هذا هو التقرير
ComboFix 09-03-29.04 - winxp 03/30/2009 18:16:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.502.225 [GMT 3:00]
Running from: c:\documents and settings\winxp\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\winxp\Application Data\.#
c:\documents and settings\winxp\Application Data\dach100.dll
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\kakle.dll
c:\windows\system32\tmp.reg
c:\windows\system32\Ultra.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-30 15:28 112,367,392 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-30 15:27 --------- dc----w c:\documents and settings\winxp\Application Data\DMCache
2009-03-30 15:24 3,928,352 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-03-30 15:23 374,480 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-03-30 15:22 1,511,972 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-30 12:52 --------- dc----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-30 12:49 --------- dc----w c:\documents and settings\winxp\Application Data\IDM
2009-03-30 12:27 --------- dc----w c:\program files\Trend Micro
2009-03-30 09:02 --------- dc----w c:\program files\MSXML 6.0
2009-03-30 08:48 --------- dc--a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-30 07:27 --------- dc----w c:\program files\RegCure
2009-03-30 07:16 --------- dc----w c:\program files\Zend
2009-03-30 07:16 --------- dc----w c:\program files\Your Uninstaller 2008
2009-03-30 07:16 --------- dc----w c:\program files\Modem Helper
2009-03-30 07:16 --------- dc----w c:\program files\DivX
2009-03-30 01:26 --------- dc----w c:\program files\Dell
2009-03-29 13:46 --------- dc----w c:\documents and settings\winxp\Application Data\PC Suite
2009-03-29 13:43 --------- dc----w c:\program files\PC Connectivity Solution
2009-03-29 13:43 --------- dc----w c:\program files\DIFX
2009-03-29 13:34 --------- dc----w c:\program files\MSBuild
2009-03-29 13:29 --------- dc----w c:\program files\Reference Assemblies
2009-03-28 14:58 --------- dc----w c:\documents and settings\winxp\Application Data\Smart PC Solutions
2009-03-28 11:14 --------- dc----w c:\program files\Google
2009-03-17 02:47 --------- dc----w c:\program files\Common Files\Adobe
2009-03-17 02:25 --------- dc-h--w c:\program files\InstallShield Installation Information
2009-03-17 02:25 --------- dc----w c:\program files\ONH1986
2009-03-13 00:15 --------- dc----w c:\program files\IP Address Shield
2009-03-11 06:21 --------- dc----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-09 17:19 --------- dc----w c:\program files\Common Files\xing shared
2009-03-09 17:19 --------- dc----w c:\program files\Common Files\Real
2009-03-05 01:09 --------- dc----w c:\program files\PhotoZoom Pro 2
2009-03-05 00:11 --------- dc----w c:\program files\STOIK Imaging
2009-03-04 23:23 --------- dc----w c:\program files\CEDP Stealer 6.0 for Messenger
2009-02-28 14:16 --------- dc----w c:\program files\AdVantage
2009-02-27 20:09 --------- dc----w c:\program files\RM Converter
2009-02-27 19:15 --------- dc----w c:\program files\RM to MP3 Converter
2009-02-26 22:55 --------- dc----w c:\program files\Folder Lock
2009-02-15 20:53 --------- dc----w c:\program files\Windows Live
2009-02-15 20:53 --------- dc----w c:\program files\Microsoft
2009-02-15 20:52 --------- dc----w c:\program files\Windows Live SkyDrive
2009-02-15 20:05 --------- dc----w c:\program files\Common Files\Windows Live
2009-02-12 18:58 --------- dc----w c:\documents and settings\winxp\Application Data\U3
2009-02-11 22:43 --------- dc----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-02-09 10:19 1,846,272 -c--a-w c:\windows\system32\win32k.sys
2009-02-06 17:36 --------- dc----w c:\documents and settings\winxp\Application Data\COOL JUNK MEDIA
2009-02-06 17:35 --------- dc----w c:\documents and settings\All Users\Application Data\Once Dog Dupe Amok
2009-02-06 17:33 --------- dc----w c:\program files\COOL JUNK MEDIA
2009-02-06 17:32 --------- dc----w c:\program files\Messenger Plus! Live
2009-02-06 17:32 --------- dc----w c:\program files\Circle Developement
2009-02-06 15:52 49,504 -c--a-w c:\windows\system32\sirenacm.dll
2009-02-03 17:13 89,601 -c--a-w c:\windows\system32\drivers\klick.dat
2009-02-03 17:13 101,287 -c--a-w c:\windows\system32\drivers\klin.dat
2008-12-31 14:04 528,744 -c--a-w c:\windows\system32\OGAVerify.exe
2008-12-31 14:04 502,120 -c--a-w c:\windows\system32\OGAAddin.dll
2008-12-05 07:12 144,896 -c--a-w c:\windows\system32\schannel.dll
2008-03-09 07:16 32 -c--a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [02/06/2009 06:53 PM 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"RemoteCenter"="c:\program files\Creative\MediaSource\RemoteControl\RCMan.EXE" [11/21/2003 02:08 PM 143360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [01/10/2008 10:05 PM 932784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [03/28/2009 12:47 AM 171448]
"user gpl"="c:\docume~1\winxp\APPLIC~1\COOLJU~1\lite nurb stop.exe" [02/06/2009 08:33 PM 557056]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [05/11/2000 01:00 AM 90112]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [11/03/2004 07:24 AM 32768]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/03/2004 10:32 PM 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/03/2004 10:32 PM 455168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [12/13/2005 05:44 PM 98304]
