هذا التقرير الأول بتاع hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:16:06 م, on 16/05/09
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Users\HP\Desktop\Internet Download Manager 5.14 Build 5\IDMan.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Mobily Connect Card\Mobily Connect Card.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\JetAudio\JetAudio.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\HP\Documents\Downloads\Programs\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Users\HP\Desktop\Internet Download Manager 5.14 Build 5\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [IDMan] C:\Users\HP\Desktop\Internet Download Manager 5.14 Build 5\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Users\HP\Desktop\Internet Download Manager 5.14 Build 5\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Users\HP\Desktop\Internet Download Manager 5.14 Build 5\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Users\HP\Desktop\Internet Download Manager 5.14 Build 5\IEGetVL.htm
O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{785CDC43-E30A-40E3-A205-6945E97FB745}: NameServer = 84.23.101.84 84.23.101.85
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: خدمة تحديث Google (gupdate1c9b5764468c0f0) (gupdate1c9b5764468c0f0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
--
End of file - 9605 bytes
--------------------------------------------------------------------------------------------------------------------------
وهذا التقرير بتاع SmitFraudFix :
SmitFraudFix v2.416
Scan done at 20:40:39.02, Sat 05/16/2009
Run from C:\Users\HP\Desktop\SmitfraudFix
OS: Microsoft Windows [Version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
::1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{785CDC43-E30A-40E3-A205-6945E97FB745}: NameServer=84.23.101.84 84.23.101.85
HKLM\SYSTEM\CS1\Services\Tcpip\..\{785CDC43-E30A-40E3-A205-6945E97FB745}: NameServer=84.23.101.84 84.23.101.85
HKLM\SYSTEM\CS2\Services\Tcpip\..\{1CD70A79-DEF4-4221-918F-7AC870410360}: DhcpNameServer=212.118.133.101 212.118.133.102
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1CD70A79-DEF4-4221-918F-7AC870410360}: DhcpNameServer=212.118.133.101 212.118.133.102
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.118.133.101 212.118.133.102
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
»»»»»»»»»»»»»»»»»»»»»»»» RK.2
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
--------------------------------------------------------------------------------------------------------------------------
وهذا التقرير بتاع ComboFix:
ComboFix 09-05-15.08 - HP 05/16/2009 21:19.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.966.1025.18.2046.1089 [GMT 3:00]
Running from: c:\users\HP\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Internet Security *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\kakle.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
c:\windows\system32\WS2Fix.exe
d:\$recycle.bin\Folder.htt
d:\$recycle.bin\protect.chinese hong kong
d:\$recycle.bin\protect.chinese simplified
d:\$recycle.bin\protect.chinese traditional
d:\$recycle.bin\protect.czech
d:\$recycle.bin\protect.danish
d:\$recycle.bin\protect.dutch
d:\$recycle.bin\Protect.ed
d:\$recycle.bin\protect.english
d:\$recycle.bin\protect.finnish
d:\$recycle.bin\protect.french
d:\$recycle.bin\protect.german
d:\$recycle.bin\protect.greek
d:\$recycle.bin\protect.hebrew
d:\$recycle.bin\protect.hungarian
d:\$recycle.bin\protect.italian
d:\$recycle.bin\protect.japanese
d:\$recycle.bin\protect.korean
d:\$recycle.bin\protect.norwegian
d:\$recycle.bin\protect.polish
d:\$recycle.bin\protect.portuguese brazilian
d:\$recycle.bin\protect.portuguese
d:\$recycle.bin\protect.russian
d:\$recycle.bin\protect.spanish
d:\$recycle.bin\protect.swedish
d:\$recycle.bin\protect.turkish
.
((((((((((((((((((((((((( Files Created from 2009-04-16 to 2009-05-16 )))))))))))))))))))))))))))))))
.
