هذا التقرير عزيزي
رحم الله والديك
ComboFix 09-05-11.01 - meteb 05/11/2009 21:19.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.2046.1456 [GMT 3:00]
Running from: c:\documents and settings\meteb\Desktop\ComboFix.exe
AV: Norton 360 Premier Edition *On-access scanning disabled* (Updated)
FW: Norton 360 Premier Edition *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\meteb\Favorites\Cheap Pharmacy Online.url
c:\documents and settings\meteb\Favorites\Search Online.url
c:\documents and settings\meteb\Favorites\SMS TRAP.url
c:\documents and settings\meteb\Favorites\VIP Casino.url
c:\windows\system32\opuc.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Service_oreans32
((((((((((((((((((((((((( Files Created from 2009-04-11 to 2009-05-11 )))))))))))))))))))))))))))))))
.
2009-05-11 17:14 . 2009-05-11 17:14 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-11 15:51 . 2009-05-11 15:51 -------- d-----w c:\program files\Trend Micro
2009-05-11 14:27 . 2009-01-15 09:19 23848 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-11 14:27 . 2008-04-17 09:12 107368 ----a-w c:\windows\system32\GEARAspi.dll
2009-05-11 14:27 . 2009-05-11 14:27 -------- d-----w c:\documents and settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
2009-05-11 14:26 . 2009-05-11 14:25 36400 ----a-r c:\windows\system32\drivers\SymIM.sys
2009-05-11 14:26 . 2009-05-11 14:26 60808 ----a-w c:\windows\system32\S32EVNT1.DLL
2009-05-11 14:26 . 2009-05-11 14:26 124464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2009-05-11 14:26 . 2009-05-11 14:26 -------- d-----w c:\program files\Symantec
2009-05-11 14:25 . 2009-05-11 14:25 -------- d-----w c:\windows\system32\drivers\N360
2009-05-11 14:25 . 2009-05-11 14:25 -------- d-----w c:\program files\Norton 360 Premier Edition
2009-05-11 14:25 . 2009-05-11 14:25 -------- d-----w c:\program files\Windows Sidebar
2009-05-11 14:25 . 2009-05-11 14:25 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-05-11 14:25 . 2009-05-11 14:27 -------- d-----w c:\documents and settings\All Users\Application Data\Norton
2009-05-11 14:24 . 2009-05-11 14:24 -------- d-----w c:\program files\NortonInstaller
2009-05-11 14:24 . 2009-05-11 14:25 -------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-11 12:51 . 2009-05-11 12:51 -------- d-----w c:\windows\McAfee.com
2009-05-11 12:49 . 2009-05-11 13:36 -------- d-----w c:\windows\BDOSCAN8
2009-05-11 12:30 . 2009-05-11 18:05 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-10 20:42 . 2009-05-11 18:04 -------- d-----w c:\program files\Equis
2009-05-10 18:48 . 2005-12-06 13:51 438341 ------w c:\windows\system32\dbcapi.dll
2009-05-09 22:18 . 2009-03-24 13:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-09 21:26 . 2009-05-09 21:26 604416 ----a-w c:\windows\system32\TUProgSt.exe
2009-05-09 21:26 . 2009-04-27 11:21 28928 ----a-w c:\windows\system32\uxtuneup.dll
2009-05-09 21:26 . 2009-05-09 21:26 361216 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-05-09 21:08 . 2009-05-09 21:09 -------- d-----w c:\program files\FX Solutions - MetaTrader
2009-05-09 20:01 . 2009-05-10 16:11 -------- d-----w c:\documents and settings\meteb\Application Data\IDM
2009-05-09 20:00 . 2009-05-10 16:58 -------- d-----w c:\program files\Internet Download Manager
2009-05-09 10:23 . 2009-05-09 10:50 -------- d-----w c:\documents and settings\meteb\Local Settings\Application Data\Runscanner.net
2009-05-08 22:18 . 2009-05-10 16:12 -------- d-----w c:\program files\zAlwil Software
2009-05-07 11:08 . 2009-05-07 11:08 -------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-05-07 11:07 . 2009-05-07 11:07 -------- d-----w c:\program files\ACD Systems
2009-05-07 10:03 . 2009-05-07 10:03 -------- d-----w c:\program files\Common Files\xing shared
2009-05-07 07:42 . 2009-03-26 15:35 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-05-06 18:45 . 2009-05-06 18:45 -------- d-----w c:\program files\Common Files\EZB Systems
2009-05-06 18:44 . 2009-05-06 18:45 -------- d-----w c:\program files\UltraISO
2009-05-06 13:10 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\meteb\Application Data\Thinstall
2009-05-06 13:10 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\meteb\Local Settings\Application Data\Thinstall
2009-05-02 19:01 . 2009-05-02 19:01 -------- d-----w c:\documents and settings\meteb\Local Settings\Application Data\SpreadsheetTools
2009-05-02 02:41 . 2009-05-02 02:42 -------- d-----w c:\program files\PhotoZoom Pro 2
2009-05-02 02:34 . 2009-05-11 17:40 -------- d-----w C:\MS Rapid Downloads
2009-05-02 02:34 . 2009-05-02 02:34 -------- d-----w c:\program files\MajorShare
2009-04-28 08:45 . 2009-04-28 08:45 30 ----a-w c:\windows\itlog.dat
2009-04-15 09:23 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-11 21:52 . 2009-04-11 21:53 -------- d-----w c:\program files\VistaCodecPack
2009-04-11 21:50 . 2009-04-11 21:50 -------- d-----w c:\documents and settings\All Users\Application Data\VistaCodecs
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 18:00 . 2009-01-24 20:32 -------- d-----w c:\program files\Common Files\Adobe
2009-05-11 14:26 . 2009-05-11 14:26 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2009-05-11 14:26 . 2009-05-11 14:26 7386 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2009-05-10 18:25 . 2009-01-24 21:37 -------- d-----w c:\program files\AmiBroker
2009-05-09 21:25 . 2009-01-25 07:24 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-05-08 12:50 . 2009-01-24 20:00 -------- d-----w c:\program files\Avant Browser
2009-05-07 12:02 . 2009-01-26 17:57 -------- d-----w c:\program files\Forex Calendar
2009-05-07 11:08 . 2009-01-24 20:38 -------- d-----w c:\program files\Common Files\ACD Systems
2009-05-07 10:03 . 2009-01-24 21:14 -------- d-----w c:\program files\Common Files\Real
2009-05-07 10:02 . 2009-01-24 21:14 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-07 10:02 . 2009-01-24 21:14 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-24 22:26 . 2009-01-25 12:40 -------- d-----w c:\program files\FXDD - MetaTrader 4
2009-04-24 22:08 . 2009-02-16 21:46 -------- d-----w c:\program files\MetaTrader 4
2009-04-24 22:04 . 2009-01-24 22:41 -------- d-----w c:\program files\Interbank FX Trader 4
2009-04-24 21:59 . 2009-01-24 22:42 -------- d-----w c:\program files\Varengold Fox
2009-04-15 15:12 . 2009-04-05 14:43 454420 --sha-r c:\documents and settings\All Users\Application Data\meteb1232817523.exe
2009-04-06 16:21 . 2009-01-24 19:25 101064 ----a-w c:\documents and settings\meteb\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-06 16:09 . 2009-04-06 16:09 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-04-06 03:08 . 2009-04-06 03:08 -------- d-----w c:\program files\Microsoft Math Add-in for Word 2007
2009-04-06 03:07 . 2009-04-06 03:07 -------- d-----w c:\program files\Classic Menu for Office
2009-04-06 00:18 . 2009-04-06 00:18 84480 ----a-w c:\windows\system32\ff_vfw.dll
2009-04-04 16:00 . 2009-04-04 16:00 -------- d-----w c:\program files\Adaptick
2009-04-03 15:25 . 2009-02-06 22:32 -------- d-----w c:\program files\HY Trader
2009-04-03 05:21 . 2009-01-25 12:17 -------- d-----w c:\program files\AL Trade 4
2009-04-01 03:58 . 2009-02-28 20:10 -------- d-----w c:\program files\FIBO Group
2009-04-01 00:24 . 2009-02-01 18:58 -------- d-----w c:\program files\MetaTrader - Masterforex
2009-03-31 20:55 . 2009-03-31 20:55 -------- d-----w c:\program files\MTPredictor6
2009-03-31 20:21 . 2009-03-31 20:21 -------- d-----w c:\program files\Final
2009-03-29 22:57 . 2009-03-29 22:57 62149 ----a-w c:\windows\system32\pthreadGC2.dll
2009-03-29 01:08 . 2009-02-12 23:24 -------- d-----w c:\program files\Precision Trader Pro
2009-03-28 04:27 . 2009-02-02 22:28 -------- d-----w c:\program files\fxsolutions
2009-03-28 04:07 . 2009-03-28 04:07 -------- d-----w c:\program files\FX
2009-03-28 02:34 . 2009-03-28 02:34 -------- d-----w c:\program files\RamCleaner
2009-03-26 01:51 . 2009-01-24 20:41 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-26 01:49 . 2009-01-24 20:28 -------- d-----w c:\program files\Common Files\PrognosisUDS
2009-03-09 02:03 . 2008-12-02 03:05 121984 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
2009-03-08 13:31 . 2009-03-08 13:31 160628 ----a-w c:\windows\Ramp Uninstaller.exe
2009-03-08 01:34 . 2008-04-14 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2008-04-14 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2008-04-14 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2008-04-14 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2008-04-14 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2008-04-14 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2008-04-14 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2008-04-14 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2008-04-14 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2008-04-14 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2008-04-14 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 09:18 . 2008-11-27 08:47 73728 ----a-w c:\windows\system32\RtNicProp32.dll
2009-02-21 05:25 . 2009-03-22 06:15 691592 ----a-w c:\windows\system32\OGACheckControl.DLL
2009-02-17 03:30 . 2009-02-17 03:30 23040 ----a-w c:\windows\system32\drivers\aksusb.sys
2009-02-12 14:09 . 2009-02-12 14:09 1409 ----a-w c:\windows\Fonts\wave2.FOT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"RamCleaner"="c:\program files\RamCleaner\ramcore.exe" [2007-10-13 71680]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-09 2807216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SWd"="c:\windows\winwd.exe" [2005-04-18 26624]
"SDaemon"="c:\windows\sdaemon.exe" [2005-04-18 111104]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MetaStock File Server.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\MetaStock File Server.lnk
backup=c:\windows\pss\MetaStock File Server.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ASTCC"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
"raVe"=
"Driver32"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\WINDOWS\\License Manager.exe"=
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\
0300000.087\SymEFA.sys [5/11/2009 5:25 PM 310320]
R0 WINSEC;WINSEC;c:\windows\system32\drivers\winsec.sys [4/19/2005 12:57 AM 20352]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\
0300000.087\cchpx86.sys [5/11/2009 5:25 PM 482352]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090508.002\IDSXpx86.sys [5/11/2009 5:36 PM 276344]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [10/3/2008 10:41 AM 87264]
R2 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\
0300000.087\BHDrvx86.sys [5/11/2009 5:25 PM 258608]
R2 N360;Norton 360;c:\program files\Norton 360 Premier Edition\Engine\3.0.0.135\ccSvcHst.exe [5/11/2009 5:25 PM 115560]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [5/10/2009 12:26 AM 604416]
R2 winser;winser;c:\windows\system32\winsersec.exe [4/14/2005 1:37 AM 53248]
S2 .1232817523;1232817523;c:\documents and settings\All Users\Application Data\meteb1232817523.exe [4/5/2009 5:43 PM 454420]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [2/18/2009 3:44 AM 104192]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-11 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37]
2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
2009-05-10 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 19:34]
2009-05-11 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 19:34]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\idmmbc.dll
.
.
------- File Associations -------
.
vbefile\shell\edit\command=%SystemRoot%\System32\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-11 21:21
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360 Premier Edition\Engine\3.0.0.135\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360 Premier Edition\Engine\3.0.0.135\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):39,6c,ed,0a,98,c5,eb,b2,47,2a,c3,5e,c4,82,0c,f9,21,82,30,61,9d,
2e,75,ac,74,03,9f,ad,75,4d,db,4c,15,da,5e,0b,5b,73,39,aa,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{fb0069cc-b841-4691-aa81-9adb35bb7011}]
@Denied: (Full) (Everyone)
"Model"=dword:00000058
"Therad"=dword:00000009
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,54,73,5c,fc,2d,
a1,65,d7,05,98,32,02,34,2b,da,61,77,8b,f5,14,48,e1,8a,13,23,01,6a,0a,7c,02,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\MSSYCLM]
@Denied: (B C D 1 2 3 4 5 6) (LocalSystem)
[HKEY_LOCAL_MACHINE\software\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NUM]
@Denied: (A C D 2 5) (LocalSystem)
"LastCompletedRun"=hex(b):00,00,00,00,00,00,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1892)
c:\windows\system32\Ati2evxx.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
- - - - - - - > 'explorer.exe'(868)
c:\windows\WSEC32HK.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
.
Completion time: 2009-05-11 21:22
ComboFix-quarantined-files.txt 2009-05-11 18:22
Pre-Run: 1,417,510,912 bytes free
Post-Run: 1,410,658,304 bytes free
269 --- E O F --- 2009-05-09 00:00
k:
