هذا تقرير الاداة الاولى الثانيه مااشتغلت
ComboFix 08-11-30.01 - Administrator 2008-11-30 22:02:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.195 [GMT 4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Desktop_.ini
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 )))))))))))))))))))))))))))))))
.
2008-11-30 06:51 . 2008-11-30 06:51 15,329 --a------ c:\windows\system32\%LocalXml%
2008-11-30 02:44 . 2008-11-30 03:06 <DIR> d-------- c:\windows\BDOSCAN8
2008-11-30 00:20 . 2008-11-30 00:20 96,976 --a------ c:\windows\system32\drivers\klin.dat
2008-11-30 00:20 . 2008-11-30 00:20 87,855 --a------ c:\windows\system32\drivers\klick.dat
2008-11-30 00:18 . 2008-11-30 22:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-30 00:18 . 2008-11-30 22:05 2,602,016 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-11-30 00:18 . 2008-11-30 22:05 385,056 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2008-11-30 00:18 . 2008-11-30 22:05 22,456 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-11-30 00:18 . 2008-11-30 22:05 2,396 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2008-11-27 08:46 . 2008-11-27 08:46 0 --a------ C:\osy3.sys
2008-11-27 07:25 . 2008-11-29 23:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-26 06:09 . 2008-11-26 06:09 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ESET
2008-11-26 06:04 . 2008-11-26 06:04 <DIR> d-------- c:\program files\ESET
2008-11-26 05:33 . 2008-11-27 07:48 4,212 ---h----- c:\windows\system32\zllictbl.dat
2008-11-26 05:32 . 2008-11-29 23:53 <DIR> d-------- c:\windows\Internet Logs
2008-11-25 07:49 . 2008-11-30 01:14 <DIR> d-------- c:\program files\Enigma Software Group
2008-11-25 07:02 . 2008-11-25 07:02 <DIR> d-------- c:\documents and settings\Administrator\Application Data\IDOL OWNS
2008-11-25 04:12 . 2008-11-25 04:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\BitDefender
2008-11-24 02:25 . 2008-11-24 02:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-11-15 03:41 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2008-11-15 03:41 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2008-11-14 22:34 . 2004-08-04 00:56 21,504 --a------ c:\windows\system32\hidserv.dll
2008-11-14 22:34 . 2004-08-04 00:56 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
2008-11-14 22:34 . 2004-08-03 22:58 14,848 --a------ c:\windows\system32\drivers\kbdhid.sys
2008-11-14 22:34 . 2004-08-03 22:58 14,848 --a--c--- c:\windows\system32\dllcache\kbdhid.sys
2008-11-14 22:31 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys
2008-11-14 22:31 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
2008-11-13 04:10 . 2008-10-24 15:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 20:00 . 2008-11-11 20:00 218,376 --a------ c:\windows\system32\klogon.dll
2008-11-11 19:58 . 2008-11-11 19:58 25,601 --a------ c:\windows\system32\drivers\klopp.dat
2008-11-06 10:58 . 2008-11-13 04:19 <DIR> d-------- c:\program files\Real_SC
2008-10-27 20:46 . 2008-10-28 05:00 81,984 --a------ c:\windows\system32\bdod.bin
2008-10-27 20:41 . 2008-10-28 05:48 <DIR> d-------- c:\program files\Common Files\Softwin
2008-10-27 20:36 . 2008-10-27 20:36 <DIR> d-------- c:\windows\system32\logs
2008-10-27 20:31 . 2008-10-27 20:31 <DIR> d-------- c:\windows\system32\URTTEMP
2008-10-23 17:22 . 2008-10-23 17:22 268 --ah----- C:\sqmdata14.sqm
2008-10-23 17:22 . 2008-10-23 17:22 268 --ah----- C:\sqmdata13.sqm
2008-10-23 17:22 . 2008-10-23 17:22 244 --ah----- C:\sqmnoopt13.sqm
2008-10-22 07:03 . 2008-10-31 03:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-22 06:57 . 2008-10-22 07:01 <DIR> d-------- c:\program files\MSN Messenger
2008-10-22 05:52 . 2008-10-27 08:15 <DIR> d-------- c:\program files\PhotoRescue Pro
2008-10-22 05:35 . 2008-10-27 08:08 <DIR> d-------- c:\program files\GetData
2008-10-21 17:30 . 2008-10-27 20:39 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-10-21 00:18 . 2008-10-21 00:18 <DIR> d-------- C:\_OTMoveIt
2008-10-21 00:09 . 2008-10-21 00:19 <DIR> d-------- c:\program files\Yahoo!
