السلام عليكم ورحمة الله وبركاته
اليوم عندي جهاز دمرااااان ورايح فيها
وخاصه انه مو راضي يحمل ولا برنامج حمايه
اتوقع انه فيه فايرس ياكل امتدادات EXE
ونا عملت تقرير وصلحت كل السلبيات الي فيه بس المشكله مستمره
الحين حملت برنامج ComboFix
وفي عملية الفحص طلعتلي اكثر من خمس مرات كلمة تم التعطير من قبل المسئول
في مربع والفت انتباهكم انه ما عمل رستارت في عملية الفحص
وهذا هو التقرير وارجو اني ما طولت عليكم
ComboFix 09-05-03.3 - kuz 05/04/2009 15:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.503.236 [GMT 3:00]
Running from: c:\documents and settings\kuz\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
AV: Twister AntiTrojanVirus *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\documents and settings\kuz\Application Data\tazebama
c:\documents and settings\kuz\Application Data\tazebama\tazebama.log
c:\documents and settings\kuz\Application Data\tazebama\zPharaoh.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\autorun.ini
c:\windows\system32\kakle.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
C:\zPharaoh.exe
D:\Autorun.inf
d:\recycler\Office2003 CD-Key.doc.exe
d:\recycler\RECYCLER .exe
D:\zPharaoh.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.
2009-05-03 19:09 . 2009-05-04 11:55 32768 ----a-w c:\documents and settings\tazebama.dll
2009-05-03 17:21 . 2009-05-04 11:50 -------- d-----w c:\program files\Common Files\Filseclab
2009-05-03 17:21 . 2009-05-03 17:21 -------- d-----w c:\program files\Filseclab
2009-05-03 17:21 . 2009-05-03 17:21 -------- d-----w c:\documents and settings\kuz\Application Data\InstallShield
2009-05-03 17:01 . 2009-05-03 17:01 -------- d-----w c:\documents and settings\kuz\Application Data\Malwarebytes
2009-05-03 17:00 . 2009-05-03 17:00 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 15:16 . 2009-05-03 17:53 -------- d-----w c:\program files\LtUcx
2009-05-03 14:50 . 2009-05-03 14:50 -------- d-----w c:\windows\Sun
2009-05-03 13:35 . 2009-05-03 13:35 -------- d-----w c:\documents and settings\kuz\Application Data\URSoft
2009-05-03 13:35 . 2009-05-03 13:36 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-03 13:35 . 2009-05-03 13:35 -------- d-----w c:\program files\Your Uninstaller 2006
2009-05-03 13:08 . 2009-05-03 13:08 -------- d-----w c:\windows\system32\LogFiles
2009-05-03 12:40 . 2009-05-03 12:05 108194 --sh--r C:\fbak.exe
2009-04-30 22:40 . 2009-05-03 14:59 102400 ----a-w c:\documents and settings\MyDocuments\readthis.doc.exe
2009-04-30 22:40 . 2009-04-30 22:40 -------- d-----w c:\documents and settings\MyDocuments
2009-04-30 22:40 . 2009-05-03 14:59 102400 ----a-w c:\documents and settings\MyDocuments\Readme.doc .exe
2009-04-28 01:20 . 2004-08-03 21:55 221184 ----a-w c:\windows\system32\wmpns.dll
2009-04-27 23:52 . 2009-04-27 23:52 -------- d-----w c:\documents and settings\SYSTEM
2009-04-27 19:46 . 2009-04-27 19:46 -------- d-----w c:\documents and settings\kuz\Application Data\Media Player Classic
2009-04-27 06:48 . 2009-04-28 11:14 -------- d-----w c:\documents and settings\kuz\Application Data\dvdcss
2009-04-23 11:14 . 2009-04-23 11:14 -------- d-----w c:\documents and settings\All Users\Application Data\LightScribe
2009-04-23 06:48 . 2004-08-03 20:10 38016 ----a-w c:\windows\system32\drivers\bthmodem.sys
2009-04-23 05:54 . 2009-04-23 05:54 -------- d-s---w c:\documents and settings\kuz\UserData
2009-04-23 05:49 . 2009-04-23 05:49 -------- d-----w c:\documents and settings\kuz\Local Settings\Application Data\Winamp Toolbar
2009-04-23 05:08 . 2009-04-23 05:08 -------- d-----w c:\documents and settings\kuz\Phone Browser
