تفضل اخوووي
ComboFix 09-05-14.06 - MY PC 05/15/2009 16:05.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.968.1033.18.1015.443 [GMT 4:00]
Running from: c:\documents and settings\MY PC\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\npee.com
F:\npee.com
.
((((((((((((((((((((((((( Files Created from 2009-04-15 to 2009-05-15 )))))))))))))))))))))))))))))))
.
2009-05-15 11:37 . 2009-05-15 11:37 -------- d-----w c:\documents and settings\MY PC\Application Data\CyberScrub
2009-05-15 11:22 . 2009-05-15 11:36 -------- d-----w c:\documents and settings\MY PC\Application Data\cleaner
2009-05-12 19:20 . 2009-05-12 19:22 -------- d-----w c:\windows\vf_hip
2009-05-12 19:20 . 2009-05-12 19:21 -------- d-----w c:\program files\Hide IP Platinum
2009-05-10 18:40 . 2003-11-04 11:11 159744 ----a-w c:\windows\system32\lfpng13n.dll
2009-05-10 18:40 . 2003-05-22 12:31 55808 ----a-w c:\windows\system32\lfpsd13n.dll
2009-05-04 08:13 . 2009-05-04 08:13 -------- d-----w c:\windows\system32\ar-sa
2009-05-04 08:03 . 2009-05-04 08:03 -------- d--h--w c:\windows\$hf_mig$
2009-05-04 06:53 . 2009-05-04 07:47 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-04 06:53 . 2009-05-04 07:47 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-04 06:52 . 2009-05-15 12:12 47392 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-04 06:52 . 2009-05-04 06:52 -------- d-----w c:\program files\Kaspersky Lab
2009-05-04 06:44 . 2009-05-15 12:13 4782880 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-03 20:05 . 2009-05-12 20:01 -------- d-----w c:\documents and settings\MY PC\Application Data\Skype
2009-05-03 20:05 . 2009-05-03 20:05 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-05-03 20:05 . 2009-05-03 20:05 -------- d-----w c:\program files\Skype
2009-05-03 14:38 . 2009-05-03 14:38 -------- d-----w c:\documents and settings\MY PC\Local Settings\Application Data\Ahead
2009-05-01 20:20 . 2009-05-01 20:21 -------- d-----w c:\program files\USB Disk Security
2009-05-01 17:52 . 2009-05-01 17:52 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-01 15:47 . 2009-05-01 15:47 -------- d-----w C:\Temp
2009-04-26 18:06 . 2004-08-03 20:56 221184 ----a-w c:\windows\system32\wmpns.dll
2009-04-26 15:57 . 2009-04-26 16:00 -------- d-----w c:\program files\VeryPDF PDF2Word v3.0
2009-04-23 18:07 . 2008-07-08 10:54 148496 ----a-w c:\windows\system32\drivers\42665878.sys
2009-04-15 16:38 . 2009-04-29 16:10 -------- d-----w c:\program files\CQPhone
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-15 11:55 . 2008-07-06 15:43 -------- d-----w c:\program files\The Cleaner
2009-05-15 11:52 . 2009-05-04 06:52 5036 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-15 11:52 . 2009-05-04 06:44 62684 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-04 07:47 . 2007-10-31 09:41 112144 ----a-w c:\windows\system32\drivers\kl1.sys
2009-04-26 15:08 . 2008-06-14 15:23 -------- d-----w c:\program files\MultiTranse
2009-04-24 18:16 . 2008-07-06 14:40 -------- d-----w c:\program files\The Cleaner Free
2009-04-22 19:26 . 2008-03-06 09:34 -------- d-----w c:\program files\Common Files\Adobe
2009-04-02 18:21 . 2008-03-06 19:24 109896 ----a-w c:\documents and settings\MY PC\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 15:37 . 2009-04-01 15:37 -------- d-----w c:\program files\Common Files\Adobe Systems Shared
2009-03-22 18:15 . 2009-03-22 18:15 -------- d-----w c:\program files\Common Files\xing shared
2009-03-22 18:14 . 2008-03-06 09:11 -------- d-----w c:\program files\Common Files\Real
2009-03-22 18:14 . 2008-03-06 09:11 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-03-22 18:13 . 2008-03-06 09:11 -------- d-----w c:\program files\Real
2009-03-21 14:34 . 2009-03-21 14:34 -------- d-----w c:\program files\Microsoft ActiveSync
2009-03-21 14:33 . 2008-03-06 08:24 -------- d-----w c:\program files\Microsoft.NET
2009-03-16 18:31 . 2008-06-17 21:46 -------- d-----w c:\program files\Save Flash
2009-03-13 10:59 . 2009-03-13 10:11 414432 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-02-22 11:21 . 2007-07-20 09:40 25930 ----a-w c:\windows\system32\drivers\FLockXP.sys
2008-09-01 17:56 . 2008-09-01 17:56 1378 ----a-w c:\program files\uninstal.log
2001-08-13 11:51 . 2001-08-13 11:51 1396337 ----a-w c:\program files\Captura.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tcactive"="c:\program files\The Cleaner\tca.exe" [2004-04-09 631808]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-07-16 798720]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-22 198160]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^MY PC^Start Menu^Programs^Startup^Webshots.lnk]
path=c:\documents and settings\MY PC\Start Menu\Programs\Startup\Webshots.lnk
backup=c:\windows\pss\Webshots.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
R1 is-P313Edrv;is-P313Edrv;c:\windows\system32\drivers\42665878.sys [23/04/2009 10:07 م 148496]
R2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [17/01/2008 09:37 م 24635]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/12/2008 12:54 ص 24652]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/12/2007 01:28 م 24592]
S2 CamelApache;CamelApache;"c:\camel\apache\apache.exe" --ntservice --> c:\camel\apache\apache.exe [?]
S3 AVPsys;AVPsys;\??\c:\windows\system32\drivers\cdaudio.sys --> c:\windows\system32\drivers\cdaudio.sys [?]
S3 CamelMysql;CamelMysql;c:\camel\mysql\bin\mysqld-nt.exe --defaults-file="c:\camel\mysql\ini\my.ini" CamelMysql --> c:\camel\mysql\bin\mysqld-nt.exe --defaults-file=c:\camel\mysql\ini\my.ini [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d5efcc5-f044-11dc-90ef-00300a50c81c}]
\Shell\AutoRun\command - H:\npee.com
\Shell\open\Command - H:\npee.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0ae79d2-9c4a-11dd-92f3-000e7f292cc9}]
\Shell\AutoRun\command - H:\upw.bat
\Shell\open\Command - H:\upw.bat
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://omania2.net/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: الدليل السريع - c:\windows\ww80.html
IE: {{46012076-ED62-464b-9554-AD0BEC35D1EC}
TCP: {3706C425-4A05-49D4-A4ED-10263751D6E9} = 212.72.23.4 212.72.1.186
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\MY PC\Application Data\Mozilla\Firefox\Profiles\wf7ckakk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - prefs.js: browser.startup.homepage - omania2.net
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=&query=
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-15 16:12
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mysql]
"ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1288)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1344)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(316)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\windows\system32\msi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll
.
Completion time: 2009-05-15 16:16
ComboFix-quarantined-files.txt 2009-05-15 12:16
ComboFix2.txt 2009-05-02 18:47
Pre-Run: 1,362,423,808 bytes free
Post-Run: 1,402,511,360 bytes free
192
