هذ1 التقرير الاول طلع لي في المفكره ونسخته مادري هو المطلوب ولا انا غلطان والتقرير الثاني حق الهايجاك لحظات وأنزله :
ComboFix 08-12-07.04 - طاغي 12/10/2008 5:01:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.467 [GMT 3:00]
Running from: d:\documents and settings\طاغي\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
d:\documents and settings\All Users\Application Data\winlogon10125.exe
d:\program files\Spyware Guard 2008
d:\program files\Spyware Guard 2008\conf.cfg
d:\program files\Spyware Guard 2008\mbase.vdb
d:\program files\Spyware Guard 2008\quarantine.vdb
d:\program files\Spyware Guard 2008\queue.vdb
d:\program files\Spyware Guard 2008\vbase.vdb
D:\setup.exe
d:\windows\csrss.exe
d:\windows\reged.exe
d:\windows\spoolsystem.exe
d:\windows\sys.com
d:\windows\syscert.exe
d:\windows\sysexplorer.exe
d:\windows\system32\mfc45.dll
d:\windows\vmreg.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_npf
((((((((((((((((((((((((( Files Created from 2008-11-10 to 2008-12-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 02:14 13,981,216 --sha-w d:\windows\system32\drivers\fidbox.dat
2008-12-10 02:13 646,176 --sha-w d:\windows\system32\drivers\fidbox2.dat
2008-12-10 02:07 63,644 --sha-w d:\windows\system32\drivers\fidbox2.idx
2008-12-10 02:07 195,536 --sha-w d:\windows\system32\drivers\fidbox.idx
2008-12-10 00:23 --------- d-----w d:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-09 22:44 --------- d-----w d:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-09 22:40 --------- d-----w d:\program files\Vuze
2008-12-09 20:51 --------- d-----w d:\documents and settings\طاغي\Application Data\Azureus
2008-12-09 12:21 --------- d-----w d:\documents and settings\All Users\Application Data\Apple Computer
2008-12-09 12:16 --------- d-----w d:\program files\Video Convert Master
2008-12-09 12:13 81,920 ----a-w d:\documents and settings\طاغي\Application Data\ezpinst.exe
2008-12-09 12:13 47,360 ----a-w d:\windows\system32\drivers\pcouffin.sys
2008-12-09 12:13 47,360 ----a-w d:\documents and settings\طاغي\Application Data\pcouffin.sys
2008-12-09 12:13 --------- d-----w d:\documents and settings\طاغي\Application Data\Vso
2008-12-09 11:48 --------- d-----w d:\program files\Xilisoft
2008-12-09 11:48 --------- d-----w d:\program files\QuickTime
2008-12-09 11:22 --------- d-----w d:\program files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter
2008-12-07 18:57 --------- d-----w d:\program files\Zone Labs
2008-12-07 12:41 --------- d-----w d:\program files\Free Internet TV
2008-12-05 23:51 --------- d-----w d:\program files\PC Tools Internet Security
2008-12-05 23:47 --------- d-----w d:\program files\Common Files\PC Tools
2008-12-05 23:47 --------- d-----w d:\documents and settings\All Users\Application Data\PC Tools
2008-12-05 23:46 --------- d---a-w d:\documents and settings\All Users\Application Data\TEMP
2008-12-05 23:44 --------- d-----w d:\program files\Browser Defender
2008-12-05 21:30 --------- d-----w d:\documents and settings\طاغي\Application Data\PCToolsSpamMonitorPlus
2008-12-05 21:30 --------- d-----w d:\documents and settings\طاغي\Application Data\PCToolsFirewallPlus
2008-12-05 18:20 --------- d-----w d:\program files\Common Files\InstallShield
2008-12-05 17:52 757,760 ----a-w d:\windows\system32\SkinCrafter.dll
2008-12-05 16:35 --------- d--h--w d:\program files\InstallShield Installation Information
2008-12-05 16:08 --------- d-----w d:\program files\Circle Developement
2008-12-05 16:07 --------- d-----w d:\documents and settings\طاغي\Application Data\BodyWipeNoun
2008-12-05 15:03 --------- d-----w d:\program files\Mininova-Vuze
2008-12-05 15:03 --------- d-----w d:\documents and settings\All Users\Application Data\Azureus
2008-12-05 14:08 --------- d-----w d:\program files\Windows Media Connect 2
2008-12-04 23:08 --------- d-----w d:\documents and settings\All Users\Application Data\Messenger Plus!