2009-04-22 23:43 . 2009-04-22 23:43 -------- d-----w c:\documents and settings\kuz\Application Data\COWON
2009-04-22 21:34 . 2009-04-22 21:34 -------- d-----w c:\documents and settings\kuz\Application Data\GRETECH
2009-04-22 21:34 . 2009-04-22 21:34 -------- d-----w c:\documents and settings\kuz\Application Data\Nokia Multimedia Player
2009-04-22 21:12 . 2009-04-22 21:12 -------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-04-22 21:12 . 2009-04-22 21:12 -------- d-----w c:\documents and settings\kuz\Application Data\vlc
2009-04-22 21:10 . 2009-04-22 21:10 -------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-04-22 21:10 . 2009-04-22 21:10 -------- d-----w c:\documents and settings\kuz\Application Data\GameHouse
2009-04-22 21:10 . 2009-04-22 21:10 -------- d-----w c:\program files\GameHouse
2009-04-22 21:09 . 2009-04-22 21:09 -------- d-----w c:\documents and settings\kuz\Local Settings\Application Data\Conduit
2009-04-22 21:09 . 2009-04-22 21:09 -------- d-----w c:\documents and settings\kuz\Local Settings\Application Data\Hotspot_Shield
2009-04-22 21:07 . 2009-04-22 21:24 877568 ----a-w c:\windows\system32\ALOAudioFile2.dll
2009-04-22 21:07 . 2009-04-22 21:24 626688 ----a-w c:\windows\system32\agsaamh.dll
2009-04-22 21:07 . 2009-04-22 21:24 2846720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
2009-04-22 21:07 . 2009-04-22 21:24 778240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
2009-04-22 21:07 . 2009-04-22 21:24 551424 ----a-w c:\windows\system32\agsaame.dll
2009-04-22 21:07 . 2009-04-22 21:24 544256 ----a-w c:\windows\system32\agsaamd.dll
2009-04-22 21:07 . 2009-04-22 21:24 538624 ----a-w c:\windows\system32\agsaamb.dll
2009-04-22 21:07 . 2009-04-22 21:24 331776 ----a-w c:\windows\system32\agsaama.dll
2009-04-22 21:07 . 2006-07-28 22:22 51712 ----a-w c:\windows\system32\coodest.dll
2009-04-22 21:07 . 2006-11-06 12:30 262144 ----a-w c:\windows\system32\lame_enc.dll
2009-04-22 21:07 . 2005-05-19 00:17 40960 ----a-w c:\windows\system32\osenxpsuite2005.dll
2009-04-22 21:07 . 2009-04-22 21:07 -------- d-----w c:\program files\Ozone
2009-04-22 21:06 . 2009-04-22 21:06 -------- d-----w c:\program files\MP3 Remix
2009-04-22 21:04 . 2009-04-22 21:04 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-22 21:01 . 2009-04-22 21:01 -------- d-----w c:\program files\Conduit
2009-04-22 21:01 . 2009-04-22 21:10 -------- d-----w c:\program files\Hotspot_Shield
2009-04-22 21:00 . 2009-04-22 21:01 -------- d-----w c:\program files\Hotspot Shield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 12:01 . 2009-04-22 18:00 6 ---ha-w c:\windows\Tasks\SA.DAT
2009-05-04 11:58 . 2001-09-19 12:00 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-04 11:58 . 2001-09-19 12:00 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-04 11:50 . 2009-04-22 18:40 203631 ----a-w c:\windows\AKDeInstall.exe
2009-05-03 19:05 . 2009-04-22 18:33 -------- d-----w c:\program files\Kaspersky Lab
2009-05-03 18:01 . 2009-04-22 19:04 -------- d-----w c:\program files\Real_SC
2009-05-03 17:36 . 2009-04-22 20:33 -------- d-----w c:\program files\Winamp
2009-05-03 17:21 . 2009-04-22 18:10 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-03 13:07 . 2009-04-22 19:03 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-03 13:07 . 2009-04-22 19:00 -------- d-----w c:\program files\Media Player Classic Arabic
2009-05-03 13:07 . 2009-04-22 18:45 -------- d-----w c:\program files\JetAudio
2009-05-03 13:07 . 2009-04-22 18:41 -------- d-----w c:\program files\Google
