مرحبا
aily120 قد دخلت على البرنامج وحملت الأداه بس لسى باقي التجريب بوقت لاحق
البارون تسلم يدك وهذا التقرير
ComboFix 09-03-04.01 - امل 03/06/2009 2:12:38.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1256.1.1025.18.1013.319 [GMT 3:00]
Running from: c:\users\امل\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\msvrc20.dll
c:\windows\system32\Ultra.dll
.
((((((((((((((((((((((((( Files Created from 2009-02-05 to 2009-03-05 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 21:39 --------- d-----w c:\programdata\Kaspersky Lab
2009-03-05 21:36 4,641,272 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-05 21:36 349,624,608 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-21 00:52 --------- d-----w c:\program files\Windows Live
2009-02-16 13:45 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-13 00:45 --------- d-----w c:\users\امل\AppData\Roaming\Ashampoo
2009-02-07 08:50 --------- d-----w c:\users\امل\AppData\Roaming\DMCache
2009-02-06 16:43 307,576 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 15:52 49,504 ----a-w c:\windows\System32\sirenacm.dll
2009-02-04 15:00 --------- d-----w c:\program files\Norton Security Scan
2009-02-04 01:28 --------- d-sh--w c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-02-03 18:22 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-03 18:22 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-02 20:39 --------- d-----w c:\users\امل\AppData\Roaming\MSN Pictures Displayer
2009-01-28 22:59 --------- d-----w c:\program files\Common Files\BitDefender
2009-01-28 22:59 --------- d-----w c:\program files\BitDefender
2009-01-28 22:45 --------- d-----w c:\program files\Bug Doctor
2009-01-28 22:31 --------- d-----w c:\programdata\BitDefender
2009-01-28 21:18 --------- d-----w c:\users\امل\AppData\Roaming\BitDefender
2009-01-27 04:21 --------- d-----w c:\users\امل\AppData\Roaming\TuneUp Software
2009-01-27 04:19 --------- d-----w c:\programdata\TuneUp Software
2009-01-16 13:13 --------- d-----w c:\program files\MSECACHE
2009-01-15 10:05 911,872 ----a-w c:\windows\System32\wininet.dll
2009-01-15 10:05 43,008 ----a-w c:\windows\System32\licmgr10.dll
2009-01-15 10:04 18,944 ----a-w c:\windows\System32\corpol.dll
2009-01-15 10:04 132,096 ----a-w c:\windows\System32\ieUnatt.exe
2009-01-15 10:04 109,568 ----a-w c:\windows\System32\PDMSetup.exe
2009-01-15 10:04 109,056 ----a-w c:\windows\System32\iesysprep.dll
2009-01-15 10:04 107,520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe
2009-01-15 10:04 107,008 ----a-w c:\windows\System32\SetIEInstalledDate.exe
2009-01-15 10:03 72,704 ----a-w c:\windows\System32\admparse.dll
2009-01-15 10:03 71,680 ----a-w c:\windows\System32\iesetup.dll
2009-01-15 10:03 66,560 ----a-w c:\windows\System32\wextract.exe
2009-01-15 10:03 420,352 ----a-w c:\windows\System32\vbscript.dll
2009-01-15 10:02 169,472 ----a-w c:\windows\System32\iexpress.exe
2009-01-15 10:01 34,304 ----a-w c:\windows\System32\imgutil.dll
2009-01-15 10:00 48,128 ----a-w c:\windows\System32\mshtmler.dll
2009-01-15 10:00 45,568 ----a-w c:\windows\System32\mshta.exe
2009-01-15 09:50 156,160 ----a-w c:\windows\System32\msls31.dll
2009-01-14 04:56 --------- d-----w c:\program files\Recovered Files
2009-01-14 02:15 --------- d-----w c:\program files\Google
2009-01-14 00:28 --------- d-----w c:\programdata\Messenger Plus!