2008-12-04 23:05 --------- d-----w d:\program files\Windows Live
2008-12-04 23:04 --------- d-----w d:\documents and settings\All Users\Application Data\WLInstaller
2008-12-04 21:56 --------- d-----w d:\documents and settings\All Users\Application Data\STORE LESS JUGS SURF
2008-12-04 21:36 --------- d-----w d:\program files\BodyWipeNoun
2008-12-04 21:35 --------- d-----w d:\program files\Messenger Plus! Live
2008-12-04 19:33 --------- d-----w d:\program files\MSECACHE
2008-12-04 18:45 --------- d-----w d:\documents and settings\طاغي\Application Data\ADPHONE
2008-12-04 09:28 --------- d-----w d:\program files\MSN Messenger
2008-12-04 09:22 --------- d-----w d:\program files\Microsoft Office Outlook Connector
2008-12-04 09:09 --------- d-----w d:\program files\Windows Live Toolbar
2008-12-04 09:06 --------- d-----w d:\program files\Microsoft
2008-12-04 08:03 --------- d-----w d:\program files\Windows Installer Clean Up
2008-12-04 08:03 --------- d-----w d:\program files\Common Files\Windows Live
2008-12-04 07:29 410,976 ----a-w d:\windows\system32\deploytk.dll
2008-12-04 07:29 --------- d-----w d:\program files\Java
2008-12-04 07:01 --------- d-----w d:\program files\Yahoo!
2008-12-04 07:01 --------- d-----w d:\program files\CCleaner
2008-12-03 16:22 --------- d-----w d:\program files\IDA
2008-12-03 05:19 --------- d-----w d:\documents and settings\طاغي\Application Data\Internet Download Accelerator
2008-12-03 02:34 --------- d-----w d:\documents and settings\طاغي\Application Data\Media Player Classic
2008-12-03 02:30 2,223,653 ----a-w D:\mpc2kxp6490.zip
2008-12-02 19:50 --------- d-----w d:\program files\Common Files\Adobe
2008-12-02 18:31 75,921,920 ----a-w D:\ps55try.exe
2008-12-02 17:29 827,382 ----a-w D:\Trojan_u.zip
2008-12-02 17:15 --------- d-----w d:\program files\GIF Movie Gear
2008-12-02 17:14 985,989 ----a-w D:\MovieGear4.exe
2008-12-02 16:39 --------- d-----w d:\documents and settings\طاغي\Application Data\CursorArts
2008-12-02 16:38 --------- d-----w d:\program files\ImageForge3
2008-12-02 16:36 6,766,448 ----a-w D:\imf_pro.exe
2008-12-02 14:16 40,073 ----a-w D:\patcher.zip
2008-12-02 14:09 --------- d-----w d:\program files\SWiSHmax
2008-12-02 14:05 9,783,685 ----a-w D:\SetupSwishmax_20050505.exe
2008-12-01 14:09 357,973 ----a-w D:\شطرنج.zip
2008-12-01 13:03 0 ---ha-w d:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-01 13:03 0 ---ha-w d:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-12-01 12:33 499,712 ----a-w d:\windows\system32\msvcp71.dll
2008-12-01 12:33 348,160 ----a-w d:\windows\system32\msvcr71.dll
2008-12-01 12:33 --------- d-----w d:\program files\Common Files\xing shared
2008-12-01 12:33 --------- d-----w d:\program files\Common Files\Real
2008-12-01 11:59 8,552 ----a-w d:\windows\system32\drivers\asctrm.sys
2008-12-01 11:59 --------- d-----w d:\program files\Real
2008-12-01 11:59 --------- d-----w d:\program files\aod
2008-11-30 16:28 --------- d-----w d:\documents and settings\طاغي\Application Data\HiYo
2008-11-30 00:41 --------- d-----w d:\program files\CEDP Stealer 6.0 for Messenger
2008-11-29 23:55 --------- d-----w d:\documents and settings\All Users\Application Data\iolo
2008-11-29 23:53 --------- d-----w d:\documents and settings\طاغي\Application Data\iolo
2008-11-29 21:19 --------- d-----w d:\program files\Microsoft SQL Server Compact Edition
2008-11-29 19:56 --------- dcsh--w d:\program files\Common Files\WindowsLiveInstaller