2009-05-03 13:07 . 2009-04-22 19:53 -------- d-----w c:\program files\Common Files\LightScribe
2009-05-03 13:07 . 2009-04-22 19:03 -------- d-----w c:\program files\Circle Developement
2009-05-03 12:56 . 2009-04-22 18:07 266240 ----a-w c:\windows\system32\igfxtray.exe
2009-04-29 02:02 . 2009-04-27 19:38 370 ----a-w c:\windows\Tasks\At1.job
2009-04-23 06:40 . 2009-04-22 17:55 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-22 21:08 . 2009-04-22 21:08 98304 ----a-w c:\windows\system32\viscomtran.dll
2009-04-22 20:59 . 2009-04-22 20:59 0 ----a-w c:\windows\nsreg.dat
2009-04-22 20:34 . 2009-04-22 20:34 -------- d-----w c:\program files\Winamp Toolbar
2009-04-22 19:50 . 2009-04-22 19:28 -------- d-----w c:\program files\Common Files\Ahead
2009-04-22 19:28 . 2009-04-22 19:28 -------- d-----w c:\program files\Nero
2009-04-22 19:12 . 2009-04-22 19:11 -------- d-----w c:\program files\Common Files\Nokia
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\Common Files\PCSuite
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\Nokia
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\DIFX
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\PC Connectivity Solution
2009-04-22 19:04 . 2009-04-22 19:04 -------- d-----w c:\program files\VideoLAN
2009-04-22 19:03 . 2009-04-22 19:03 -------- d-----w c:\program files\BLEH IDLE WAIT
2009-04-22 19:03 . 2009-04-22 19:03 -------- d-----w c:\program files\Windows Live
2009-04-22 19:03 . 2009-04-22 18:48 -------- d-----w c:\program files\MSN Messenger
2009-04-22 19:01 . 2009-04-22 18:02 94632 ----a-w c:\documents and settings\kuz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 18:53 . 2009-04-22 18:53 -------- d-----w c:\program files\Common Files\xing shared
2009-04-22 18:53 . 2009-04-22 18:52 -------- d-----w c:\program files\Real
2009-04-22 18:53 . 2009-04-22 18:52 -------- d-----w c:\program files\Common Files\Real
2009-04-22 18:52 . 2009-04-22 18:52 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-22 18:52 . 2009-04-22 18:52 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-22 18:51 . 2009-04-22 18:51 2232 ----a-w c:\windows\java\Packages\Data\V9JFDZRN.DAT
2009-04-22 18:51 . 2009-04-22 18:51 155995 ----a-w c:\windows\java\Packages\2JB577L7.ZIP
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\AIE1JTJT.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\OGVJLV7V.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\DZ5NN3ZP.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\SYVPVDFT.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\2LNHNDZD.DAT
2009-04-22 18:45 . 2009-04-22 18:45 -------- d-----w c:\program files\Common Files\COWON
2009-04-22 18:42 . 2009-04-22 18:42 -------- d-----w c:\program files\Java
2009-04-22 18:42 . 2009-04-22 18:42 -------- d-----w c:\program files\Common Files\Java
2009-04-22 18:41 . 2009-04-22 18:41 -------- d-----w c:\program files\GRETECH
2009-04-22 18:40 . 2009-04-22 18:40 -------- d-----w c:\program files\mpegable
2009-04-22 18:23 . 2009-04-22 18:23 -------- d-----w c:\program files\Microsoft.NET
2009-04-22 18:22 . 2009-04-22 18:22 -------- d-----w c:\program files\Microsoft Works
2009-04-22 18:12 . 2009-04-22 18:12 -------- d-----w c:\program files\CONEXANT
2009-04-22 18:12 . 2009-04-22 18:12 -------- d-----w c:\program files\SigmaTel
2009-04-22 18:12 . 2009-04-22 18:10 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-22 17:56 . 2009-04-22 17:56 -------- d-----w c:\program files\microsoft frontpage
