هذا هو التقرير :
ComboFix 09-04-25.A1 - User 04/25/2009 18:57.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.503.331 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\ej10fkdo.bat
C:\em8tqm.cmd
C:\gyn.cmd
C:\i.cmd
C:\jm3cx96.bat
C:\minm.cmd
c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013
c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
C:\upw.bat
C:\uxkl0apt.bat
D:\ej10fkdo.bat
D:\em8tqm.cmd
D:\gyn.cmd
D:\i.cmd
D:\jm3cx96.bat
D:\minm.cmd
D:\sq.com
D:\u.com
D:\upw.bat
D:\uxkl0apt.bat
.
---- Previous Run -------
.
C:\sq.com
C:\u.com
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
.
((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-4-26 )))))))))))))))))))))))))))))))
.
2009-04-26 00:54 . 2009-04-26 00:54 -------- d-sha-r C:\autorun.inf
2009-04-25 16:01 . 2009-04-25 16:00 106749 --sh--r C:\npee.com
2009-04-23 03:52 . 2009-04-23 03:52 108169 --sh--r C:\husyu8n.exe
2009-04-22 00:44 . 2009-04-22 02:20 -------- d-----w c:\documents and settings\Administrator.ابوجنة\Local Settings\Application Data\Microsoft
2009-04-22 00:44 . 2009-04-22 02:20 -------- d-s---w c:\documents and settings\Administrator.ابوجنة
2009-04-22 00:37 . 2009-04-22 02:20 -------- d-----w C:\RECYCLER(2)
2009-04-21 16:26 . 2009-04-23 04:06 109601 --sh--r C:\g1ljsm.com
2009-04-21 15:55 . 2009-04-22 16:00 109249 --sh--r C:\
0xuc.com
2009-04-20 15:45 . 2009-04-20 15:44 109163 --sh--r C:\qwtb.com
2009-04-16 18:35 . 2009-04-22 02:22 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-04-16 02:50 . 2009-04-16 02:50 -------- d-----w c:\documents and settings\tazebama.dl_
2009-04-16 02:26 . 2009-04-21 16:25 -------- d-----w c:\documents and settings\User\Application Data\Antispyware
2009-04-14 16:26 . 2009-04-14 16:26 -------- d-----w c:\documents and settings\All Users\Application Data\SweetIM
2009-04-14 15:51 . 2009-04-17 15:53 109163 --sh--r C:\1ogf.exe
2009-04-10 15:48 . 2009-04-10 15:48 110157 --sh--r C:\cqxj.exe
2009-04-08 15:49 . 2009-04-08 15:49 108083 --sh--r C:\o3n9k.com
2009-04-04 15:52 . 2009-04-07 15:54 108693 --sh--r C:\
0bcobed.exe
2009-04-02 01:01 . 2008-07-13 06:11 13312 ----a-w c:\windows\system\setup.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 01:23 . 2009-04-26 01:23 192 ----a-w C:\BcBtRmv.log
2009-04-25 16:10 . 2009-02-03 02:14 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-25 16:00 . 2009-03-25 02:16 -------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-04-22 03:49 . 2009-04-22 03:48 -------- d-----w c:\program files\Kaspersky Lab
2009-04-22 03:41 . 2009-04-22 03:40 441 ------w C:\Win32.Worm.Downladup.Gen.log
2009-04-22 01:28 . 2009-04-22 01:33 658 ----a-w c:\program files\wga.zip
2009-04-16 05:08 . 2009-03-04 15:20 -------- d-----w c:\documents and settings\User\Application Data\Skype
2009-04-14 16:26 . 2009-04-14 16:26 -------- d-----w c:\program files\SweetIM
2009-03-29 18:27 . 2009-02-24 17:21 -------- d-----w c:\documents and settings\User\Application Data\DMCache
2009-03-25 19:06 . 2009-01-22 13:20 -------- d-----w c:\program files\Google
2009-03-23 21:08 . 2009-03-22 15:58 111435 --sh--r C:\luk1ylq.com
2009-03-17 15:55 . 2009-03-17 15:55 108313 --sh--r C:\cb.exe
2009-03-14 23:24 . 2009-03-14 23:24 108446 --sh--r C:\i.com
2009-03-04 17:17 . 2009-03-04 17:17 -------- d-----w c:\program files\Windows Live Safety Center
2009-03-04 14:40 . 2009-02-20 12:56 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-03-04 08:00 . 2009-02-20 13:02 -------- d-----w c:\documents and settings\User\Application Data\skypePM
2009-03-03 18:02 . 2009-01-22 13:21 -------- d-----w c:\program files\VideoLAN
2009-03-03 18:01 . 2009-02-23 14:11 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-03-03 17:59 . 2009-02-23 13:53 -------- d-----w c:\program files\PC Shower 2009
2009-03-03 17:58 . 2009-02-27 18:00 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-03-03 17:56 . 2009-03-03 17:56 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-03-03 06:53 . 2009-02-27 18:02 -------- d-----w c:\documents and settings\User\Application Data\Apple Computer
2009-03-02 14:06 . 2009-02-25 15:57 -------- d-----w c:\program files\Yahoo!