2009-05-16 17:41 . 2009-05-16 17:41 35 ----a-w c:\users\HP\AppData\Roaming\SetValue.bat
2009-05-16 17:41 . 2009-05-16 17:41 691 ----a-w c:\users\HP\AppData\Roaming\GetValue.vbs
2009-04-24 01:45 . 2009-05-16 17:36 -------- d-----w c:\users\HP\Tracing
2009-04-24 01:26 . 2009-04-24 01:26 -------- d-----w c:\program files\Microsoft Sync Framework
2009-04-24 01:24 . 2009-04-24 01:24 -------- d-----w c:\program files\Microsoft
2009-04-24 01:24 . 2009-04-24 01:24 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-21 21:53 . 2009-04-26 19:53 188416 ----a-w c:\windows\system32\ALOVideoFile.dll
2009-04-20 23:06 . 2009-04-20 23:06 -------- d-----w c:\program files\Western Digital
2009-04-19 22:14 . 2009-05-11 22:47 -------- d-----w c:\program files\Hotspot_Shield
2009-04-17 19:28 . 2008-12-06 04:42 376832 ----a-w c:\windows\system32\winhttp.dll
2009-04-17 19:28 . 2008-06-06 03:27 562176 ----a-w c:\windows\system32\msdtcprx.dll
2009-04-17 19:28 . 2008-06-06 03:27 38912 ----a-w c:\windows\system32\xolehlp.dll
2009-04-17 19:28 . 2009-03-03 04:39 551424 ----a-w c:\windows\system32\rpcss.dll
2009-04-17 19:28 . 2009-03-03 04:46 3599328 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-04-17 19:28 . 2009-03-03 04:46 3547632 ----a-w c:\windows\system32\ntoskrnl.exe
2009-04-17 19:27 . 2009-03-03 03:04 666624 ----a-w c:\windows\system32\printfilterpipelinesvc.exe
2009-04-17 19:27 . 2009-03-03 04:39 26112 ----a-w c:\windows\system32\printfilterpipelineprxy.dll
2009-04-17 19:27 . 2009-03-03 04:39 183296 ----a-w c:\windows\system32\sdohlp.dll
2009-04-17 19:27 . 2009-03-03 04:37 98304 ----a-w c:\windows\system32\iasrecst.dll
2009-04-17 19:27 . 2009-03-03 04:37 44032 ----a-w c:\windows\system32\iasdatastore.dll
2009-04-17 19:27 . 2009-03-03 04:37 54784 ----a-w c:\windows\system32\iasads.dll
2009-04-17 19:27 . 2009-03-03 02:38 17408 ----a-w c:\windows\system32\iashost.exe
2009-04-17 19:27 . 2009-02-13 08:49 1255936 ----a-w c:\windows\system32\lsasrv.dll
2009-04-17 19:27 . 2009-02-13 08:49 72704 ----a-w c:\windows\system32\secur32.dll
2009-04-17 19:27 . 2009-03-17 03:38 13824 ----a-w c:\windows\system32\apilogen.dll
2009-04-17 19:27 . 2009-03-17 03:38 24064 ----a-w c:\windows\system32\amxread.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-16 17:59 . 2008-08-03 20:34 876576 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-16 17:44 . 2008-08-04 02:51 -------- d-----w c:\program files\Google
2009-05-16 17:37 . 2009-01-02 17:09 27554 ----a-w c:\users\All Users\nvModes.dat
2009-05-16 17:37 . 2009-01-02 17:09 27554 ----a-w c:\programdata\nvModes.dat
2009-05-16 12:00 . 2006-12-05 05:23 410550 ----a-w c:\windows\system32\perfc001.dat
2009-05-16 12:00 . 2006-12-05 05:23 1381180 ----a-w c:\windows\system32\perfh001.dat
2009-05-16 11:01 . 2008-08-03 20:34 8212 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-16 11:01 . 2008-08-03 20:34 4906528 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-16 11:01 . 2008-08-03 20:34 43604 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-16 11:00 . 2008-08-03 15:16 4132 ----a-w c:\windows\bthservsdp.dat
2009-05-15 10:41 . 2008-08-22 18:10 -------- d-----w c:\program files\Garena
2009-05-12 21:28 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-05-08 22:39 . 2008-08-04 10:42 -------- d-----w c:\program files\Warcraft III
2009-04-26 21:33 . 2008-08-03 17:47 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-26 19:54 . 2009-04-21 21:53 626688 ----a-w c:\windows\system32\agsaamh.dll
2009-04-26 19:54 . 2009-04-21 21:53 551424 ----a-w c:\windows\system32\agsaame.dll
2009-04-26 19:54 . 2009-04-21 21:53 544256 ----a-w c:\windows\system32\agsaamd.dll
2009-04-26 19:54 . 2009-04-21 21:53 538624 ----a-w c:\windows\system32\agsaamb.dll
2009-04-26 19:54 . 2009-04-21 21:53 331776 ----a-w c:\windows\system32\agsaama.dll
2009-04-26 19:54 . 2009-04-21 21:53 237568 ----a-w c:\windows\system32\lame_enc.dll
2009-04-26 19:54 . 2008-08-03 18:02 90112 ----a-w c:\windows\system32\agsaami.dll
2009-04-26 19:54 . 2008-08-03 18:02 2846720 ----a-w c:\windows\system32\agsaamj.dll
2009-04-26 19:54 . 2008-08-03 18:02 753664 ----a-w c:\windows\system32\agsaamg.dll
2009-04-26 19:54 . 2008-08-03 18:02 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-04-24 01:26 . 2008-08-03 17:47 -------- d-----w c:\program files\Windows Live
2009-04-23 02:50 . 2008-10-07 10:24 -------- d-----w c:\program files\Hotspot Shield
2009-04-22 11:38 . 2008-10-05 04:01 -------- d-----w c:\program files\Java
2009-04-21 21:53 . 2009-04-21 21:53 344064 ----a-w c:\windows\system32\dkll.dll
2009-04-21 21:53 . 2008-08-03 18:02 1986560 ----a-w c:\windows\system32\akll.dll
2009-04-21 21:53 . 2008-08-03 18:02 196608 ----a-w c:\windows\system32\maag.dll
2009-04-21 21:53 . 2008-08-03 18:02 1212416 ----a-w c:\windows\system32\ckll.dll
2009-04-21 21:53 . 2009-04-21 21:53 -------- d-----w c:\program files\Ozone
2009-04-03 19:07 . 2008-08-04 10:43 85343 ----a-w c:\windows\War3Unin.dat
2009-04-03 18:18 . 2009-02-24 16:47 33256 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-04-01 11:31 . 2009-04-01 11:31 -------- d-----w c:\program files\Common Files\Windows Live
2009-03-30 14:14 . 2009-03-30 14:09 -------- d-----w c:\program files\Mobily Connect Card
