هلا
يعطيك العافيه
وهذا تقرير الاداة
ComboFix 09-03-28.06 - es 03/30/2009 0:37:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.1014.675 [GMT 3:00]
Running from: c:\documents and settings\es\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\es\Application Data\addon.dat
c:\documents and settings\es\Application Data\addons.dat
c:\program files\Bifrost
c:\program files\Bifrost\logg.dat
c:\program files\Bifrost\win32.exe
c:\windows\system32\AutoRun.inf
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-29 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-29 21:37 82,432 ----a-w c:\documents and settings\es\Application Data\svchost.exe.exe
2009-03-29 21:35 825,376 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-29 21:35 12,836 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-29 20:57 --------- d-----w c:\program files\Circle Developement
2009-03-29 20:41 --------- d-----w c:\documents and settings\es\Application Data\Shim Mode
2009-03-29 20:36 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-29 19:35 82,432 --sh--r c:\windows\win32svc.exe
2009-03-29 18:16 --------- d-----w c:\program files\CCleaner
2009-03-12 21:03 --------- d-----w c:\program files\Windows Live Safety Center
2009-03-12 11:22 --------- d-----w c:\program files\Microsoft Games
2009-02-04 21:00 --------- d-----w c:\documents and settings\All Users\Application Data\comp two long internet
2009-02-04 20:56 --------- d-----w c:\program files\Shim Mode
2009-02-04 20:56 --------- d-----w c:\program files\MSN Messenger
2009-02-04 20:56 --------- d-----w c:\program files\Messenger Plus! Live
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [08/09/2006 03:41 PM 4617720]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [10/28/2005 04:25 PM 94208]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/07/2008 08:29 PM 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
"Poll Film"="c:\docume~1\es\APPLIC~1\SHIMMO~1\Corn Axis.exe" [02/04/2009 11:56 PM 639488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [05/16/2007 04:50 PM 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [05/16/2007 04:50 PM 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [05/16/2007 04:50 PM 137752]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM 31016]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 08:24 PM 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [07/09/2001 10:50 AM 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [02/05/2008 11:31 PM 185896]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [03/11/2007 09:34 PM 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"Long Internet Team Stupid"="c:\documents and settings\All Users\Application Data\comp two long internet\Boob hide.exe" [03/30/2009 12:35 AM 770048]
"SigmatelSysTrayApp"="stsystra.exe" [05/06/2007 05:10 PM 405504 c:\windows\stsystra.exe]
"win32svc"="win32svc.exe" [03/29/2009 10:35 PM 82432 c:\windows\win32svc.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\es\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-04 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 622653]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2007-11-04 118784]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D61248EA-D255-7964-BF50-6ED1F226F177}]
c:\windows\system32\wirtrans\khrombo.exe s
.
Contents of the 'Scheduled Tasks' folder
2009-03-29 c:\windows\Tasks\A1922F67919DDF93.job
- c:\docume~1\es\applic~1\shimmo~1\Date grim part.exe [02/05/2009 12:01 AM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-30 00:38:24
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
c:\program files\Internet Explorer\IEXPLORE.EXE [272] 0x861A4DA0
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(896)
c:\windows\System32\BCMLogon.dll
.
Completion time: 03/30/2009 0:39:31
ComboFix-quarantined-files.txt 2009-03-29 21:39:29
Pre-Run: 33,042,350,080 bytes free
Post-Run: 33,091,563,520 bytes free
124
