تفضل يا غالي
هذا التقرير حق الاداة
ComboFix 09-05-16.05 - MN 05/17/2009 14:58.5 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.383.215 [GMT 3:00]
Running from: c:\documents and settings\MN\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\IE4 Error Log.txt
.
((((((((((((((((((((((((( Files Created from 2009-04-17 to 2009-05-17 )))))))))))))))))))))))))))))))
.
2009-05-17 11:10 . 2009-05-17 11:10 -------- d-----w c:\program files\GVR
2009-05-16 18:48 . 2009-05-16 18:48 -------- d-----w c:\program files\Common Files\SWF Studio
2009-05-16 18:41 . 2001-09-28 14:00 164864 ----a-w c:\windows\system32\UNWISE.EXE
2009-05-16 10:54 . 2009-05-16 10:54 -------- d-s---w c:\documents and settings\MN\UserData
2009-05-16 08:13 . 2009-05-16 08:13 -------- d-----w c:\documents and settings\MN\Application Data\Thinstall
2009-05-15 14:02 . 2007-12-24 10:47 7680 ----a-w c:\windows\system32\ff_vfw.dll
2009-05-15 14:02 . 2007-11-29 09:52 60273 ----a-w c:\windows\system32\pthreadGC2.dll
2009-05-15 14:01 . 2009-05-15 14:02 -------- d-----w c:\program files\ffdshow
2009-05-15 13:21 . 2009-05-15 13:21 -------- d-----w C:\OutputFolder
2009-05-15 13:00 . 2009-05-15 13:00 -------- d-----w c:\documents and settings\MN\Application Data\GetRightToGo
2009-05-15 11:33 . 2009-05-15 12:05 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-15 11:33 . 2009-05-15 12:05 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-15 11:32 . 2009-05-17 10:44 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-15 11:32 . 2009-05-17 10:44 32 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-15 11:32 . 2009-05-15 11:32 -------- d-----w c:\program files\Kaspersky Lab
2009-05-15 11:32 . 2009-05-15 11:32 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-14 06:51 . 2009-05-14 06:51 168208 ----a-w c:\windows\system32\guard32.dll
2009-05-14 05:57 . 2009-05-14 05:57 -------- d-----w c:\documents and settings\MN\Local Settings\Application Data\Help
2009-05-13 14:54 . 2009-05-13 14:54 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-13 07:55 . 2009-05-14 06:36 253688 ----a-w c:\windows\system32\cssdll32.dll
2009-05-12 15:53 . 2009-05-12 15:53 -------- d-----w c:\documents and settings\MN\Application Data\Daimler
2009-05-12 14:34 . 2009-05-12 14:34 -------- d-----w c:\documents and settings\MN\Application Data\Local Settings
2009-05-12 14:34 . 2009-05-12 14:34 37376 ----a-w c:\windows\system32\drivers\WMDrive.sys
2009-05-12 08:59 . 2009-05-12 09:00 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-12 05:21 . 2009-05-12 05:21 0 ----a-w c:\windows\nsreg.dat
2009-05-11 18:03 . 2001-08-17 10:48 17664 ----a-w c:\windows\system32\dllcache\sermouse.sys
2009-05-11 18:03 . 2001-08-17 10:48 17664 ----a-w c:\windows\system32\drivers\sermouse.sys
2009-05-11 17:23 . 2009-05-12 07:40 4212 ---ha-w c:\windows\system32\zllictbl.dat
2009-05-11 17:21 . 2009-05-11 17:21 -------- d-----w c:\windows\Internet Logs
2009-05-11 14:12 . 2009-05-11 14:12 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-05-11 08:42 . 2009-05-11 08:42 -------- d-----w c:\documents and settings\All Users\Application Data\RoboForm
2009-05-11 05:55 . 2009-05-11 06:00 89088 ----a-w c:\windows\system32\mpeg2lib.dll
2009-05-10 10:30 . 2009-05-10 10:30 -------- d-----w c:\documents and settings\MN\Application Data\FLVPlayer4Free
2009-05-10 09:17 . 2009-05-10 09:17 -------- d-----w c:\windows\system32\scripting
2009-05-10 09:17 . 2009-05-10 09:17 -------- d-----w c:\windows\l2schemas
2009-05-10 09:17 . 2009-05-10 09:17 -------- d-----w c:\windows\system32\en
2009-05-10 09:17 . 2009-05-10 09:17 -------- d-----w c:\windows\system32\bits
2009-05-10 09:12 . 2009-05-10 09:12 -------- d-----w c:\windows\ServicePackFiles
2009-05-09 16:14 . 2009-05-09 16:14 -------- d-----w c:\program files\Yahoo!