2009-04-22 17:55 . 2001-09-19 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-04-22 17:52 . 2009-04-22 17:52 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-20 18:50 . 2009-03-20 18:50 3358720 ----a-w c:\windows\system32\GPhotos.scr
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2008-06-24 20:17 1569304 ----a-w c:\program files\Hotspot_Shield\tbHots.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Filseclab Messenger.lnk - c:\program files\Common Files\Filseclab\FilMsg.exe [2009-5-3 549743]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-4-22 188416]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\Nero\\Nero 7\\InCD\\NBHGui.exe"=
"c:\\Program Files\\Your Uninstaller 2006\\uruninstaller.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\PC Connectivity Solution\\NclInstaller.exe"=
"c:\\WINDOWS\\stsystra.exe"=
"c:\\Program Files\\WinRAR\\WinRAR.exe"=
"c:\\Program Files\\Nero\\Nero 7\\InCD\\InCD.exe"=
"c:\\Program Files\\WinZip\\WINZIP32.EXE"=
"c:\\PROGRA~1\\WINZIP\\winzip32.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
R3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-08-17 18688]
R3 filpp;Filseclab Process Protection Driver;c:\progra~1\COMMON~1\FILSEC~1\filpp.sys [2008-12-21 9776]
R3 IMMDRV;Filseclab Twister Kernel Module;c:\progra~1\FILSEC~1\Twister\immdrv.sys [2007-11-26 151952]
S1 filar;Filseclab Dynamic Defense System Driver;c:\progra~1\COMMON~1\FILSEC~1\filar.sys [2007-12-18 10896]
S3 abp470n5;abp470n5; [x]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14095bc5-3351-11de-ad9e-0015c56b081b}]
\Shell\AutoRun\command - F:\g2pfnid.com
\Shell\explore\Command - F:\g2pfnid.com
\Shell\open\Command - F:\g2pfnid.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92cb81a5-2fc8-11de-ad95-0015c56b081b}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8a99d3e-3426-11de-ada6-0015c56b081b}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd7cf247-2f7b-11de-ad8d-001f81000100}]
\Shell\AutoRun\command - G:\zPharaoh.exe
\Shell\explore\command - G:\zPharaoh.exe
\Shell\open\command - G:\zPharaoh.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\kuz\Application Data\Mozilla\Firefox\Profiles\xeihbrdv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJPI142_06.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-04 15:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-04 15:05
ComboFix-quarantined-files.txt 2009-05-04 12:05
Pre-Run: 15,303,974,912 bytes free
Post-Run: 15,435,513,856 bytes free
255
اليوم عندي جهاز دمرااااان ورايح فيها
وخاصه انه مو راضي يحمل ولا برنامج حمايه
اتوقع انه فيه فايرس ياكل امتدادات EXE
ونا عملت تقرير وصلحت كل السلبيات الي فيه بس المشكله مستمره
الحين حملت برنامج ComboFix
وفي عملية الفحص طلعتلي اكثر من خمس مرات كلمة تم التعطير من قبل المسئول
في مربع والفت انتباهكم انه ما عمل رستارت في عملية الفحص
وهذا هو التقرير وارجو اني ما طولت عليكم
ComboFix 09-05-03.3 - kuz 05/04/2009 15:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.503.236 [GMT 3:00]
Running from: c:\documents and settings\kuz\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
AV: Twister AntiTrojanVirus *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\documents and settings\kuz\Application Data\tazebama
c:\documents and settings\kuz\Application Data\tazebama\tazebama.log
c:\documents and settings\kuz\Application Data\tazebama\zPharaoh.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\autorun.ini
c:\windows\system32\kakle.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
C:\zPharaoh.exe
D:\Autorun.inf
d:\recycler\Office2003 CD-Key.doc.exe
d:\recycler\RECYCLER .exe
D:\zPharaoh.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.
