2008 3:57:01.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.233 [GMT 2:00]
Running from: c:\documents and settings\zezo\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\12.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-28 00:44 98,440 ----a-w c:\windows\system32\drivers\avgldx86.sys
2008-11-28 00:44 90,632 ----a-w c:\windows\system32\drivers\avgtdix.sys
2008-11-28 00:44 12,936 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2008-11-28 00:44 10,520 ----a-w c:\windows\system32\avgrsstx.dll
2008-11-28 00:42 50,968 ----a-w c:\windows\system32\avgfwdx.dll
2008-11-28 00:42 29,208 ----a-w c:\windows\system32\drivers\avgfwdx.sys
2008-11-28 00:42 --------- d-----w c:\program files\AVG
2008-11-27 23:16 --------- d-----w c:\documents and settings\zezo\Application Data\PCToolsSpamMonitorPlus
2008-11-27 23:16 --------- d-----w c:\documents and settings\zezo\Application Data\PCToolsFirewallPlus
2008-11-27 23:13 --------- d-----w c:\program files\PC Tools Internet Security
2008-11-27 23:13 --------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2008-11-27 23:13 --------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2008-11-27 22:54 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2008-11-27 03:02 354,560 ----a-w c:\windows\system32\TuneUpDefragService.exe
2008-11-26 23:05 --------- d-----w c:\program files\Internet Download Manager
2008-11-26 23:05 --------- d-----w c:\documents and settings\zezo\Application Data\IDM
2008-11-26 22:11 --------- d-----w c:\documents and settings\zezo\Application Data\Talkback
2008-11-26 21:29 --------- d-----w c:\documents and settings\All Users\Application Data\SweetIM
2008-11-26 21:18 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-26 21:16 --------- d-----w c:\program files\Yahoo!
2008-11-26 21:01 --------- d-sh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-26 21:00 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-26 09:07 --------- d-----w c:\program files\Alwil Software
2008-11-26 08:26 --------- d-----w c:\program files\Free Download Manager
2008-11-26 04:46 249,592 ----a-w c:\windows\system32\cssdll32.dll
2008-11-26 04:34 --------- d-----w c:\documents and settings\zezo\Application Data\Comodo
2008-11-26 04:34 --------- d-----w c:\documents and settings\All Users\Application Data\comodo
2008-11-26 03:37 --------- d-----w c:\documents and settings\zezo\Application Data\DMCache
2008-11-26 01:50 --------- d-----w c:\program files\PC Check-up
2008-11-26 00:35 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-26 00:35 --------- d-----w c:\documents and settings\zezo\Application Data\TuneUp Software
2008-11-26 00:35 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-26 00:34 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-26 00:29 --------- d-----w c:\documents and settings\zezo\Application Data\ESET
2008-11-26 00:27 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2008-11-26 00:26 --------- d-----w c:\program files\Unlocker
2008-11-26 00:20 --------- d-----w c:\program files\Windows Doctor
2008-11-26 00:07 --------- d-----w c:\program files\LClock
2008-11-26 00:02 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-10 12:34 55,304 ----a-w c:\windows\system32\drivers\epfwtdi.sys
2008-11-10 12:34 32,264 ----a-w c:\windows\system32\drivers\epfwndis.sys
2008-11-10 12:34 129,032 ----a-w c:\windows\system32\drivers\epfw.sys
2008-11-10 12:34 104,456 ----a-w c:\windows\system32\drivers\ehdrv.sys
2008-11-10 12:33 110,600 ----a-w c:\windows\system32\drivers\eamon.sys
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 12:07 23,576 ----a-w c:\windows\system32\wuauserv.dll
2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys
2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys
2008-09-05 21:30 241,704 ------w c:\windows\system32\dllcache\wgaLogon.dll
2008-09-05 21:29 917,032 ------w c:\windows\system32\dllcache\WgaTray.exe
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-09-04 17:15 1,106,944 ------w c:\windows\system32\dllcache\msxml3.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [05/09/2008 08:52 AM 40448]
"LClock"="c:\program files\LClock\LClock.exe" [09/19/2004 08:27 PM 65536]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [11/27/2008 01:06 AM 2594224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [05/02/2008 06:15 AM 15872]
"PC-Checkup"="c:\program files\PC Check-up\PCCheckUp.exe" [03/18/2008 12:49 AM 4047360]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [11/18/2008 07:39 PM 81000]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [11/28/2008 02:44 AM 1235736]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [05/09/2008 08:52 AM 40448]
"LClock"="c:\program files\LClock\LClock.exe" [09/19/2004 08:27 PM 65536]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [08/22/2008 03:06 AM 128512 c:\windows\system32\advpack.dll]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-11-28 12936]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-26 110160]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-28 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-28 90632]
R1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2008-11-10 104456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-26 20560]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-28 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-28 231704]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2008-11-28 1212184]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe -k netsvcs [2008-04-14 14336]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2008-11-28 29208]
S2 MPKrnl;MPKrnl; []
S3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2008-11-28 29208]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-11-27 354560]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-11-26 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [04/16/2008 09:59 AM]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\zezo\Application Data\Mozilla\Firefox\Profiles\ejtoltqf.default\
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-28 03:58:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1408)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\avgrsstx.dll
c:\windows\system32\WgaLogon.dll
c:\windows\system32\COMRes.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(1516)
c:\windows\system32\avgrsstx.dll
c:\windows\system32\SETUPAPI.dll
.
Completion time: 11/28/2008 3:59:19
ComboFix-quarantined-files.txt 2008-11-28 01:59:18
Pre-Run: 4,092,899,328 bytes free
Post-Run: 4,086,870,016 bytes free
169 --- E O F --- 2008-11-26 05:55:18
======================================================================================
تقرير الهيجات
==========
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:05:39 ص, on 28/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\PC Check-up\PCCheckUp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
E:\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PC Check-up\PCCheckUp.exe" -mini
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\WINDOWS\system32\shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1227677242140
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
--
End of file - 5399 bytes