2009-05-09 16:14 . 2009-05-09 16:14 -------- d-----w c:\program files\CCleaner
2009-05-08 16:02 . 2009-05-08 16:02 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-08 15:12 . 2009-05-08 15:12 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-08 07:24 . 2009-05-08 07:24 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-07 10:41 . 2009-05-07 10:41 -------- d-----w c:\windows\system32\LogFiles
2009-05-07 08:12 . 2009-05-07 08:12 -------- d-----w c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-05-07 07:06 . 2007-04-09 10:23 28040 ----a-w c:\windows\system32\mdimon.dll
2009-05-07 07:04 . 2009-05-07 07:04 -------- d-----w c:\program files\Microsoft.NET
2009-05-07 07:02 . 2009-05-07 07:02 -------- d-----w c:\program files\Microsoft Works
2009-05-07 07:01 . 2009-05-07 07:01 -------- d-----w c:\windows\SHELLNEW
2009-05-07 06:39 . 2009-05-07 06:39 -------- d-----w c:\documents and settings\MN\Local Settings\Application Data\Adobe
2009-05-06 20:24 . 2009-05-06 20:24 -------- d-----w c:\documents and settings\MN\Application Data\CyberScrub
2009-05-06 20:23 . 2009-05-06 20:24 -------- d-----w c:\documents and settings\MN\Application Data\cleaner
2009-05-06 20:07 . 2009-05-06 20:07 -------- d-----w c:\documents and settings\MN\Local Settings\Application Data\Identities
2009-05-06 19:17 . 2009-05-06 19:17 -------- d-----w c:\documents and settings\MN\Application Data\TeamViewer
2009-05-06 19:16 . 2009-05-06 19:16 -------- d-----w c:\program files\TeamViewer
2009-05-06 19:15 . 2009-05-06 19:15 -------- d-----w c:\documents and settings\MN\temp
2009-05-06 17:22 . 2008-06-13 11:05 272128 ------w c:\windows\system32\dllcache\bthport.sys
2009-05-06 17:22 . 2008-06-13 11:05 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-05-06 16:24 . 2009-03-06 13:22 284160 ------w c:\windows\system32\dllcache\pdh.dll
2009-05-06 16:24 . 2009-02-09 11:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-05-06 16:24 . 2009-02-06 10:11 110592 ------w c:\windows\system32\dllcache\services.exe
2009-05-06 16:24 . 2009-02-09 11:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-05-06 16:24 . 2009-02-06 09:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-06 16:24 . 2009-02-09 11:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-06 16:24 . 2009-02-09 11:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-05-06 16:24 . 2009-02-09 11:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-05-06 16:24 . 2009-02-09 11:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-05-06 16:24 . 2009-02-06 10:06 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-06 16:24 . 2009-02-06 10:08 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-06 16:24 . 2009-02-06 09:32 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-06 16:13 . 2008-04-11 18:04 691712 ------w c:\windows\system32\dllcache\inetcomm.dll
2009-05-06 16:04 . 2008-05-03 10:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-06 16:04 . 2008-04-21 11:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe
2009-05-06 15:22 . 2008-05-08 13:02 203136 ------w c:\windows\system32\dllcache\rmcast.sys
2009-05-06 15:21 . 2008-10-24 10:21 455296 ------w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-06 15:20 . 2008-12-11 09:57 333952 ------w c:\windows\system32\dllcache\srv.sys