"igfxpers"="c:\windows\system32\igfxpers.exe" [12/13/2005 05:45 PM 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [12/13/2005 05:41 PM 77824]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM 33648]
"dupe amok gram atom"="c:\documents and settings\All Users\Application Data\Once Dog Dupe Amok\Curb road.exe" [03/30/2009 06:27 PM 831488]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [08/04/2006 05:51 AM 1032192]
"CTSysVol"="c:\program files\Creative\USB SBAudigy2 NX\Surround Mixer\CTSysVol.exe" [07/09/2003 02:36 PM 57344]
"CTDVDDET"="c:\program files\Creative\USB SBAudigy2 NX\DVDAudio\CTDVDDet.EXE" [06/18/2003 01:00 AM 45056]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [12/19/2005 08:08 PM 1347584]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [03/09/2009 08:18 PM 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [02/27/2009 05:10 PM 35696]
"SigmatelSysTrayApp"="stsystra.exe" [03/25/2006 04:30 AM 282624 c:\windows\stsystra.exe]
"SbUsb AudCtrl"="sbusbdll.dll" [11/24/2003 11:26 AM 98304 c:\windows\system32\sbusbdll.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-25 622653]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Orbit.lnk]
backup=c:\windows\pss\Orbit.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage]
--a--c--- 11/05/2007 11:12 AM 884176 c:\program files\AdVantage\AdVantage.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a--c--- 08/03/2004 10:32 PM 208952 c:\windows\ime\IMJP8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 10/13/2004 07:24 PM 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 07/09/2001 11:50 AM 155648 c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-04-04 24344]
S3 CAM1210;SM0121 USB 2.0 Video Camera;c:\windows\system32\drivers\cam1210.sys [2006-07-25 89856]
S3 sbusb;Sound Blaster USB Audio Driver;c:\windows\system32\drivers\sbusb.sys [2008-03-04 911488]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb4aeb64-572b-11dc-b371-00197dfd49d6}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(0)\command - Recycled\ctfmon.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe []
2009-03-30 c:\windows\Tasks\AD631A6590E492E5.job
- c:\docume~1\winxp\applic~1\coolju~1\Downloadflawbore.exe [02/06/2009 08:36 PM]
2009-03-29 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [12/31/2008 05:04 PM]
2009-03-30 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [12/31/2008 05:04 PM]
2009-03-30 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [03/30/2009 10:25 AM]
2009-03-30 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [03/30/2009 10:25 AM]
.
- - - - ORPHANS REMOVED - - - -
Notify-NavLogon - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.yahoo.com/
uInternet Settings,ProxyServer = 212.71.37.130:8080
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
DPF: {3C8E8DD8-D86A-4E6D-AF37-AB3CA7FDF8CD} - hxxp://qtr13.talkok.com/imscp/talkc38.cab
DPF: {8C159DFD-DC9C-4077-B3B6-114A8D64B6D2} - hxxp://74.53.69.70/cp/files/talk08.cab
DPF: {9E45BE3C-DE06-4492-AB7D-E51447CF2ED0} - hxxp://qtr13.talkok.com/imscp/talka.cab
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://209.11.243.139/ReadUid.CAB
FF - ProfilePath - c:\documents and settings\winxp\Application Data\Mozilla\Firefox\Profiles\kaup30jw.default\
FF - prefs.js: browser.startup.homepage -
FF - component: c:\documents and settings\winxp\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-30 18:25:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1957994488-1547161642-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="ba"
"b"="NOTEPAD.EXE"
[HKEY_USERS\S-1-5-21-1957994488-1547161642-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithProgids]
"ctt_auto_file"=hex(0):
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):5b,7d,13,aa,dc,2a,fb,2b,b0,fe,f0,ba,b7,03,88,98,df,ce,17,07,38,
54,d7,88,60,94,1a,48,0a,0a,53,7b,af,a1,87,2c,be,91,b1,31,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5fd1b36e-b722-49e0-919d-36c1d7b33325}]
@Denied: (Full) (Everyone)
"Model"=dword:00000132
"Therad"=dword:00000001
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,1e,02,2f,99,28,90,18,29,10,4d,a8,bd,d6,e3,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):13,63,96,e7,f0,d0,b4,ca,f1,a6,a6,28,30,47,05,69,f8,2e,74,83,c5,
1d,bf,13,f1,de,81,eb,a4,14,94,ea,6f,fe,ea,78,9d,80,1e,ef,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{fe12d8bb-68de-4994-86c4-4d0b332f5e5a}]
@Denied: (Full) (Everyone)
"Model"=dword:00000132
"Therad"=dword:0000000f
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(800)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
c:\windows\System32\BCMLogon.dll
- - - - - - - > 'lsass.exe'(860)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\Crypserv.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
.
**************************************************************************
.
Completion time: 03/30/2009 18:34:28 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-30 15:34:19
Pre-Run: 12,732,157,952 bytes free
Post-Run: 12,764,950,528 bytes free
Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
272 --- E O F --- 2009-03-30 09:02:16