2008-10-21 00:08 . 2008-10-21 00:09 <DIR> d-------- c:\program files\CCleaner
2008-10-20 19:59 . 2008-10-20 19:59 120 --a------ C:\sqmnoopt12.sqm
2008-10-20 19:59 . 2008-10-20 19:59 120 --a------ C:\sqmdata12.sqm
2008-10-20 19:58 . 2008-10-20 19:58 200 --a------ C:\sqmnoopt11.sqm
2008-10-20 19:58 . 2008-10-20 19:58 200 --a------ C:\sqmdata11.sqm
2008-10-20 06:24 . 2008-10-20 06:24 <DIR> d-------- c:\program files\IDOL OWNS
2008-10-20 05:57 . 2008-10-20 05:57 200 --a------ C:\sqmnoopt10.sqm
2008-10-20 05:57 . 2008-10-20 05:57 200 --a------ C:\sqmdata10.sqm
2008-10-20 05:53 . 2008-10-20 05:53 260 --a------ C:\sqmdata09.sqm
2008-10-20 05:53 . 2008-10-20 05:53 224 --a------ C:\sqmnoopt09.sqm
2008-10-20 05:52 . 2008-10-20 05:52 <DIR> d-------- c:\program files\Microsoft Office Outlook Connector
2008-10-20 05:51 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2008-10-20 05:44 . 2008-10-20 05:44 <DIR> d-------- c:\program files\Microsoft
2008-10-20 05:33 . 2008-10-20 05:33 <DIR> d-------- c:\program files\Common Files\Windows Live
2008-10-20 05:20 . 2008-10-21 21:58 <DIR> d-------- c:\documents and settings\Administrator\Tracing
2008-10-19 23:22 . 2008-10-22 06:54 <DIR> d-------- c:\program files\Windows Live
2008-10-19 23:22 . 2008-10-22 07:01 <DIR> d-------- c:\program files\Messenger Plus! Live
2008-10-19 23:22 . 2008-10-31 18:36 <DIR> d-------- c:\program files\Circle Developement
2008-10-19 23:18 . 2008-10-19 23:18 850 --a------ c:\windows\system32\ProductTweaks.xml
2008-10-19 16:49 . 2008-10-19 16:49 385 --a------ c:\windows\system32\user_gensett.xml
2008-10-19 07:03 . 2008-11-26 03:16 <DIR> d-------- c:\program files\BitDefender
2008-10-19 07:02 . 2008-11-27 07:13 <DIR> d-------- c:\program files\Common Files\BitDefender
2008-10-17 20:00 . 2008-10-18 02:56 <DIR> d-------- c:\documents and settings\Administrator\Application Data\dvdcss
2008-10-16 07:45 . 2008-10-16 07:45 <DIR> d--h----- c:\windows\PIF
2008-10-16 06:43 . 2008-10-16 06:52 <DIR> d-------- c:\windows\system32\scripting
2008-10-16 06:43 . 2008-10-16 06:43 <DIR> d-------- c:\windows\system32\en
2008-10-16 06:43 . 2008-10-16 06:52 <DIR> d-------- c:\windows\system32\bits
2008-10-16 06:43 . 2008-10-16 06:43 <DIR> d-------- c:\windows\l2schemas
2008-10-16 06:22 . 2007-08-10 20:46 33,656 --a------ c:\windows\system32\sprecovr.exe
2008-10-16 06:02 . 2004-08-04 16:00 4,256,768 --a------ c:\windows\system32\dllcache\wmm2res.dll
2008-10-16 06:01 . 2004-08-04 16:00 13,463,552 --a------ c:\windows\system32\dllcache\hwxjpn.dll
2008-10-16 06:00 . 2004-08-04 16:00 4,190,352 --a------ c:\windows\system32\dllcache\luna.mst
2008-10-15 19:21 . 2008-10-15 19:22 <DIR> d-------- c:\documents and settings\Administrator\Application Data\MSNInstaller
2008-10-15 01:00 . 2008-10-15 01:00 <DIR> d-------- c:\documents and settings\LocalService\Application Data\agi
2008-10-15 00:57 . 2008-10-15 00:57 2,117,632 --a------ c:\windows\system32\python25.dll
2008-10-15 00:57 . 2008-09-16 20:26 1,332,197 --a------ c:\windows\system32\pythondll.zip
2008-10-15 00:57 . 2008-10-15 00:57 339,968 --a------ c:\windows\system32\pythoncom25.dll
2008-10-15 00:57 . 2008-10-15 00:57 114,688 --a------ c:\windows\system32\pywintypes25.dll
2008-10-09 19:53 . 2008-10-09 19:53 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ImTOO Software Studio
2008-10-09 19:50 . 2008-10-09 19:50 <DIR> d-------- c:\program files\ImTOO
2008-10-09 18:23 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll
2008-10-08 17:49 . 2003-02-28 18:26 171,280 --a------ c:\windows\system32\jit.dll
2008-10-08 17:49 . 2003-02-28 18:26 46,352 --a------ c:\windows\setdebug.exe
2008-10-08 17:49 . 2003-02-28 16:54 7,315 --a------ c:\windows\system32\javasup.vxd
2008-10-08 17:37 . 2008-10-08 17:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-10-08 01:10 . 2008-10-08 01:10 <DIR> d-------- c:\program files\QuickTime
2008-10-06 11:17 . 2008-11-19 01:13 <DIR> d-------- c:\program files\Hotspot Shield
2008-10-04 23:04 . 2008-10-04 23:04 <DIR> d-------- c:\program files\MSXML 4.0
2008-10-04 20:22 . 2008-04-14 04:12 7,680 --a------ c:\windows\system32\spdwnwxp.exe
2008-10-04 20:19 . 2006-12-28 23:01 19,569 --a------ c:\windows\
002915_.tmp
2008-10-04 19:24 . 2008-11-25 08:13 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-10-03 21:35 . 2008-11-17 03:13 <DIR> d--h----- c:\windows\$hf_mig$
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 03:32 --------- d-----w c:\documents and settings\All Users\Application Data\Long slow road itch
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 20:06 --------- d-----w c:\program files\Google
2008-10-14 00:13 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-08 13:49 155,995 ----a-w c:\windows\java\Packages\
0331bpjt.zip
2008-10-05 13:45 --------- d-----w c:\program files\Kaspersky Lab
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2008-11-18 06:59 200192 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-25 94208]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-06-13 118784]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2006-06-23 225280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-09 185896]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-11-11 206088]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-19 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-07-19 c:\windows\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-01-17 618557]
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
--------- 2006-07-19 09:41 53248 c:\program files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--------- 2004-08-04 16:00 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2006-06-13 09:57 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2006-06-13 09:57 94208 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 12:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2005-09-25 19:11 155648 c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--------- 2007-06-18 15:10 271360 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-09-09 23:28 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
-ra------ 2005-12-13 21:50 88204 c:\windows\AGRSMMSG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2006-07-19 09:41 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VSSERV"=2 (0x2)
"vsmon"=2 (0x2)
"usnjsvc"=3 (0x3)
"ServiceLayer"=3 (0x3)
"ose"=3 (0x3)
"MDM"=2 (0x2)
"LVPrcSrv"=2 (0x2)
"LIVESRV"=2 (0x2)
"HotspotShieldService"=2 (0x2)
"btwdins"=2 (0x2)
"Arrakis3"=3 (0x3)
"Adobe LM Service"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\DRIVERS\lv321av.sys [2008-09-10 1097728]
S2 BDVEDISK;BDVEDISK;\??\c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys []
.
s of the 'Scheduled Tasks' folder
2008-11-30 c:\windows\Tasks\AF34BDA591233359.job
- c:\docume~1\admini~1\applic~1\idolow~1\obj more second.exe []
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Curb Hide - c:\docume~1\ADMINI~1\APPLIC~1\IDOLOW~1\bold dvd open.exe
HKLM-Run-avgnt - c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
.
------- Supplementary Scan -------
.
uStart Page =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {0D167D3B-0748-41A1-BA09-8DDA01D85D53} = 213.42.20.20,192.229.241.222
TCP: {DC0AB25F-1B57-47C5-B24A-B43D096EEF6C} = 213.42.20.20,195.229.241.222
c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
c:\windows\Downloaded Program Files\OSDC5.OSD
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-30 22:07:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\docume~1\ADMINI~1\LOCALS~1\temp\RtkBtMnt.exe
.
**************************************************************************
.
Completion time: 2008-11-30 22:09:53 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2008-11-30 18:09:50
Pre-Run: 28,637,319,168 bytes free
Post-Run: 30,597,853,184 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
254 --- E O F --- 2008-11-29 23:09:43
k:
.png)
.png)