2009-01-13 07:39 --------- d-----w c:\program files\Windows Live SkyDrive
2009-01-13 07:39 --------- d-----w c:\program files\Microsoft
2009-01-13 04:34 --------- d-----w c:\program files\Windows Installer Clean Up
2009-01-13 03:56 --------- d-----w c:\programdata\WLInstaller
2008-05-21 00:36 174 --sha-w c:\program files\desktop.ini
2008-08-18 03:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-08-18 03:19 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\*******.IE5\index.dat
2008-08-18 03:19 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\******s\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\system32\msconfig.exe" [11/02/2006 12:45 PM 222208]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [12/08/2007 02:34 PM 3444736]
c:\users\ںêé\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-11-17 4708864]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-03 703280]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=Security Security
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
backup=c:\windows\pss\QuickSet.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^امل^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MSN Pictures Displayer.lnk]
path=c:\users\امل\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSN Pictures Displayer.lnk
backup=c:\windows\pss\MSN Pictures Displayer.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
--a------ 05/31/2005 01:13 PM 303104 c:\program files\Atheros\ACU.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CollaborationHost]
--a------ 11/02/2006 03:34 PM 191488 c:\windows\System32\p2phost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 02/15/2008 09:41 AM 166424 c:\windows\System32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 02/15/2008 09:41 AM 141848 c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 09/29/2006 09:58 PM 49152 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 02/06/2009 06:53 PM 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 06/15/2006 12:36 PM 229376 c:\progra~1\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 06/27/2006 04:21 PM 1449984 c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 02/15/2008 09:41 AM 133656 c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 09/18/2006 11:08 AM 29696 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
--a------ 05/22/2008 03:03 AM 1232896 c:\program files\Windows Sidebar\sidebar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a------ 09/13/2007 03:44 PM 405504 c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 05/27/2008 12:51 PM 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 11/12/2008 09:10 AM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 05/22/2008 03:11 AM 1006264 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2698061568-719749654-1137627286-1000]
"EnableNotificationsRef"=dword:00000005
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D1190EAD-A679-4BFA-8B44-DD8865CFAF2C}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{15521469-D79B-4FCD-B0A1-D8D4A6FC841C}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{CA53BBDD-5C86-4735-B374-FC276E390F71}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{0EE43E78-EF2D-48D8-A665-5346146E1286}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{4054AADE-5443-45E0-9BD1-FEC27FCA2143}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{87BDF504-0705-463A-9122-B9B9A6E5E2D0}c:\\program files\\internet download manager\\idman.exe"= UDP:c:\program files\internet download manager\idman.exe:Internet Download Manager (IDM)
"UDP Query User{342BF525-2CFF-47CA-BA5D-96A7095D052A}c:\\program files\\internet download manager\\idman.exe"= TCP:c:\program files\internet download manager\idman.exe:Internet Download Manager (IDM)
"TCP Query User{A98A27A9-0AE9-41AD-8086-2783F2EF76B8}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{ED20783E-BE85-40E7-B2ED-B5B390B659E8}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [2007-10-16 20496]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [2008-05-18 73728]
R2 AntiArpNdisProt;AntiARP NDIS Protocol Driver;c:\windows\System32\drivers\AntiArpNdisProt.sys [2007-04-18 21120]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R2 TeamViewer;TeamViewer 3;c:\program files\TeamViewer3\TeamViewer_Host.exe [2008-05-15 181544]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [2008-05-18 111616]
R3 xAntiArp;xAntiArpSpoof Service;c:\windows\System32\drivers\xAntiArp.sys [2007-08-11 305792]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\System32\drivers\royal.sys [2008-06-22 240128]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\RTL8187.sys [2008-05-26 205312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
*******s of the 'Scheduled Tasks' folder
2009-02-04 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe [01/09/2008 04:08 AM]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-CloneCDTray - c:\program files\SlySoft\CloneCD\CloneCDTray.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
FF - ProfilePath - c:\users\امل\AppData\Roaming\Mozilla\Firefox\Profiles\8bjimpjf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/firefox?client=firefox-a&rls=org.mozilla:ar
fficial
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-06 02:17:59
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2698061568-719749654-1137627286-1000_Classes\CLSID\{5b9446be-a342-4058-b104-bf29036de917}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000e4
"Therad"=dword:00000016
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,e8,49,d1,5d,db,2d,14,7a,8c,97,9a,95,3c,c2,88,f7,2d,92,35,e3,b8,08,\
[HKEY_USERS\S-1-5-21-2698061568-719749654-1137627286-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):ed,fd,0d,4a,88,1e,20,f2,b1,95,97,28,3f,d4,d2,39,d0,77,78,ec,31,
c6,23,cf,2d,1f,af,bf,d0,da,72,ff,e6,2e,f0,e7,56,6a,6b,d0,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-2698061568-719749654-1137627286-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):91,a3,4a,85,66,94,9a,96,4a,7e,d2,c3,95,c5,09,df,64,9b,63,48,01,
d2,0a,d9,43,4f,0b,14,15,35,1e,b7,d1,95,77,df,d1,eb,7e,c2,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-2698061568-719749654-1137627286-1000_Classes\CLSID\{fd346107-b547-4e8c-b714-a07ee2d4783f}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000a1
"Therad"=dword:00000017
.
Completion time: 03/06/2009 2:22:23
ComboFix-quarantined-files.txt 2009-03-05 23:22:19
Pre-Run: 33,557,692,416 bytes free
Post-Run: 34,495,795,200 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8
224