2009-03-01 16:13 . 2009-03-01 16:04 -------- d-----w c:\documents and settings\User\Application Data\ADPHONE
2009-03-01 06:33 . 2009-03-01 06:31 -------- d-----w c:\documents and settings\User\Application Data\ObjCakeLite
2009-03-01 06:32 . 2009-03-01 06:32 -------- d-----w c:\documents and settings\All Users\Application Data\Bags Plus Online Chin
2009-03-01 06:31 . 2009-03-01 06:31 -------- d-----w c:\program files\ObjCakeLite
2009-03-01 06:29 . 2009-03-01 06:29 -------- d-----w c:\program files\Circle Dvelopement
2009-03-01 06:29 . 2009-01-24 23:23 -------- d-----w c:\program files\Messenger Plus! Live
2009-03-01 06:29 . 2009-01-22 12:34 -------- d-----w c:\program files\MSN Messenger
2009-02-28 14:34 . 2009-02-28 14:27 -------- d-----w c:\program files\Super Internet TV
2009-02-28 14:29 . 2009-02-28 14:29 -------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2009-02-27 07:37 . 2009-02-27 07:37 510 ----a-w C:\updatedatfix.log
2009-02-27 07:37 . 2009-01-22 16:11 -------- d-----w c:\program files\HP
2009-02-27 07:19 . 2009-02-27 07:19 127 ----a-w c:\documents and settings\User\Local Settings\Application Data\fusioncache.dat
2009-02-27 07:19 . 2009-01-22 16:09 60168 ----a-w c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-27 07:16 . 2009-02-27 07:00 109191 ----a-w c:\windows\hpoins08.dat
2009-02-27 07:14 . 2009-02-27 07:14 -------- d-----w c:\documents and settings\All Users\Application Data\HP
2009-02-27 07:12 . 2009-02-27 07:12 -------- d-----w c:\documents and settings\All Users\Application Data\Sonic
2009-02-27 07:12 . 2009-02-27 07:12 -------- d-----w c:\program files\Common Files\Sonic Shared
2009-02-27 07:11 . 2009-02-27 07:11 -------- d-----w c:\program files\Common Files\HP
2009-02-25 15:57 . 2009-02-25 15:57 -------- d-----w c:\program files\CCleaner
2008-08-17 21:28 . 2009-04-21 13:51 2682284 ----a-w c:\program files\ComboFix.rar
2008-08-11 09:31 . 2009-04-22 03:42 2710230 ----a-w c:\program files\ComboFix.exe
2007-11-01 05:49 . 2009-04-22 00:47 326533 ----a-w c:\program files\Microsoft%100Genuine.zip
2009-01-09 01:56 . 2009-03-23 21:18 30989 --sh--r c:\windows\imageviewer.exe
2004-08-03 22:56 . 2004-08-03 22:56 84320 --sha-r c:\windows\system32\jjxkzozc.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 19:22 1172792 ----a-w c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"msnmsgr"="~c:\program files\MSN Messenger\msnmsgr.exe" [BU]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-21 39408]
"Keepante"="c:\docume~1\User\APPLIC~1\OBJCAK~1\soft2site.exe" [2009-03-01 610304]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"cdoosoft"="c:\windows\system32\olhrwef.exe" [BU]
"Antispyware"="c:\program files\Antispyware\Antispyware.exe" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-22 185872]
"Online chin internet bolt"="c:\documents and settings\All Users\Application Data\Bags Plus Online Chin\online defy.exe" [2009-04-26 765952]
"manager"="c:\windows\system\setup.exe" [2008-07-13 13312]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-03-06 111928]
"Windows Image Viewer Service"="imageviewer.exe" - c:\windows\imageviewer.exe [2009-01-09 30989]
"SystemInit"="" [BU]
"Karen"="" [BU]
"raVe"="" [BU]
"SystemBackup"="" [BU]
"Win32BaseServiceMOD"="" [BU]
"startIE"="" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ADPHONE"=c:\program files\ADPHONE3\ADPHONE.EXE /STARTUP
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\English\\setup.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6356:TCP"= 6356:TCP:medjh
R2 rdmvfh;Monitor Shell;c:\windows\system32\svchost.exe [2004-08-03 14336]
R3 autorun;autorun;C:\huadio.tmp [2009-01-22 5311]
R3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-08-23 18688]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
rdmvfh
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13ad7400-081a-11de-8835-000b6a9d570d}]
\Shell\AutoRun\command - g:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
\Shell\open\command - g:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5ad43e97-081e-11de-8836-000b6a9d570d}]
\Shell\AutoRun\command - e:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
\Shell\open\command - e:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94be46f1-245d-11de-887f-000b6a9d570d}]
\Shell\AutoRun\command - e:\driver\usb\driver.exe
\Shell\open\command - e:\driver\usb\driver.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aff93302-0bdb-11de-8843-000b6a9d570d}]
\Shell\AutoRun\command - e:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
\Shell\open\command - e:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9762662-ea6d-11dd-87d6-000b6a9d570d}]
\Shell\AutoRun\command - e:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
\Shell\open\command - e:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\lusrsh.exe
.
Contents of the 'Scheduled Tasks' folder
2009-04-26 c:\windows\Tasks\A529F19091926BB0.job
- c:\docume~1\user\applic~1\objcak~1\KnobOnlineSupport.exe [2009-03-01 06:33]
2009-04-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-20 20:42]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.jadide4all.ift.fr
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://home.sweetim.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\8334nqiu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - SweetIM Search
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-25 18:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\C:\huadio.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\rdmvfh]
"ServiceDll"="c:\windows\system32\jjxkzozc.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1957994488-1644491937-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="a"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(536)
c:\windows\system32\antiwpa.dll
- - - - - - - > 'lsass.exe'(596)
c:\windows\system32\imon.dll
.
Completion time: 2009-04-26 19:01
ComboFix-quarantined-files.txt 2009-04-26 02:00
ComboFix2.txt 2009-04-21 16:17
ComboFix3.txt 2009-04-21 14:30
Pre-Run: 34,439,229,440 bytes free
Post-Run: 34,439,487,488 bytes free
286 --- E O F --- 2009-01-29 09:52