2009-05-06 15:15 . 2008-10-15 15:34 337408 ------w c:\windows\system32\dllcache\netapi32.dll
2009-05-06 14:59 . 2007-08-10 17:46 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-06 14:59 . 2009-05-06 14:59 -------- d--h--w c:\windows\$hf_mig$
2009-05-06 14:53 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-05-06 14:39 . 2009-05-06 14:39 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-06 14:35 . 2008-04-13 18:45 6272 ----a-w c:\windows\system32\drivers\splitter.sys
2009-05-06 14:35 . 2008-04-13 19:17 83072 ----a-w c:\windows\system32\drivers\wdmaud.sys
2009-05-06 14:34 . 2008-04-13 18:45 52864 ----a-w c:\windows\system32\drivers\DMusic.sys
2009-05-06 14:34 . 2008-04-13 18:45 56576 ----a-w c:\windows\system32\drivers\swmidi.sys
2009-05-06 14:34 . 2008-04-13 16:39 142592 ----a-w c:\windows\system32\drivers\aec.sys
2009-05-06 14:34 . 2008-04-13 18:45 172416 ----a-w c:\windows\system32\drivers\kmixer.sys
2009-05-06 14:34 . 2008-04-13 18:45 2944 ----a-w c:\windows\system32\drivers\drmkaud.sys
2009-05-06 14:34 . 2008-04-13 19:15 60800 ----a-w c:\windows\system32\drivers\sysaudio.sys
2009-05-06 14:34 . 2008-04-13 18:39 7552 ----a-w c:\windows\system32\drivers\mskssrv.sys
2009-05-06 14:34 . 2008-04-13 18:39 4992 ----a-w c:\windows\system32\drivers\mspqm.sys
2009-05-06 14:34 . 2008-04-13 18:39 5376 ----a-w c:\windows\system32\drivers\mspclock.sys
2009-05-06 14:33 . 2004-09-07 05:23 156672 ----a-r c:\windows\system32\RTLCPAPI.dll
2009-05-06 14:33 . 2004-11-17 07:11 9319936 ----a-r c:\windows\system32\RTLCPL.EXE
2009-05-06 14:32 . 2004-11-15 09:20 77824 ----a-r c:\windows\SOUNDMAN.EXE
2009-05-06 14:32 . 2004-11-17 10:05 2297664 ----a-r c:\windows\system32\drivers\ALCXWDM.SYS
2009-05-06 14:32 . 2008-04-13 19:19 146048 ----a-w c:\windows\system32\drivers\portcls.sys
2009-05-06 14:32 . 2008-04-14 00:11 4096 ----a-w c:\windows\system32\ksuser.dll
2009-05-06 14:32 . 2008-04-13 18:45 60160 ----a-w c:\windows\system32\drivers\drmk.sys
2009-05-06 13:23 . 2009-05-06 13:23 -------- d-----w c:\documents and settings\MN\Contacts
2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\program files\Circe Developement
2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\documents and settings\MN\Local Settings\Application Data\ESET
2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\program files\Windows Live
2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-06 13:19 . 2009-05-06 13:19 -------- d-----w c:\windows\system32\DRVSTORE
2009-05-06 13:19 . 2009-05-06 13:19 -------- d-----w c:\program files\MSN Messenger
2009-05-06 12:58 . 2009-05-06 12:58 -------- d-----w c:\program files\Common Files\Adobe
2009-05-06 12:56 . 2009-05-06 12:56 -------- d-----w c:\program files\Common Files\xing shared
2009-05-06 12:56 . 2009-05-06 12:56 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-06 12:56 . 2009-05-06 12:56 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-06 12:56 . 2009-05-06 12:56 -------- d-----w c:\program files\Common Files\Real
2009-05-06 12:56 . 2009-05-06 12:56 -------- d-----w c:\program files\Real
2009-05-06 12:53 . 2009-05-06 12:53 -------- d-----w c:\documents and settings\MN\Application Data\URSoft
2009-05-06 12:53 . 2009-05-06 12:53 -------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2009-05-06 12:53 . 2009-05-06 12:53 -------- d-----w c:\program files\Your Uninstaller 2008
