تفضل عزيزي التقرير ..
ComboFix 09-04-25.A3 - Hasib 04/25/2009 23:31.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1015.579 [GMT 3:00]
Running from: c:\documents and settings\Hasib\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.
2009-04-25 09:58 . 2009-04-25 20:11 -------- d-----w C:\32788R22FWJFW.0.tmp
2009-04-18 09:49 . 2009-04-18 10:27 -------- d-----w c:\documents and settings\Hasib\Application Data\IEPro
2009-04-18 09:25 . 2009-04-18 10:26 -------- d-----w c:\documents and settings\Hasib\Application Data\SlipStream
2009-04-15 22:51 . 2009-03-27 06:58 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 22:51 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-15 22:51 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-14 11:03 . 2009-04-14 11:03 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-11 12:37 . 2009-04-11 12:37 -------- d-----w c:\program files\Windows Installer Clean Up
2009-03-30 19:51 . 2008-07-08 10:54 148496 ----a-w c:\windows\system32\drivers\74503988.sys
2009-03-27 04:17 . 2008-10-16 11:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-03-27 04:17 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-03-27 04:17 . 2008-10-16 11:06 208744 ----a-w c:\windows\system32\muweb.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 20:35 . 2008-10-31 10:35 -------- d-----w c:\documents and settings\Hasib\Application Data\DMCache
2009-04-25 20:09 . 2008-10-30 20:31 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-25 13:07 . 2008-11-04 12:00 6688 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-25 13:07 . 2008-11-04 12:00 720928 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-25 13:07 . 2008-11-04 12:00 3745312 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-25 13:07 . 2008-11-04 12:00 34532 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-21 22:18 . 2008-11-04 12:01 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-21 22:18 . 2008-11-04 12:01 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-20 21:17 . 2008-11-13 23:15 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-20 15:45 . 2008-11-13 23:15 -------- d-----w c:\program files\Your Uninstaller 2008
2009-04-20 15:45 . 2009-01-27 17:46 -------- d-----w c:\program files\MyVideoConverter
2009-04-18 10:32 . 2008-10-31 10:35 -------- d-----w c:\documents and settings\Hasib\Application Data\IDM
2009-04-14 11:03 . 2008-10-30 07:49 -------- d-----w c:\program files\Java
2009-04-11 12:44 . 2008-11-21 16:44 -------- d-----w c:\program files\MSN Messenger
2009-04-11 12:37 . 2008-11-21 16:32 -------- d-----w c:\program files\MSECACHE
2009-03-15 20:49 . 2009-01-06 17:54 -------- d-----w c:\documents and settings\Hasib\Application Data\uTorrent
2009-03-06 14:22 . 2004-05-23 11:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-04 23:25 . 2009-03-04 23:25 -------- d-----w c:\program files\LtUcx
2009-03-03 00:18 . 2004-05-23 11:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-03-01 23:10 . 2009-02-27 17:38 -------- d-----w c:\documents and settings\All Users\Application Data\Bluetooth
2009-03-01 23:06 . 2009-03-01 23:06 -------- d-----w c:\program files\IVT Corporation
2009-02-27 00:51 . 2009-02-27 00:51 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-02-20 18:09 . 2004-05-23 11:00 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-05-23 11:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-05-23 11:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-05-23 11:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-05-23 11:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-05-23 11:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 11:11 . 2004-05-23 11:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-05-23 11:00 2145280 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-05-23 11:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 19:59 . 2004-05-23 11:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-02-03 15:53 . 2009-02-03 15:53 268 ---ha-w C:\sqmdata18.sqm