2008-11-23 15:13 --------- d-----w d:\documents and settings\All Users\Application Data\Bluetooth
2008-11-23 05:49 102,400 ----a-w d:\windows\system32\STemp_01.exe
2008-11-20 21:58 --------- d-----w d:\program files\Windows Live Safety Center
2008-11-19 22:54 --------- d-----w d:\documents and settings\طاغي\Application Data\AntiSpywareGuard
2008-11-16 10:04 --------- d-----w d:\program files\Golden Al-Wafi Translator
2008-11-16 10:03 73,216 ----a-w d:\windows\ST6UNST.EXE
2008-11-16 10:03 172,032 ------w d:\windows\Setup1.exe
2008-11-15 06:38 --------- d-----w d:\program files\Conduit
2008-11-14 16:30 --------- d-----w d:\program files\Windows Live Favorites
2008-11-14 16:28 --------- d-----w d:\documents and settings\All Users\Application Data\Windows Live Toolbar
2008-11-11 15:32 21,035 ----a-w d:\windows\system32\drivers\AegisP.sys
2008-11-11 15:31 --------- d-----w d:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility
2008-10-24 11:21 455,296 ----a-w d:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w d:\windows\system32\gdi32.dll
2008-10-16 11:13 202,776 ----a-w d:\windows\system32\wuweb.dll
2008-10-16 11:13 1,809,944 ----a-w d:\windows\system32\wuaueng.dll
2008-10-16 11:12 561,688 ----a-w d:\windows\system32\wuapi.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "d:\program files\Mininova-Vuze\tbMini.dll" [09/15/2008 06:47 AM 1784856]
[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
09/15/2008 06:47 AM 1784856 --a------ d:\program files\Mininova-Vuze\tbMini.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{d51d388b-f5dc-471a-a1ce-5e2d671091c0}"= "d:\program files\Mininova-Vuze\tbMini.dll" [09/15/2008 06:47 AM 1784856]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D51D388B-F5DC-471A-A1CE-5E2D671091C0}"= "d:\program files\Mininova-Vuze\tbMini.dll" [09/15/2008 06:47 AM 1784856]
[HKEY_CLASSES_ROOT\clsid\{d51d388b-f5dc-471a-a1ce-5e2d671091c0}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
"MsnMsgr"="d:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM 33648]
"TkBellExe"="d:\program files\Common Files\Real\Update_OB\realsched.exe" [12/01/2008 03:33 PM 185872]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [12/04/2008 10:29 AM 136600]
"ZoneAlarm Client"="d:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [11/14/2007 04:05 PM 919016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [04/14/2008 07:00 PM 110592 d:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [04/14/2008 06:59 PM 15360]
d:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.exe.lnk - d:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-02 113664]
REALTEK RTL8187 Wireless LAN Utility.lnk - d:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe [2008-11-11 737280]
WinZip Quick Pick.lnk - d:\program files\WinZip\WZQKPICK.EXE [2008-08-23 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"=
"d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R1 oxser;OX16C95x Serial port driver;d:\windows\system32\DRIVERS\oxser.sys [2008-08-25 51169]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\DRIVERS\klim5.sys [2007-04-04 24344]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;d:\windows\system32\DRIVERS\RTL8187.sys [2008-11-11 194304]
R3 SjyPkt;SjyPkt;\??\d:\windows\System32\Drivers\SjyPkt.sys [2008-11-11 13532]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-ADPHONE - d:\program files\ADPHONE3\ADPHONE.EXE
HKCU-Run-Internet Download Accelerator - d:\program files\IDA\ida.exe
.