2009-05-03 19:09 . 2009-05-04 11:55 32768 ----a-w c:\documents and settings\tazebama.dll
2009-05-03 17:21 . 2009-05-04 11:50 -------- d-----w c:\program files\Common Files\Filseclab
2009-05-03 17:21 . 2009-05-03 17:21 -------- d-----w c:\program files\Filseclab
2009-05-03 17:21 . 2009-05-03 17:21 -------- d-----w c:\documents and settings\kuz\Application Data\InstallShield
2009-05-03 17:01 . 2009-05-03 17:01 -------- d-----w c:\documents and settings\kuz\Application Data\Malwarebytes
2009-05-03 17:00 . 2009-05-03 17:00 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 15:16 . 2009-05-03 17:53 -------- d-----w c:\program files\LtUcx
2009-05-03 14:50 . 2009-05-03 14:50 -------- d-----w c:\windows\Sun
2009-05-03 13:35 . 2009-05-03 13:35 -------- d-----w c:\documents and settings\kuz\Application Data\URSoft
2009-05-03 13:35 . 2009-05-03 13:36 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-03 13:35 . 2009-05-03 13:35 -------- d-----w c:\program files\Your Uninstaller 2006
2009-05-03 13:08 . 2009-05-03 13:08 -------- d-----w c:\windows\system32\LogFiles
2009-05-03 12:40 . 2009-05-03 12:05 108194 --sh--r C:\fbak.exe
2009-04-30 22:40 . 2009-05-03 14:59 102400 ----a-w c:\documents and settings\MyDocuments\readthis.doc.exe
2009-04-30 22:40 . 2009-04-30 22:40 -------- d-----w c:\documents and settings\MyDocuments
2009-04-30 22:40 . 2009-05-03 14:59 102400 ----a-w c:\documents and settings\MyDocuments\Readme.doc .exe
2009-04-28 01:20 . 2004-08-03 21:55 221184 ----a-w c:\windows\system32\wmpns.dll
2009-04-27 23:52 . 2009-04-27 23:52 -------- d-----w c:\documents and settings\SYSTEM
2009-04-27 19:46 . 2009-04-27 19:46 -------- d-----w c:\documents and settings\kuz\Application Data\Media Player Classic
2009-04-27 06:48 . 2009-04-28 11:14 -------- d-----w c:\documents and settings\kuz\Application Data\dvdcss
2009-04-23 11:14 . 2009-04-23 11:14 -------- d-----w c:\documents and settings\All Users\Application Data\LightScribe
2009-04-23 06:48 . 2004-08-03 20:10 38016 ----a-w c:\windows\system32\drivers\bthmodem.sys
2009-04-23 05:54 . 2009-04-23 05:54 -------- d-s---w c:\documents and settings\kuz\UserData
2009-04-23 05:49 . 2009-04-23 05:49 -------- d-----w c:\documents and settings\kuz\Local Settings\Application Data\Winamp Toolbar
2009-04-23 05:08 . 2009-04-23 05:08 -------- d-----w c:\documents and settings\kuz\Phone Browser
2009-04-22 23:43 . 2009-04-22 23:43 -------- d-----w c:\documents and settings\kuz\Application Data\COWON
2009-04-22 21:34 . 2009-04-22 21:34 -------- d-----w c:\documents and settings\kuz\Application Data\GRETECH
2009-04-22 21:34 . 2009-04-22 21:34 -------- d-----w c:\documents and settings\kuz\Application Data\Nokia Multimedia Player
2009-04-22 21:12 . 2009-04-22 21:12 -------- d-----w c:\documents and settings\All Users\Application Data\MumboJumbo
2009-04-22 21:12 . 2009-04-22 21:12 -------- d-----w c:\documents and settings\kuz\Application Data\vlc
2009-04-22 21:10 . 2009-04-22 21:10 -------- d-----w c:\documents and settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2009-04-22 21:10 . 2009-04-22 21:10 -------- d-----w c:\documents and settings\kuz\Application Data\GameHouse
2009-04-22 21:10 . 2009-04-22 21:10 -------- d-----w c:\program files\GameHouse
2009-04-22 21:09 . 2009-04-22 21:09 -------- d-----w c:\documents and settings\kuz\Local Settings\Application Data\Conduit
2009-04-22 21:09 . 2009-04-22 21:09 -------- d-----w c:\documents and settings\kuz\Local Settings\Application Data\Hotspot_Shield
2009-04-22 21:07 . 2009-04-22 21:24 877568 ----a-w c:\windows\system32\ALOAudioFile2.dll
2009-04-22 21:07 . 2009-04-22 21:24 626688 ----a-w c:\windows\system32\agsaamh.dll
2009-04-22 21:07 . 2009-04-22 21:24 2846720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
2009-04-22 21:07 . 2009-04-22 21:24 778240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
2009-04-22 21:07 . 2009-04-22 21:24 551424 ----a-w c:\windows\system32\agsaame.dll
2009-04-22 21:07 . 2009-04-22 21:24 544256 ----a-w c:\windows\system32\agsaamd.dll
