تقرير الكومبو
ComboFix 09-05-05.04 - user 05/06/2009 15:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.2046.1529 [GMT 3:00]
Running from: d:\documents and settings\user\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
.
2009-05-06 12:40 . 2009-05-06 12:40 -------- d-----w d:\documents and settings\user\Application Data\CyberScrub
2009-05-06 12:39 . 2009-05-06 12:39 -------- d-----w d:\documents and settings\user\Application Data\cleaner
2009-05-05 20:12 . 2009-05-05 20:12 -------- d-----w d:\program files\Trend Micro
2009-04-25 12:43 . 2009-04-25 14:32 -------- d-----w D:\DriveKey
2009-04-21 00:40 . 2009-04-21 01:21 -------- d-----w d:\documents and settings\user\Shared
2009-04-21 00:40 . 2009-04-21 01:23 -------- d-----w d:\documents and settings\user\Incomplete
2009-04-21 00:40 . 2009-04-21 01:23 -------- d-----w d:\documents and settings\user\Application Data\FileVOoM
2009-04-21 00:38 . 2009-04-21 00:38 -------- d-----w d:\program files\Common Files\Java
2009-04-21 00:11 . 2009-03-23 21:30 33256 ----a-w d:\windows\system32\drivers\hssdrv.sys
2009-04-09 16:10 . 2009-04-09 16:11 -------- d-----w d:\program files\Ahead
2009-04-07 20:51 . 2009-04-07 20:51 -------- d-----w d:\documents and settings\user\Application Data\AdobeAUM
2009-04-07 20:51 . 2009-04-07 20:51 -------- d-----w d:\documents and settings\user\Application Data\AdobeUM
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 12:54 . 2009-03-29 11:08 6044 --sha-w d:\windows\system32\drivers\fidbox2.idx
2009-05-06 12:54 . 2009-03-29 11:08 532512 --sha-w d:\windows\system32\drivers\fidbox2.dat
2009-05-06 12:54 . 2009-03-29 11:08 30720 --sha-w d:\windows\system32\drivers\fidbox.idx
2009-05-06 12:54 . 2009-03-29 11:08 2989088 --sha-w d:\windows\system32\drivers\fidbox.dat
2009-05-06 12:51 . 2008-04-15 12:00 67438 ----a-w d:\windows\system32\perfc001.dat
2009-05-06 12:51 . 2008-04-15 12:00 366874 ----a-w d:\windows\system32\perfh001.dat
2009-04-25 15:45 . 2009-03-29 11:09 89601 ----a-w d:\windows\system32\drivers\klick.dat
2009-04-25 15:45 . 2009-03-29 11:09 101287 ----a-w d:\windows\system32\drivers\klin.dat
2009-04-25 12:43 . 2009-01-23 19:03 -------- d--h--w d:\program files\InstallShield Installation Information
2009-04-21 00:40 . 2009-01-10 20:30 -------- d-----w d:\program files\Java
2009-04-20 11:32 . 2009-01-10 03:11 52784 ----a-w d:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-11 16:18 . 2009-01-11 21:05 -------- d-----w d:\program files\Common Files\Adobe
2009-03-31 09:51 . 2009-03-31 09:51 -------- d-----w d:\program files\Common Files\MainConcept
