Microsoft Windows XP Professional 5.1.2600.3.1256.216.1025.18.479.117 [GMT 3:00]
Running from: c:\documents and settings\jws\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\jws\LOCALS~1\Temp\GLCB.tmp
c:\documents and settings\jws\Local Settings\Temp\GLCB.tmp
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
.
((((((((((((((((((((((((( Files Created from 2009-04-05 to 2009-05-05 )))))))))))))))))))))))))))))))
.
2009-05-05 21:33 . 2009-05-05 21:33 -------- d-----w c:\windows\LastGood
2009-05-05 19:23 . 2009-05-05 19:24 -------- d-----w c:\windows\system32\NtmsData
2009-05-04 12:08 . 2009-05-04 12:08 -------- d-----w c:\program files\KONAMI
2009-05-04 04:13 . 2009-05-04 04:16 4627 ----a-w c:\windows\BricoPackFoldersDelete.cmd
2009-05-03 22:09 . 2009-05-03 22:09 -------- d-----w c:\windows\system32\VIRepair
2009-05-03 12:25 . 2009-05-03 12:25 -------- d-----w c:\program files\Project64 1.6
2009-05-03 09:50 . 2009-05-03 22:24 -------- d-----w c:\program files\Vista Rainbar
2009-05-03 01:00 . 2009-05-03 01:00 -------- d-----w C:\Temp
2009-05-03 00:50 . 2009-05-03 00:50 102024 ----a-w c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-05-03 00:50 . 2009-05-03 00:50 -------- d-----w c:\documents and settings\jws\Application Data\ViSplore
2009-05-03 00:50 . 2009-05-03 00:51 -------- d-----w c:\documents and settings\jws\Application Data\ViStart
2009-05-03 00:46 . 2009-05-03 09:50 -------- d-----w c:\program files\ViSplore
2009-05-03 00:46 . 2009-05-03 09:50 -------- d-----w c:\program files\TrueTransparency
2009-05-03 00:46 . 2009-05-05 21:37 -------- d-----w c:\program files\WinFlip
2009-05-03 00:39 . 2009-05-03 22:11 -------- d-----w c:\windows\system32\VITrans
2009-05-03 00:39 . 2009-05-03 09:53 -------- d-----w C:\VTPFiles
2009-05-03 00:39 . 2006-12-03 14:15 111104 ----a-w c:\windows\system32\Uharc.exe
2009-05-03 00:39 . 2006-12-03 14:15 19968 ----a-w c:\windows\system32\reico.exe
2009-05-03 00:39 . 2006-12-03 14:14 8636 ----a-w c:\windows\system32\modifype.exe
2009-05-03 00:39 . 2006-12-03 14:15 69632 ----a-w c:\windows\system32\moveex.exe
2009-05-03 00:39 . 2004-11-27 16:00 94208 ----a-w c:\windows\system32\pskill.exe
2009-05-03 00:39 . 2009-03-17 21:30 20480 ----a-w c:\windows\system32\scrnrdr.exe
2009-05-02 23:05 . 2009-05-03 02:43 -------- d-----w c:\program files\Streets of Rage
2009-05-02 23:02 . 2009-05-03 08:21 -------- d-----w c:\program files\Ultimate Mortal Kombat 3
2009-05-02 22:55 . 2009-05-02 22:56 -------- d-----w c:\program files\Tiny Toon Adventures - Buster's Hidden Treasure
2009-05-02 22:34 . 2009-05-03 02:41 -------- d-----w c:\program files\Streets of Rage 2
2009-05-02 22:30 . 2009-05-02 22:30 -------- d-----w c:\program files\Lion King
2009-05-02 22:08 . 2009-05-02 22:24 -------- d-----w c:\program files\Aladdin
2009-05-02 21:43 . 2009-05-02 22:08 -------- d-----w c:\program files\Teenage Mutant Ninja Turtles - The Hyperstone Heist
2009-05-02 15:38 . 2009-05-02 15:38 -------- d-----w c:\program files\Perfect Optimizer
2009-04-15 19:32 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 19:32 . 2009-02-09 11:22 2190592 ------w c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-15 19:32 . 2009-03-06 14:20 283136 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-15 19:32 . 2009-02-09 11:21 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-15 19:32 . 2009-02-09 10:51 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 19:32 . 2009-02-09 10:51 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 19:32 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-04-15 19:31 . 2009-02-09 10:51 681472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 19:31 . 2009-02-09 10:51 723456 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 19:31 . 2009-02-09 10:51 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 19:31 . 2009-02-09 10:51 693760 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 19:31 . 2009-02-09 11:22 2146816 ------w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-15 19:31 . 2009-02-09 11:22 2025472 ------w c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-15 19:21 . 2008-04-21 21:14 215040 ------w c:\windows\system32\dllcache\wordpad.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-05 21:31 . 2009-02-17 00:09 -------- d-----w c:\program files\Nakido
2009-05-05 19:03 . 2008-09-02 21:27 -------- d-----w c:\program files\CyberLink
2009-05-05 19:03 . 2008-09-02 20:42 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-04 04:16 . 2009-03-08 13:07 63613 ----a-w c:\windows\BricoPackUninst.cmd