2009-04-22 21:07 . 2009-04-22 21:24 538624 ----a-w c:\windows\system32\agsaamb.dll
2009-04-22 21:07 . 2009-04-22 21:24 331776 ----a-w c:\windows\system32\agsaama.dll
2009-04-22 21:07 . 2006-07-28 22:22 51712 ----a-w c:\windows\system32\coodest.dll
2009-04-22 21:07 . 2006-11-06 12:30 262144 ----a-w c:\windows\system32\lame_enc.dll
2009-04-22 21:07 . 2005-05-19 00:17 40960 ----a-w c:\windows\system32\osenxpsuite2005.dll
2009-04-22 21:07 . 2009-04-22 21:07 -------- d-----w c:\program files\Ozone
2009-04-22 21:06 . 2009-04-22 21:06 -------- d-----w c:\program files\MP3 Remix
2009-04-22 21:04 . 2009-04-22 21:04 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-22 21:01 . 2009-04-22 21:01 -------- d-----w c:\program files\Conduit
2009-04-22 21:01 . 2009-04-22 21:10 -------- d-----w c:\program files\Hotspot_Shield
2009-04-22 21:00 . 2009-04-22 21:01 -------- d-----w c:\program files\Hotspot Shield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 12:01 . 2009-04-22 18:00 6 ---ha-w c:\windows\Tasks\SA.DAT
2009-05-04 11:58 . 2001-09-19 12:00 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-04 11:58 . 2001-09-19 12:00 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-04 11:50 . 2009-04-22 18:40 203631 ----a-w c:\windows\AKDeInstall.exe
2009-05-03 19:05 . 2009-04-22 18:33 -------- d-----w c:\program files\Kaspersky Lab
2009-05-03 18:01 . 2009-04-22 19:04 -------- d-----w c:\program files\Real_SC
2009-05-03 17:36 . 2009-04-22 20:33 -------- d-----w c:\program files\Winamp
2009-05-03 17:21 . 2009-04-22 18:10 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-03 13:07 . 2009-04-22 19:03 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-03 13:07 . 2009-04-22 19:00 -------- d-----w c:\program files\Media Player Classic Arabic
2009-05-03 13:07 . 2009-04-22 18:45 -------- d-----w c:\program files\JetAudio
2009-05-03 13:07 . 2009-04-22 18:41 -------- d-----w c:\program files\Google
2009-05-03 13:07 . 2009-04-22 19:53 -------- d-----w c:\program files\Common Files\LightScribe
2009-05-03 13:07 . 2009-04-22 19:03 -------- d-----w c:\program files\Circle Developement
2009-05-03 12:56 . 2009-04-22 18:07 266240 ----a-w c:\windows\system32\igfxtray.exe
2009-04-29 02:02 . 2009-04-27 19:38 370 ----a-w c:\windows\Tasks\At1.job
2009-04-23 06:40 . 2009-04-22 17:55 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-22 21:08 . 2009-04-22 21:08 98304 ----a-w c:\windows\system32\viscomtran.dll
2009-04-22 20:59 . 2009-04-22 20:59 0 ----a-w c:\windows\nsreg.dat
2009-04-22 20:34 . 2009-04-22 20:34 -------- d-----w c:\program files\Winamp Toolbar
2009-04-22 19:50 . 2009-04-22 19:28 -------- d-----w c:\program files\Common Files\Ahead
2009-04-22 19:28 . 2009-04-22 19:28 -------- d-----w c:\program files\Nero
2009-04-22 19:12 . 2009-04-22 19:11 -------- d-----w c:\program files\Common Files\Nokia
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\Common Files\PCSuite
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\Nokia
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\DIFX
2009-04-22 19:11 . 2009-04-22 19:11 -------- d-----w c:\program files\PC Connectivity Solution
2009-04-22 19:04 . 2009-04-22 19:04 -------- d-----w c:\program files\VideoLAN
2009-04-22 19:03 . 2009-04-22 19:03 -------- d-----w c:\program files\BLEH IDLE WAIT
2009-04-22 19:03 . 2009-04-22 19:03 -------- d-----w c:\program files\Windows Live
2009-04-22 19:03 . 2009-04-22 18:48 -------- d-----w c:\program files\MSN Messenger
2009-04-22 19:01 . 2009-04-22 18:02 94632 ----a-w c:\documents and settings\kuz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 18:53 . 2009-04-22 18:53 -------- d-----w c:\program files\Common Files\xing shared
2009-04-22 18:53 . 2009-04-22 18:52 -------- d-----w c:\program files\Real
2009-04-22 18:53 . 2009-04-22 18:52 -------- d-----w c:\program files\Common Files\Real
2009-04-22 18:52 . 2009-04-22 18:52 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-22 18:52 . 2009-04-22 18:52 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-22 18:51 . 2009-04-22 18:51 2232 ----a-w c:\windows\java\Packages\Data\V9JFDZRN.DAT
