ComboFix 08-12-04.04 - Casper Hero 12/05/2008 4:28:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.1180 [GMT 2:00]
Running from: c:\documents and settings\Casper Hero\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-11-05 to 2008-12-05 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-05 02:28 --------- d-----w c:\documents and settings\Casper Hero\Application Data\DMCache
2008-12-05 02:11 --------- d-----w c:\program files\Internet Download Manager
2008-12-05 01:59 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-12-05 01:45 --------- d-----w c:\program files\AIMP2
2008-12-05 01:31 32 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-05 01:31 32 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-05 01:31 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-05 01:31 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-05 01:03 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-05 01:00 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-05 00:59 --------- d-----w c:\program files\SLD Codec Pack
2008-12-05 00:57 --------- d-----w c:\program files\AC3Filter
2008-12-05 00:56 --------- d-----w c:\documents and settings\Casper Hero\Application Data\uTorrent
2008-12-05 00:35 --------- d-----w c:\documents and settings\Casper Hero\Application Data\IDM
2008-12-05 00:18 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-05 00:18 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-12-05 00:15 --------- d-----w c:\program files\Webteh
2008-12-05 00:14 --------- d-----w c:\program files\Yahoo!
2008-12-05 00:14 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-05 00:04 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2008-12-05 00:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-04 23:58 --------- d-----w c:\program files\Microsoft.NET
2008-12-04 23:58 --------- d-----w c:\program files\Microsoft ActiveSync
2008-12-04 23:53 --------- d-----w c:\program files\CCleaner
2008-12-04 23:50 --------- d-----w c:\program files\Flash Player Pro
2008-12-04 23:48 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-04 23:48 286,720 ------w c:\windows\Setup1.exe
2008-12-04 23:48 --------- d-----w c:\program files\Anti Netcut
2008-12-04 23:47 --------- d-----w c:\program files\Ad Muncher
2008-12-04 23:38 685,816 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-04 23:37 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-04 23:36 --------- d-----w c:\program files\Realtek Sound Manager
2008-12-04 23:36 --------- d-----w c:\program files\Realtek AC97
2008-12-04 23:36 --------- d-----w c:\program files\AvRack
2008-12-04 23:34 --------- d-----w c:\program files\Intel
2008-12-04 23:20 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/03/2004 11:56 PM 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [10/28/2008 11:00 PM 2606512]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [09/19/2008 05:34 PM 4347120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [08/03/2004 09:32 PM 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/03/2004 09:32 PM 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/03/2004 09:32 PM 455168]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [03/11/2003 04:24 PM 86016]
"Ad Muncher"="c:\program files\Ad Muncher\AdMunch.exe" [10/28/2006 09:37 AM 705024]
"antinetcut2"="c:\program files\Anti Netcut\Anti NetCut.exe" [09/16/2006 02:37 PM 69694]
"SoundMan"="SOUNDMAN.EXE" [12/14/2005 06:06 PM 577536 c:\windows\soundman.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/03/2004 11:56 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.X264"= x264vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"f:\\program\\utorrent_2.exe"=
S3 cdspacex;cdspacex;c:\windows\system32\DRIVERS\CDSPACEX.sys []
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe []
S3 TwoRabts;Two Rabbits Live Bus;c:\windows\system32\DRIVERS\TwoRabts.sys []
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-05 04:29:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 12/05/2008 4:29:52
ComboFix-quarantined-files.txt 2008-12-05 02:29:46
Pre-Run: 3,605,995,520 bytes free
Post-Run: 3,800,387,584 bytes free
97
اما تقرير الهايجاك فهو
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:36, on 2008-12-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Ad Muncher\AdMunch.exe
C:\Program Files\Anti Netcut\Anti NetCut.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Casper Hero\Desktop\Zyzoom_HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Ad Muncher] C:\Program Files\Ad Muncher\AdMunch.exe /bt
O4 - HKLM\..\Run: [antinetcut2] C:\Program Files\Anti Netcut\Anti NetCut.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Block frame with Ad Muncher -
O8 - Extra context menu item: Block image with Ad Muncher -
O8 - Extra context menu item: Block link with Ad Muncher -
O8 - Extra context menu item: Don't filter page with Ad Muncher -
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Report page to the Ad Muncher developers -
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
--
End of file - 4862 bytes
ولك خالص تحياتى
