التقرير
التقرير الاول من ComboFix
ComboFix 08-11-27.07 - alamin center 11/28/2008 9:28:17.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.644 [GMT -8:00]
Running from: c:\documents and settings\alamin center\Desktop\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-28 17:25 32 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-28 17:25 32 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-28 17:25 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-28 17:25 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-27 15:20 720,896 ----a-w c:\windows\iun6002.exe
2008-11-27 09:13 --------- d-----w c:\program files\Chessmaster 9000
2008-11-25 13:52 112,144 ----a-w c:\windows\system32\drivers\kl1.sys
2008-11-25 13:51 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-11-25 13:51 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-11-24 19:11 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-11-24 19:11 172,032 ------w c:\windows\Setup1.exe
2008-11-24 19:11 --------- d-----w c:\program files\Golden Al-Wafi Translator
2008-11-24 19:10 --------- d-----w c:\program files\Common Files\Adobe
2008-11-24 19:08 --------- d-----w c:\program files\Microsoft Works
2008-11-24 19:05 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-24 19:04 --------- d-----w c:\program files\The Dictionary
2008-11-24 19:04 --------- d-----w c:\program files\Common Files\Nero
2008-11-24 19:03 --------- d-----w c:\program files\Common Files\Ahead
2008-11-24 19:03 --------- d-----w c:\program files\Ahead
2008-11-24 19:02 --------- d-----w c:\program files\Yahoo!
2008-11-24 19:02 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-24 19:02 --------- d-----w c:\documents and settings\alamin center\Application Data\Yahoo!
2008-11-24 19:00 --------- d-----w c:\program files\Skype
2008-11-24 19:00 --------- d-----w c:\program files\Google
2008-11-24 19:00 --------- d-----w c:\program files\Common Files\Skype
2008-11-24 19:00 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-11-24 19:00 --------- d-----w c:\documents and settings\alamin center\Application Data\Skype
2008-11-24 18:58 --------- d-----w c:\program files\Windows Live
2008-11-24 18:56 --------- d-----w c:\program files\IDA
2008-11-24 18:56 --------- d-----w c:\documents and settings\alamin center\Application Data\Internet Download Accelerator
2008-11-24 18:54 --------- d-----w c:\program files\QuickTime
2008-11-24 18:54 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-24 18:54 --------- d-----w c:\documents and settings\alamin center\Application Data\Apple Computer
2008-11-24 18:53 --------- d-----w c:\program files\CyberLink
2008-11-24 18:53 --------- d-----w c:\program files\ASUSTek
2008-11-24 18:53 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-11-24 18:51 --------- d-----w c:\program files\Real
2008-11-24 18:51 --------- d-----w c:\program files\Common Files\xing shared
2008-11-24 18:51 --------- d-----w c:\program files\Common Files\Real
2008-11-24 18:48 --------- d-----w c:\program files\USB Disk Security
2008-11-24 18:47 --------- d-----w c:\program files\Kaspersky Lab
2008-11-24 18:47 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-24 18:47 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-24 18:10 --------- d-----w c:\program files\ProgDVB
2008-11-24 18:09 --------- d-----w c:\program files\ProgDVB Arabic
2008-11-24 18:07 --------- d-----w c:\documents and settings\All Users\Application Data\NVIDIA
2008-11-24 18:03 --------- d-----w c:\program files\KWorld Multimedia
2008-11-24 18:00 --------- d-----w c:\program files\Realtek
2008-11-24 17:59 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-24 17:59 --------- d-----w c:\program files\Analog Devices
2008-11-24 17:57 --------- d-----w c:\program files\Intel
2008-11-24 17:55 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-24 17:42 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/03/2004 11:56 PM 15360]
"Internet Download Accelerator"="c:\program files\IDA\ida.exe" [04/10/2006 04:36 PM 2934784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [08/11/2006 09:43 PM 7630848]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [08/11/2006 09:43 PM 86016]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [05/18/2005 12:00 AM 925696]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [05/23/2008 08:33 PM 790528]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/24/2008 10:51 AM 185896]
"RemoteControl"="c:\program files\ASUSTek\ASUSDVD\PDVDServ.exe" [10/31/2003 07:42 PM 32768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [11/24/2008 10:54 AM 155648]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [07/09/2001 11:50 AM 155648]
"nwiz"="nwiz.exe" [08/11/2006 09:43 PM 1519616 c:\windows\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [10/27/2004 03:21 PM 61952 c:\windows\system32\HdAShCut.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [08/03/2004 11:56 PM 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-24 113664]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Remote Control.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Remote Control.lnk
backup=c:\windows\pss\Remote Control.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DTVR Agent]
--a------ 04/26/2005 01:50 PM 702464 c:\program files\KWorld Multimedia\DVBS\Scheduled.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
R2 CX2388X;KWorld 2388x Video Capture;c:\windows\system32\drivers\cx88cap.sys [2008-11-24 160640]
R2 CX88TS;%CnxtDVBS.DeviceDesc%;c:\windows\system32\drivers\cx88ts.sys [2008-11-24 13824]
R3 CXBDATUNE;KWorld DVB BDA Tuner/Demod;c:\windows\system32\drivers\cxBDAtun.sys [2008-11-24 108544]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-04-04 24344]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81d0bcce-bbf0-11dd-9da1-001a926375cf}]
\Shell\AutoRun\command - I:\kefakm.exe
\Shell\explore\Command - I:\kefakm.exe
\Shell\open\Command - I:\kefakm.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb9e0136-bb16-11dd-9d9d-000000000000}]
\Shell\AutoRun\command - I:\xp32.exe
\Shell\explore\Command - I:\xp32.exe
\Shell\open\Command - I:\xp32.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\alamin center\Application Data\Mozilla\Firefox\Profiles\lj886qx7.default\
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-28 09:30:55
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1044)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1100)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
.
Completion time: 11/28/2008 9:31:59
ComboFix-quarantined-files.txt 2008-11-28 17:31:58
ComboFix2.txt 2008-11-28 17:23:20
Pre-Run: 5,676,335,104 bytes free
Post-Run: 5,642,698,752 bytes free
151