2009-03-09 02:19 . 2009-01-02 16:36 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-08 11:34 . 2009-05-02 13:22 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-05-02 13:22 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-05-02 13:22 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-05-02 13:22 109056 ----a-w c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-05-02 13:22 109568 ----a-w c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-05-02 13:22 132608 ----a-w c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-05-02 13:22 107520 ----a-w c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-05-02 13:22 107008 ----a-w c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-05-02 13:22 103936 ----a-w c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-05-02 13:22 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-05-02 13:22 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-05-02 13:22 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-05-02 13:22 66560 ----a-w c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-05-02 13:22 169472 ----a-w c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-05-02 13:22 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-05-02 13:22 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-05-02 13:22 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-05-02 13:22 156160 ----a-w c:\windows\system32\msls31.dll
2008-08-15 01:46 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHot1.dll" [2009-05-11 1883672]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2009-05-11 22:49 1883672 ----a-w c:\program files\Hotspot_Shield\tbHot1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHot1.dll" [2009-05-11 1883672]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHot1.dll" [2009-05-11 1883672]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-08 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"IDMan"="c:\users\HP\Desktop\Internet Download Manager 5.14 Build 5\IDMan.exe" [2008-09-15 2606512]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 174616]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-05 201992]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-28 185872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-03 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-03 92704]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-9-5 727592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4214128158-2371241959-386477393-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000002
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9A429C92-E9D1-4900-AD65-34A4013F6E5E}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{88808C85-4102-4E19-A388-E4AD5C6F5B3C}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"TCP Query User{2976340B-44A0-4A76-B0C7-86DA2536C3D4}c:\\program files\\warcraft iii\\war3.exe"= Disabled:UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{FA799FB5-8174-4BBC-982B-4B2AB4355703}c:\\program files\\warcraft iii\\war3.exe"= Disabled:TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{16CEF104-9AF9-4707-A02D-15161F6BD357}"= Disabled:UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{C6F19902-B561-4D95-892A-D7396EBC2B29}"= Disabled:TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{9B58640D-A77F-4DE1-B088-2C124B04DA7D}"= Disabled:UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{F30C1C37-FE61-4452-8252-ECF6D7081C87}"= Disabled:TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/08 18:29 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [26/03/08 13:10 20496]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [22/04/09 04:12 328752]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/09 17:53 226656]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\System32\drivers\hssdrv.sys [24/02/09 19:47 33256]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/08 19:02 26640]
S2 gupdate1c9b5764468c0f0;خدمة تحديث Google (gupdate1c9b5764468c0f0);c:\program files\Google\Update\GoogleUpdate.exe [05/04/09 01:39 133104]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [23/04/09 00:34 34352]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-16 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-04 22:39]
2009-05-16 c:\windows\Tasks\User_Feed_Synchronization-{7B05063A-60C3-4067-AB28-AC452153E047}.job
- c:\windows\system32\msfeedssync.exe [2009-05-02 11:31]
.
.
------- Supplementary Scan -------
.
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\users\HP\Desktop\Internet Download Manager 5.14 Build 5\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\users\HP\Desktop\Internet Download Manager 5.14 Build 5\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\users\HP\Desktop\Internet Download Manager 5.14 Build 5\IEGetVL.htm
TCP: {785CDC43-E30A-40E3-A205-6945E97FB745} = 84.23.101.84 84.23.101.85
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\mazist1y.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - component: c:\users\HP\AppData\Roaming\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\mazist1y.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-16 21:22
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-4214128158-2371241959-386477393-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ad,50,9c,66,e8,fc,6a,e3,2d,8e,9b,4a,6c,51,0f,88,65,4d,ac,c2,31,
1c,5b,49,a8,f9,86,b1,0c,b7,7f,67,a0,93,61,2c,ec,58,e7,aa,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-4214128158-2371241959-386477393-1000_Classes\CLSID\{94afe353-d624-437f-a7be-18460a0afb0e}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000062
"Therad"=dword:00000015
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,b5,23,51,ae,67,49,2d,8c,49,f8,e9,37,fe,92,47,73,72,ed,b3,bb,9a,10,\
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-05-16 21:25
ComboFix-quarantined-files.txt 2009-05-16 18:25
Pre-Run: 5,690,671,104 bytes free
Post-Run: 5,778,984,960 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=48 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48
319 --- E O F --- 2009-05-15 09:55
--------------------------------------------------------------------------------------------------------------------------