------- Supplementary Scan -------
.
uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
IE: &Google Search - d:\program files\Google\googletoolbar.dll/cmsearch.html
IE: &Search -
IE: &Windows Live Search - d:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites -
IE: Backward &Links - d:\program files\Google\googletoolbar.dll/cmbacklinks.html
IE: Cac&hed Snapshot of Page - d:\program files\Google\googletoolbar.dll/cmcache.html
IE: Download ALL with IDA
IE: Download with IDA
IE: Si&milar Pages - d:\program files\Google\googletoolbar.dll/cmsimilar.html
IE: Translate into English - d:\program files\Google\googletoolbar.dll/cmtrans.html
IE: ت&صدير إلى Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
d:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
d:\windows\Downloaded Program Files\tbhelper.dll - d:\windows\Downloaded Program Files\FileFlyerMax.crc
d:\windows\Downloaded Program Files\uninstall.exe
d:\windows\Downloaded Program Files\FFMax_logo.bmp
d:\windows\Downloaded Program Files\FFMax_saved.bmp
d:\windows\Downloaded Program Files\FFMax_upload.bmp
d:\windows\Downloaded Program Files\suggestion_plugin.dll
d:\windows\Downloaded Program Files\autosearch_plugin.dll
d:\windows\Downloaded Program Files\about.html
d:\windows\Downloaded Program Files\info.txt
d:\windows\Downloaded Program Files\FileFlyerMax_icons.bmp
d:\windows\Downloaded Program Files\affid.dat
d:\windows\Downloaded Program Files\update.exe
d:\windows\Downloaded Program Files\basic.xml
d:\windows\Downloaded Program Files\maxlocal.xml
d:\windows\Downloaded Program Files\version.txt
d:\windows\Downloaded Program Files\basis.xml
d:\windows\Downloaded Program Files\FileFlyerMax.dll
O16 -: {6226BA26-C017-4007-928C-DE9715C6FA67}
hxxp://max.fileflyer.com/toolbar/FileFlyerMax.CAB
d:\windows\Downloaded Program Files\FileFlyerMax.inf
d:\windows\system32\msvcrt.dll - d:\windows\system32\mfc42.dll
d:\windows\system32\olepro32.dll
d:\windows\Downloaded Program Files\imcv1.dll
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413}
hxxp://76.76.24.100/IMSCP/talk.cab
d:\windows\Downloaded Program Files\talk.inf
c:\program files\LtUcx\1003\c0.dll - d:\windows\system32\msvcrt.dll
d:\windows\system32\mfc42.dll
d:\windows\system32\olepro32.dll
d:\windows\Downloaded Program Files\IMCSec.dll
O16 -: {C171FF59-8C55-4796-A398-4F5D02B4C763}
hxxp://76.76.24.100/imscp/talks3n.cab
d:\windows\Downloaded Program Files\talks.inf
FireFox -: Profile - d:\documents and settings\طاغي\Application Data\Mozilla\Firefox\Profiles\n6esbnl1.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-10 05:12:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
d:\windows\TEMP\ZLT058d7.TMP 256 bytes
d:\windows\TEMP\ZLT058db.TMP 256 bytes
scan completed successfully
hidden files: 2
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1448)
d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
d:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1504)
d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll
d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
- - - - - - - > 'explorer.exe'(3872)
d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll
d:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 12/10/2008 5:17:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-10 02:16:59
Pre-Run: 890,139,648 bytes free
Post-Run: 943,863,808 bytes free
281 --- E O F --- 2008-12-10 00:23:16