2009-04-22 18:51 . 2009-04-22 18:51 155995 ----a-w c:\windows\java\Packages\2JB577L7.ZIP
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\AIE1JTJT.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\OGVJLV7V.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\DZ5NN3ZP.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\SYVPVDFT.DAT
2009-04-22 18:51 . 2009-04-22 18:51 2678 ----a-w c:\windows\java\Packages\Data\2LNHNDZD.DAT
2009-04-22 18:45 . 2009-04-22 18:45 -------- d-----w c:\program files\Common Files\COWON
2009-04-22 18:42 . 2009-04-22 18:42 -------- d-----w c:\program files\Java
2009-04-22 18:42 . 2009-04-22 18:42 -------- d-----w c:\program files\Common Files\Java
2009-04-22 18:41 . 2009-04-22 18:41 -------- d-----w c:\program files\GRETECH
2009-04-22 18:40 . 2009-04-22 18:40 -------- d-----w c:\program files\mpegable
2009-04-22 18:23 . 2009-04-22 18:23 -------- d-----w c:\program files\Microsoft.NET
2009-04-22 18:22 . 2009-04-22 18:22 -------- d-----w c:\program files\Microsoft Works
2009-04-22 18:12 . 2009-04-22 18:12 -------- d-----w c:\program files\CONEXANT
2009-04-22 18:12 . 2009-04-22 18:12 -------- d-----w c:\program files\SigmaTel
2009-04-22 18:12 . 2009-04-22 18:10 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-22 17:56 . 2009-04-22 17:56 -------- d-----w c:\program files\microsoft frontpage
2009-04-22 17:55 . 2001-09-19 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-04-22 17:52 . 2009-04-22 17:52 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-20 18:50 . 2009-03-20 18:50 3358720 ----a-w c:\windows\system32\GPhotos.scr
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2008-06-24 20:17 1569304 ----a-w c:\program files\Hotspot_Shield\tbHots.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Filseclab Messenger.lnk - c:\program files\Common Files\Filseclab\FilMsg.exe [2009-5-3 549743]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-4-22 188416]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\Program Files\\Nero\\Nero 7\\InCD\\NBHGui.exe"=
"c:\\Program Files\\Your Uninstaller 2006\\uruninstaller.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\PC Connectivity Solution\\NclInstaller.exe"=
"c:\\WINDOWS\\stsystra.exe"=
"c:\\Program Files\\WinRAR\\WinRAR.exe"=
"c:\\Program Files\\Nero\\Nero 7\\InCD\\InCD.exe"=
"c:\\Program Files\\WinZip\\WINZIP32.EXE"=
"c:\\PROGRA~1\\WINZIP\\winzip32.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
R3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-08-17 18688]
R3 filpp;Filseclab Process Protection Driver;c:\progra~1\COMMON~1\FILSEC~1\filpp.sys [2008-12-21 9776]
R3 IMMDRV;Filseclab Twister Kernel Module;c:\progra~1\FILSEC~1\Twister\immdrv.sys [2007-11-26 151952]
S1 filar;Filseclab Dynamic Defense System Driver;c:\progra~1\COMMON~1\FILSEC~1\filar.sys [2007-12-18 10896]
S3 abp470n5;abp470n5; [x]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14095bc5-3351-11de-ad9e-0015c56b081b}]
\Shell\AutoRun\command - F:\g2pfnid.com
\Shell\explore\Command - F:\g2pfnid.com
\Shell\open\Command - F:\g2pfnid.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{92cb81a5-2fc8-11de-ad95-0015c56b081b}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8a99d3e-3426-11de-ada6-0015c56b081b}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd7cf247-2f7b-11de-ad8d-001f81000100}]
\Shell\AutoRun\command - G:\zPharaoh.exe
\Shell\explore\command - G:\zPharaoh.exe
\Shell\open\command - G:\zPharaoh.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: Microsoft XML Parser for Java -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
FF - ProfilePath - c:\documents and settings\kuz\Application Data\Mozilla\Firefox\Profiles\xeihbrdv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPJPI142_06.dll
FF - plugin: c:\program files\Java\j2re1.4.2_06\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2009-05-04 15:04
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-04 15:05
ComboFix-quarantined-files.txt 2009-05-04 12:05
Pre-Run: 15,303,974,912 bytes free
Post-Run: 15,435,513,856 bytes free
255