2009-02-03 15:53 . 2009-02-03 15:53 244 ---ha-w C:\sqmnoopt18.sqm
2009-02-02 23:06 . 2009-02-02 22:56 0 ----a-w C:\temp.txt
2009-02-02 23:00 . 2009-02-02 22:56 1005 ----a-w C:\is.html
2008-10-30 07:46 . 2008-04-18 16:39 94632 ----a-w c:\documents and settings\Hasib\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( SnapShot@2009-04-25_00.07.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-25 20:09 . 2009-04-25 20:09 16384 c:\windows\temp\Perflib_Perfdata_428.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-11-19 2607616]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-14 148888]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-11 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-30 185896]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2008-11-21 190024]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\gprs.exe [2008-3-19 43608]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10853:TCP"= 10853:TCP:BitComet 10853 TCP
"10853:UDP"= 10853:UDP:BitComet 10853 UDP
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 is-4ST2Vdrv;is-4ST2Vdrv;c:\windows\system32\DRIVERS\78405922.sys [2008-07-08 148496]
R1 is-8V5G2drv;is-8V5G2drv;c:\windows\system32\DRIVERS\95546000.sys [2008-07-08 148496]
R1 is-EHTRUdrv;is-EHTRUdrv; [x]
R1 is-TJ5K6drv;is-TJ5K6drv;c:\windows\system32\DRIVERS\78546928.sys [2008-07-08 148496]
R2 vcs;vcs; [x]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-02-11 33808]
S1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2005-03-16 13696]
S1 is-18DQ4drv;is-18DQ4drv;c:\windows\system32\DRIVERS\40023248.sys [2008-07-08 148496]
S1 is-7EF2Mdrv;is-7EF2Mdrv;c:\windows\system32\DRIVERS\79400168.sys [2008-07-08 148496]
S1 is-H9ERFdrv;is-H9ERFdrv;c:\windows\system32\DRIVERS\74503988.sys [2008-07-08 148496]
S1 is-NML93drv;is-NML93drv;c:\windows\system32\DRIVERS\18762776.sys [2008-07-08 148496]
S1 is-V6IOBdrv;is-V6IOBdrv;c:\windows\system32\DRIVERS\82572999.sys [2008-07-08 148496]
S1 is-VUHDDdrv;is-VUHDDdrv;c:\windows\system32\DRIVERS\62091736.sys [2008-07-08 148496]
S2 Start BT in service;Start BT in service;c:\program files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe [2008-03-19 51816]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Hasib\Application Data\Mozilla\Firefox\Profiles\r92hxn97.default\
FF - prefs.js: network.proxy.type - 2
FF - component: c:\documents and settings\Hasib\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-25 23:35
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2052111302-1592454029-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*N]
@Class="Shell"
[HKEY_USERS\S-1-5-21-2052111302-1592454029-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*N\OpenWithList]
@Class="Shell"
"a"="IDMan.exe"
"MRUList"="bdca"
"b"="mplayerc.exe"
"c"="realplay.exe"
"d"="wmplayer.exe"
[HKEY_USERS\S-1-5-21-2052111302-1592454029-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*N\OpenWithProgids]
"َ_auto_file"=hex(0):
[HKEY_LOCAL_MACHINE\software\Classes\.*N]
@="َ_auto_file"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e5,9e,ac,04,61,60,7b,1d,ba,79,ac,55,36,96,1c,60,77,37,07,94,67,
0b,22,a3,53,e0,d1,fb,35,ee,a8,1c,d9,f0,d5,ff,1d,8a,87,94,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{995a7c22-eece-4aad-8e11-b25ae63b82e2}]
@Denied: (Full) (Everyone)
"Model"=dword:0000004f
"Therad"=dword:00000016
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{f543a073-8429-4e0c-abe8-fd5a1064582c}]
@Denied: (Full) (Everyone)
"Model"=dword:00000143
"Therad"=dword:00000014
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(400)
c:\program files\MessengerPlus! 3\MsgPlusLoader.dll
.
Completion time: 2009-04-25 23:38
ComboFix-quarantined-files.txt 2009-04-25 20:38
ComboFix2.txt 2009-04-25 00:11
ComboFix3.txt 2008-12-15 23:03
ComboFix4.txt 2008-11-13 21:26
Pre-Run: 576,651,264 bytes free
Post-Run: 592,257,024 bytes free
207 --- E O F --- 2009-04-24 23:15
عذرا على التاخير .,