2009-03-31 09:50 . 2009-03-31 09:50 -------- d-----w d:\program files\SimpleCenter
2009-03-31 09:50 . 2009-03-31 09:50 -------- d-----w d:\program files\Common Files\i4j_jres
2009-03-31 08:35 . 2009-03-31 08:35 -------- d-----w d:\program files\Common Files\Nokia
2009-03-31 08:35 . 2009-03-31 08:32 -------- d-----w d:\program files\Nokia
2009-03-31 08:33 . 2009-03-31 08:33 -------- d-----w d:\program files\Common Files\PCSuite
2009-03-31 08:33 . 2009-03-31 08:33 -------- d-----w d:\program files\DIFX
2009-03-31 08:32 . 2009-03-31 08:32 -------- d-----w d:\program files\PC Connectivity Solution
2009-03-29 11:31 . 2008-01-29 14:29 33808 ----a-w d:\windows\system32\drivers\klbg.sys
2009-03-29 11:08 . 2009-03-29 11:08 -------- d-----w d:\program files\Kaspersky Lab
2009-03-26 13:17 . 2009-01-10 20:06 -------- d-----w d:\program files\Windows Live
2009-03-26 13:12 . 2009-03-26 13:12 -------- d-----w d:\program files\Microsoft SQL Server Compact Edition
2009-03-26 13:10 . 2009-03-26 13:09 -------- dcsh--w d:\program files\Common Files\WindowsLiveInstaller
2009-03-25 10:55 . 2009-03-25 10:55 2678 ----a-w d:\windows\java\Packages\Data\UZBLVVJV.DAT
2009-03-25 10:55 . 2009-03-25 10:55 2678 ----a-w d:\windows\java\Packages\Data\3VZT7XZN.DAT
2009-03-25 10:55 . 2009-03-25 10:55 2678 ----a-w d:\windows\java\Packages\Data\YNDV9JB3.DAT
2009-03-25 10:55 . 2009-03-25 10:55 2678 ----a-w d:\windows\java\Packages\Data\WON9F9NV.DAT
2009-03-25 10:55 . 2009-03-25 10:55 2678 ----a-w d:\windows\java\Packages\Data\TNZZRJLJ.DAT
2009-03-24 18:44 . 2009-03-23 19:04 -------- d-----w d:\program files\EAGLE-5.4.0
2009-03-23 17:18 . 2009-03-23 17:17 -------- d-----w d:\program files\ExpressPCB
2009-03-21 18:55 . 2009-03-21 18:54 -------- d-----w d:\program files\Readiris Pro 11 Mr.Underground Edition
2009-03-21 17:27 . 2009-03-21 17:27 -------- d-----w d:\program files\Nitro PDF
2009-03-21 17:27 . 2009-03-21 17:27 -------- d-----w d:\program files\Common Files\Nitro PDF
2009-03-21 17:27 . 2009-03-21 17:27 -------- d-----w d:\program files\Common Files\BCL Technologies
2009-03-12 15:27 . 2009-03-12 15:27 -------- d-----w d:\program files\K-Lite Codec Pack
2009-03-12 15:27 . 2009-01-10 17:49 -------- d-----w d:\program files\Common Files\Real
2009-03-09 19:43 . 2009-03-09 19:36 -------- d-----w d:\program files\AskBarDis
2009-03-09 02:19 . 2009-01-10 20:30 410984 ----a-w d:\windows\system32\deploytk.dll
2009-03-02 21:34 . 2009-03-02 21:34 56 ---ha-w d:\windows\system32\ezsidmv.dat
2009-02-09 18:56 . 2009-03-12 15:27 67584 ----a-w d:\windows\system32\ff_vfw.dll
.
------- Sigcheck -------
[-] 2008-04-15 12:00 1692672 6EBE193A4B84FDA080E38B4EB688774E d:\windows\explorer.exe
[7] 2008-04-15 12:00 1031168 CA3445DCE9EB70A2CA2504E0AF5C543F d:\windows\system32\dllcache\explorer.exe
[-] 2008-04-15 12:00 30208 16B6B140093313F0BDE58E5DC715C2A8 d:\windows\system32\ctfmon.exe
[7] 2008-04-15 12:00 15360 252F972131EB23596C20B82CA190DC5C d:\windows\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2008-04-15 30208]
"IDMan"="d:\program files\Internet Download Manager\IDMan.exe" [2009-01-10 2745776]
"MsnMsgr"="d:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MSMSGS"="d:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2008-12-25 13680640]
"SW20"="d:\windows\system32\sw20.exe" [2006-09-07 208896]
"SW24"="d:\windows\system32\sw24.exe" [2006-09-07 69632]
"NvMediaCenter"="d:\windows\system32\NvMcTray.dll" [2008-12-25 86016]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"Nitro PDF Printer Monitor"="d:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe" [2008-12-05 210240]
"AVP"="d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-03-29 206088]
"NSLauncher"="d:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2007-08-02 3096576]
"sclauncher"="d:\program files\SimpleCenter\bin\win\sclauncher.exe" [2007-01-30 94208]
"Adobe Photo Downloader"="d:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NeroCheck"="d:\windows\system32\\NeroCheck.exe" [2001-07-09 155648]
"nwiz"="nwiz.exe" - d:\windows\system32\nwiz.exe [2008-12-25 1657376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-15 30208]
d:\documents and settings\user\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Styler.lnk - d:\documents and settings\user\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2009-1-12 15086]
d:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
HP Digital Imaging Monitor.lnk - d:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
PalTalk.lnk - d:\program files\Paltalk Messenger\paltalk.exe [2009-1-28 10950144]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;d:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R3 HssDrv;Hotspot Shield Helper Miniport;d:\windows\system32\drivers\hssdrv.sys [21/04/2009 03:11 ص 33256]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S2 HssSrv;Hotspot Shield Helper Service;d:\documents and settings\user\سطح المكتب\Hotspot Shield\HssWPR\hsssrv.exe --> d:\documents and settings\user\سطح المكتب\Hotspot Shield\HssWPR\hsssrv.exe [?]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;d:\windows\system32\drivers\RTL8187.sys [14/02/2009 05:46 م 332928]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14a55358-15db-11de-94ed-0019d103e8a2}]
\Shell\AutoRun\command - G:\i.com
\Shell\open\Command - G:\i.com
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Nitro PDF Professional]
cscript //B "d:\program files\Nitro PDF\Professional\RemoveOldAddins.vbs"
.
Contents of the 'Scheduled Tasks' folder
2009-04-20 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - d:\program files\AskBarDis\bar\bin\askBar1.dll
HKCU-Run-ares - d:\program files\Ares\Ares.exe
HKCU-Run-WinPro.exe - d:\program files\Ares\WebPro.exe
HKLM-Run-SigmatelSysTrayApp - sttray.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyOverride = local
uInternet Settings,ProxyServer = 212.116.219.52:80
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
TCP: {C8F768AA-4CCA-4F8B-B5CC-D94A9C13207F} = 212.76.68.200,212.76.68.201
FF - ProfilePath - d:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\3awe963k.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.googel.com
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=
FF - prefs.js: network.proxy.ftp - 212.93.193.83
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - 212.93.193.83
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - 212.93.193.83
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 212.93.193.83
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 212.93.193.83
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 4
FF - component: d:\documents and settings\user\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: d:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: d:\program files\Veetle\Player\npvlc.dll
FF - plugin: d:\program files\Veetle\plugins\npVeetle.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-06 15:56
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{179c3ef6-8e08-40a4-8e70-6de5faab748c}]
@Denied: (Full) (Everyone)
"Model"=dword:00000026
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):4c,51,2e,96,b1,f4,8a,8a,f7,ef,0d,17,68,92,46,ec,1a,74,4d,f8,a7,
70,bb,c5,08,73,f0,bc,1b,6b,27,42,d3,41,1c,ca,7b,be,04,2e,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1932)
d:\windows\system32\cscui.dll
- - - - - - - > 'explorer.exe'(2836)
d:\windows\System32\cscui.dll
d:\windows\system32\msi.dll
d:\windows\system32\ieframe.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\nvsvc32.exe
d:\windows\system32\HPZipm12.exe
d:\windows\system32\rundll32.exe
d:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-06 15:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-06 12:59
Pre-Run: 7,153,025,024 bytes free
Post-Run: 7,072,219,136 bytes free
220