2009-05-06 12:50 . 2009-05-06 12:50 -------- d-----w c:\documents and settings\MN\Application Data\IDM
2009-05-06 12:50 . 2009-05-06 12:50 -------- d-----w c:\documents and settings\MN\Application Data\DMCache
2009-05-06 12:50 . 2009-05-06 12:50 -------- d-----w c:\program files\Internet Download Manager
2009-05-06 12:47 . 2009-05-06 12:47 -------- d-----w c:\program files\Quranzu1
2009-05-06 12:47 . 2008-10-16 11:09 43544 ----a-w c:\windows\system32\wups2.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-17 10:44 . 2009-05-15 11:32 32 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-17 10:44 . 2009-05-15 11:32 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-15 12:05 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-13 08:16 . 2009-05-06 11:55 91504 ----a-w c:\documents and settings\MN\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-06 11:47 . 2009-05-06 11:47 -------- d-----w c:\program files\microsoft frontpage
2009-05-06 11:43 . 2009-05-06 11:43 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-06 11:07 . 2009-05-06 11:07 -------- d-----w c:\program files\InstallShield Installation Information
2009-05-06 11:07 . 2009-05-06 11:07 -------- d-----w c:\program files\Nokia
2009-05-06 11:07 . 2009-05-06 11:07 -------- d-----w c:\program files\Common Files\Nokia
2009-05-06 11:06 . 2009-05-06 11:06 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-06 13:22 . 2004-05-23 09:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-20 07:11 . 2004-05-23 09:00 666112 ----a-w c:\windows\system32\wininet.dll
2009-02-20 07:10 . 2004-05-23 09:00 81920 ----a-w c:\windows\system32\ieencode.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-05-13_17.32.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-11 16:58 . 2008-11-11 16:58 25601 c:\windows\system32\drivers\klopp.dat
+ 2008-04-30 14:06 . 2008-04-30 14:06 24592 c:\windows\system32\drivers\klim5.sys
+ 2008-03-13 15:02 . 2008-03-13 15:02 26640 c:\windows\system32\drivers\klfltdev.sys
+ 2009-05-16 18:41 . 2000-06-08 14:00 409600 c:\windows\system32\Macromed\Shockwave 8\PluginPing.dll
+ 2008-11-11 17:00 . 2008-11-11 17:00 218376 c:\windows\system32\klogon.dll
+ 2009-05-15 11:32 . 2009-05-15 12:05 226832 c:\windows\system32\drivers\klif.sys
+ 2008-07-21 14:34 . 2008-07-21 14:34 121872 c:\windows\system32\drivers\kl1.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-06 185872]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-11-15 77824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 5:29 PM 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/13/2008 6:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [4/30/2008 5:06 PM 24592]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\g:\ntglm7x.sys --> g:\NTGLM7X.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.jo/
mStart Page = about:blank
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {43D9AD92-09D3-451D-9219-D094BE16D0C6} = 196.27.0.35 196.27.0.230
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-17 15:01
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-17 15:03
ComboFix-quarantined-files.txt 2009-05-17 12:03
ComboFix2.txt 2009-05-16 14:44
ComboFix3.txt 2009-05-13 17:33
Pre-Run: 2,928,918,528 bytes free
Post-Run: 3,026,083,840 bytes free
214 --- E O F --- 2009-05-13 09:34
k: