التقرير الاول
ComboFix 09-05-14.03 - Administrator 05/15/2009 1:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.991.741 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Bifrost
c:\windows\IE4 Error Log.txt
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_asc3360pr
((((((((((((((((((((((((( Files Created from 2009-04-14 to 2009-05-14 )))))))))))))))))))))))))))))))
.
2009-05-10 21:26 . 2009-05-10 21:26 -------- d-----w c:\program files\Avira
2009-05-09 03:26 . 2006-10-09 01:14 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-05-09 03:26 . 2008-04-13 18:45 15104 ----a-w c:\windows\system32\dllcache\usbscan.sys
2009-05-09 03:26 . 2008-04-13 18:45 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-09 03:26 . 2008-04-14 15:59 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-05-08 01:34 . 2008-09-16 19:23 168448 ----a-w c:\windows\system32\unrar.dll
2009-05-08 01:34 . 2004-01-25 16:18 217088 ----a-w c:\windows\system32\yv12vfw.dll
2009-05-08 01:34 . 2008-12-07 18:08 795648 ----a-w c:\windows\system32\xvidcore.dll
2009-05-08 01:34 . 2008-12-07 18:08 130048 ----a-w c:\windows\system32\xvidvfw.dll
2009-05-08 01:34 . 2008-11-06 16:37 3596288 ----a-w c:\windows\system32\qt-dx331.dll
2009-05-08 01:34 . 2008-12-11 00:33 86016 ----a-w c:\windows\system32\dpl100.dll
2009-05-08 01:34 . 2008-11-06 16:33 684032 ----a-w c:\windows\system32\divx.dll
2009-05-08 01:34 . 2009-03-02 18:10 67584 ----a-w c:\windows\system32\ff_vfw.dll
2009-05-08 01:34 . 2009-01-07 18:14 60273 ----a-w c:\windows\system32\pthreadGC2.dll
2009-05-08 01:34 . 2009-05-08 01:34 -------- d-----w c:\program files\K-Lite Codec Pack
2009-05-04 19:28 . 2009-05-04 19:28 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-04 19:15 . 2002-02-18 07:22 139536 ----a-w c:\windows\system32\javaee.dll
2009-05-04 16:24 . 2009-05-04 16:24 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-04 09:07 . 2009-05-04 09:07 -------- d-----w c:\program files\Business-in-a-Box
2009-05-04 07:58 . 2009-05-04 07:58 -------- d-----w c:\program files\Ask Search Assistant
2009-05-03 19:44 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-03 19:44 . 2009-03-06 14:20 283136 ------w c:\windows\system32\dllcache\pdh.dll
2009-05-03 19:44 . 2009-02-09 11:21 110592 ------w c:\windows\system32\dllcache\services.exe
2009-05-03 19:44 . 2009-02-09 10:51 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-05-03 19:44 . 2009-02-09 10:51 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-05-03 19:44 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-05-03 19:44 . 2009-02-09 10:51 681472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-05-03 19:44 . 2009-02-09 10:51 723456 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-05-03 19:44 . 2009-02-09 10:51 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-03 19:44 . 2009-02-09 10:51 693760 ------w c:\windows\system32\dllcache\ntdll.dll
2009-05-03 19:43 . 2008-04-21 21:14 215040 ------w c:\windows\system32\dllcache\wordpad.exe
2009-04-29 09:44 . 2009-04-29 09:44 -------- d-----w c:\documents and settings\Administrator\Application Data\Windows Live Writer
2009-04-29 09:43 . 2009-04-29 09:43 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Windows Live Writer
2009-04-27 02:13 . 2006-10-09 01:13 8192 ----a-w c:\windows\system32\dllcache\kbdkor.dll
2009-04-27 02:13 . 2006-10-09 01:13 8192 ----a-w c:\windows\system32\kbdkor.dll
2009-04-27 02:13 . 2006-10-09 01:13 8704 ----a-w c:\windows\system32\dllcache\kbdjpn.dll
2009-04-27 02:13 . 2006-10-09 01:13 8704 ----a-w c:\windows\system32\kbdjpn.dll
2009-04-27 02:13 . 2006-10-09 01:13 5632 ----a-w c:\windows\system32\dllcache\kbd103.dll
2009-04-27 02:13 . 2006-10-09 01:13 5632 ----a-w c:\windows\system32\kbd103.dll
2009-04-27 02:13 . 2006-10-09 01:13 6144 ----a-w c:\windows\system32\dllcache\kbd101c.dll
2009-04-27 02:13 . 2006-10-09 01:13 6144 ----a-w c:\windows\system32\kbd101c.dll
2009-04-27 02:13 . 2006-10-09 01:13 6144 ----a-w c:\windows\system32\dllcache\kbd101b.dll
2009-04-27 02:13 . 2006-10-09 01:13 6144 ----a-w c:\windows\system32\kbd101b.dll
2009-04-27 02:13 . 2008-04-14 15:58 6144 ----a-w c:\windows\system32\dllcache\kbd106.dll
2009-04-27 02:13 . 2008-04-14 15:58 6144 ----a-w c:\windows\system32\kbd106.dll
2009-04-22 05:08 . 2009-04-22 05:11 -------- d-----w c:\documents and settings\Administrator\Application Data\GetRightToGo
2009-04-21 22:26 . 2009-04-21 22:26 -------- d-----w c:\program files\7-Zip
2009-04-21 00:02 . 2009-04-21 00:02 4096 ----a-w c:\windows\d3dx.dat
2009-04-19 16:35 . 2009-04-19 16:35 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\WMTools Downloaded Files
2009-04-18 20:43 . 2009-04-18 20:43 -------- d-----w c:\program files\Windows Installer Clean Up
2009-04-15 15:28 . 2009-04-15 15:28 -------- d-----w c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-04-15 12:13 . 2009-05-08 10:37 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Deployment
2009-04-15 08:47 . 2009-04-15 08:47 -------- d-----w c:\program files\AVG
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-14 21:18 . 2001-09-19 12:00 62470 ----a-w c:\windows\system32\perfc001.dat
2009-05-14 21:18 . 2001-09-19 12:00 337218 ----a-w c:\windows\system32\perfh001.dat
2009-05-10 21:44 . 2009-03-27 19:52 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-10 04:35 . 2009-03-25 05:57 -------- d-----w c:\program files\Google
2009-05-04 19:28 . 2009-03-25 03:21 -------- d-----w c:\program files\Java
2009-05-04 08:00 . 2009-04-10 02:58 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-22 21:21 . 2009-03-25 03:22 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-14 21:58 . 2009-03-27 21:13 -------- d-----w c:\program files\MSECACHE
2009-04-14 13:14 . 2009-03-27 19:59 -------- d-----w c:\program files\Windows Live
2009-04-14 13:14 . 2009-04-14 13:14 -------- d-----w c:\program files\Microsoft Sync Framework
2009-04-14 13:13 . 2009-04-14 13:13 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-04-13 23:51 . 2009-03-27 20:02 -------- d-----w c:\program files\Your Uninstaller 2008
2009-04-13 23:50 . 2009-03-25 03:25 -------- d-----w c:\program files\Windows Media Connect 2
2009-04-13 20:26 . 2009-03-25 03:26 -------- d-----w c:\program files\Extension Changer
2009-04-10 06:11 . 2009-04-10 04:57 -------- d-----w c:\program files\ma-config.com
2009-04-10 06:11 . 2009-04-10 04:57 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-10 05:09 . 2009-04-10 05:09 -------- d-----w c:\program files\InstallShield Installation Information
2009-04-10 05:08 . 2009-04-10 05:08 -------- d-----w c:\program files\VIA
2009-04-10 05:07 . 2009-04-10 05:07 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-10 02:59 . 2009-04-10 02:59 -------- d-----w c:\program files\Circle Developement
2009-04-04 20:25 . 2009-04-04 20:25 -------- d-----w c:\program files\LeeGTs Games
2009-04-04 19:54 . 2009-04-04 19:54 -------- d-----w c:\program files\AlterJig
2009-04-04 19:40 . 2009-04-04 19:40 -------- d-----w c:\program files\ReflexiveArcade
2009-04-01 03:23 . 2009-04-01 03:23 -------- d-----w c:\program files\BandRich
2009-03-27 22:33 . 2009-03-27 22:33 -------- d-----w c:\program files\microsoft frontpage
2009-03-27 21:28 . 2009-03-27 18:19 12328 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-27 21:27 . 2009-03-27 21:27 -------- d-----w c:\program files\Microsoft
2009-03-27 21:26 . 2009-03-27 21:26 -------- d-----w c:\program files\Windows Live SkyDrive
2009-03-27 21:10 . 2009-03-27 21:10 -------- d-----w c:\program files\Common Files\Windows Live
2009-03-27 20:09 . 2009-03-27 20:09 -------- d-----w c:\program files\GRETECH
2009-03-27 20:02 . 2009-03-27 20:02 0 ----a-w c:\windows\nsreg.dat
2009-03-26 09:14 . 2009-03-26 09:14 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2009-03-25 05:57 . 2009-03-25 05:57 -------- d-----w c:\program files\Common Files\xing shared
2009-03-25 05:57 . 2009-03-25 05:57 -------- d-----w c:\program files\Common Files\Real
2009-03-25 05:57 . 2009-03-25 03:22 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-03-25 05:57 . 2009-03-25 05:57 -------- d-----w c:\program files\Real
2009-03-25 03:23 . 2009-03-25 03:23 -------- d-----w c:\program files\PowerMenu
2009-03-25 03:21 . 2009-03-25 03:21 -------- d-----w c:\program files\Common Files\Java
2009-03-25 03:03 . 2009-03-25 03:03 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2007-01-04 14:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 21:55 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 21:55 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 21:55 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 21:55 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 21:55 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 21:55 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 21:53 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 21:56 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-09-19 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-03 21:55 283136 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-10 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="c:\windows\VistaDrive\VistaDrive.exe" [2006-10-05 280779]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-22 198160]
"CTFMON"="c:\windows\system32\wscript.exe" [2008-05-08 155648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]
c:\documents and settings\Administrator\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
PowerMenu 1.51.lnk - c:\program files\PowerMenu\PowerMenu.exe [2009-3-25 57344]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dwwinxp.exe]
"Debugger"=c:\windows\system32\winxp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [09/04/2009 02:00 ص 149376]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/05/2009 12:26 ص 108289]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [03/06/2008 10:12 ص 87264]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/2009 05:53 م 226656]
S2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [11/05/2009 12:26 ص 194817]
S2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [11/05/2009 12:26 ص 432897]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [01/04/2009 06:24 ص 100096]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37afa870-3214-11de-87bc-000ae60e8a41}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ddab1d4-18eb-11de-824c-000ae60e8a41}]
\Shell\AutoplaY\commanD - oiyv.pif
\Shell\AutoRun\command - oiyv.pif
\Shell\eXPlOre\CommAnd - oiyv.pif
\Shell\OPen\Command - oiyv.pif
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e9a3907-2659-11de-825f-000ae60e8a41}]
\shell\AUtoplaY\commANd - G:\lwihum.pif
\shell\AutoRun\command - G:\lwihum.pif
\shell\eXPLore\COMmAnd - G:\lwihum.pif
\shell\opEn\COMMand - G:\lwihum.pif
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b97e6c60-3500-11de-87c6-000ae60e8a41}]
\Shell\AutoRun\command - 8ng8w.com
\Shell\explore\Command - 8ng8w.com
\Shell\open\Command - 8ng8w.com
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{66D0FA89-E793-DA07-06B1-80FEF7F8FBC7}]
c:\windows\system32\winxp.exe
.
Contents of the 'Scheduled Tasks' folder
2009-05-14 c:\windows\Tasks\User_Feed_Synchronization-{4C6425F6-21F9-4306-86FA-D633ADFFFD0C}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-AudioDeck - c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe
HKLM-Run-abu salem - c:\windows\system32\winxp.exe
HKLM-Run-regdiit - c:\windows\system32\winxp.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uInternet Settings,ProxyServer = 172.16.40.254:8080
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\
0rk1632d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.http - 172.16.40.254
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\
0rk1632d.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-15 01:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1390067357-688789844-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fc,3d,c9,ed,5d,aa,b6,42,85,e9,b2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fc,3d,c9,ed,5d,aa,b6,42,85,e9,b2,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(740)
c:\program files\Avira\AntiVir Desktop\avsda.dll
- - - - - - - > 'explorer.exe'(3736)
c:\program files\PowerMenu\PowerMenuHook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
.
**************************************************************************
.
Completion time: 2009-05-14 1:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-14 22:30
Pre-Run: 11,260,133,376 bytes free
Post-Run: 11,682,951,168 bytes free
256 --- E O F --- 2009-04-02 02:10