2009-05-03 00:50 . 2008-09-02 20:40 8224 ----a-w c:\documents and settings\jws\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 07:17 . 2001-09-19 09:00 59544 ----a-w c:\windows\system32\perfc001.dat
2009-04-17 07:17 . 2001-09-19 09:00 330874 ----a-w c:\windows\system32\perfh001.dat
2009-04-06 00:03 . 2008-09-02 21:23 -------- d-----w c:\program files\Common Files\Adobe
2009-04-01 12:20 . 2009-04-01 12:20 -------- d-----w c:\program files\Common Files\xing shared
2009-04-01 12:20 . 2008-09-02 22:30 -------- d-----w c:\program files\Common Files\Real
2009-04-01 12:19 . 2008-09-02 21:20 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-01 12:19 . 2008-09-02 22:30 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-03-21 06:08 . 2009-03-21 06:08 -------- d-----w c:\program files\Microsoft.NET
2009-03-17 21:13 . 2009-03-10 21:18 -------- d-----w c:\program files\Microsoft Works
2009-03-08 13:07 . 2004-08-03 18:55 218624 ----a-w c:\windows\system32\uxtheme.dll
2009-03-06 14:20 . 2004-08-03 18:55 283136 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:06 . 2004-08-03 18:55 817152 ----a-w c:\windows\system32\wininet.dll
2009-02-20 16:50 . 2004-08-03 18:55 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-10 16:03 . 2004-08-03 21:48 2067584 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 14:04 . 2004-08-03 18:46 1846656 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:22 . 2004-08-03 18:49 2190592 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:21 . 2004-08-03 18:56 110592 ----a-w c:\windows\system32\services.exe
2009-02-09 10:51 . 2004-08-03 18:55 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:51 . 2004-08-03 18:55 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:51 . 2004-08-03 18:55 681472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:51 . 2004-08-03 18:55 693760 ----a-w c:\windows\system32\ntdll.dll
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 10:39 . 2001-09-19 09:00 35328 ----a-w c:\windows\system32\sc.exe
2009-01-20 20:01 . 2009-01-20 17:12 733216 --sha-w c:\windows\system32\drivers\fidbox.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="d:\التحميلات\Internet Download Manager 5.12 FINAL\Crack\Cracked exe\IDMan.exe" [2007-12-21 931760]
"WinFlip"="c:\program files\WinFlip\WinFlip.exe" [2008-05-21 483328]
"Vista Rainbar"="c:\program files\Vista Rainbar\launcher.exe" [2009-03-19 135528]
"ViSplore"="c:\program files\ViSplore\ViSplore.exe" [2009-02-04 389120]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-01 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\jws\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
RocketDock.lnk - d:\ں颥êïéں¢\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]
TransBar.lnk - d:\ں颥êïéں¢\Vista Inspirat 2\TransBar\TransBar.exe [2005-6-1 65536]
UberIcon.lnk - d:\ں颥êïéں¢\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]
Y'z Shadow.lnk - d:\ں颥êïéں¢\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-1-28 10950144]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Utility Tray.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Utility Tray.lnk
backup=c:\windows\pss\Utility Tray.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^jws^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma.lnk]
path=c:\documents and settings\jws\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^jws^قائمة ابدأ^البرامج^بدء التشغيل^Ela-Salaty.lnk]
path=c:\documents and settings\jws\قائمة ابدأ\البرامج\بدء التشغيل\Ela-Salaty.lnk
backup=c:\windows\pss\Ela-Salaty.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Nakido\\nakido.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13361:TCP"= 13361:TCP:BitComet 13361 TCP
"13361:UDP"= 13361:UDP:BitComet 13361 UDP
R2 Nakido;Nakido;c:\program files\Nakido\nakido.exe [27-04-2009 18:11 325632]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14-01-2009 17:53 226656]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [12-11-2008 12:44 33752]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [22-10-2008 19:07 81832]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [22-10-2008 19:07 13864]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [22-10-2008 19:07 107304]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [22-10-2008 19:08 99112]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [23-10-2008 0:20 21928]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [22-10-2008 19:08 97320]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [23-10-2008 0:20 97704]
.
Contents of the 'Scheduled Tasks' folder
2009-05-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 12:42]
2009-05-05 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKCU-Run-BitComet - c:\program files\BitComet\BitComet.exe
HKCU-Run-ViGlance - c:\program files\ViGlance\ViGlance.exe
HKCU-Run-ViStart - c:\program files\ViStart\ViStart.exe
HKLM-Run-DrvIcon - c:\program files\Vista Drive Icon\DrvIcon.exe
HKU-Default-Run-Nokia.PCSync - d:\nokia pc suite 6\PcSync2.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.windowsxlive.net
uInternet Connection Wizard,ShellNext = iexplore
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - d:\التحميلات\Internet Download Manager 5.12 FINAL\Crack\Cracked exe\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - d:\التحميلات\Internet Download Manager 5.12 FINAL\Crack\Cracked exe\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - d:\التحميلات\Internet Download Manager 5.12 FINAL\Crack\Cracked exe\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\jws\Application Data\Mozilla\Firefox\Profiles\c27snbol.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=
FF - component: c:\documents and settings\jws\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-06 00:36
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):a4,6b,fd,d3,a1,1c,98,34,58,f2,b4,e4,fd,3c,ca,56,0d,84,d7,11,8e,
56,3f,aa,06,f9,c7,cf,c7,91,cc,dd,d2,28,46,9c,63,30,fe,9d,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{642f3731-0a6c-4b7c-bbc8-dc355fe0d3e9}]
@Denied: (Full) (Everyone)
"Model"=dword:0000002f
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):fd,e8,ad,86,1e,70,3d,31,d6,31,95,06,53,17,c8,9c,f3,66,71,dc,04,
76,90,6a,af,b5,88,2a,6f,3a,fd,07,65,38,0e,a9,2e,69,72,4d,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{db4bb368-c528-4de2-8526-0c75aaa809c0}]
@Denied: (Full) (Everyone)
"Model"=dword:00000077
"Therad"=dword:0000001d
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.EXE'(1616)
c:\windows\system32\ntshrui.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
d:\التحميلات\Internet Download Manager 5.12 FINAL\Crack\Cracked exe\idmmkb.dll
d:\التحميلات\Vista Inspirat 2\UberIcon\UberIcon.dll
d:\التحميلات\Vista Inspirat 2\YzShadow\YzShadow.dll
d:\التحميلات\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\docume~1\jws\LOCALS~1\Temp\catchme.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\WgaTray.exe
c:\combofix\hidec.exe
d:\c:\Program Files\WinFlip\WinFlip.exe
d:\d:\d:\d:\c:\progra~1\VISTAR~1\Rainbar.exe
c:\combofix\Catchme.tmp
.
**************************************************************************
.
Completion time: 2009-05-05 0:42 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-05 21:40
Pre-Run: 6,449,926,144 bytes free
Post-Run: 6,600,982,528 bytes free
243
هذا تقرير الكمبوفكس
مع الشكر
