هذا تقرير ببرنامج
ComboFix
ComboFix 09-05-23.01 - user 05/23/2009 22:22.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.494.220 [GMT 3:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Microsoft Common
c:\program files\Microsoft Common\emails.dat
c:\program files\Microsoft Common\log.dat
c:\windows\system32\alrsvcs.exe
.
---- Previous Run -------
.
c:\program files\Microsoft Common
c:\program files\Microsoft Common\emails.dat
c:\program files\Microsoft Common\log.dat
c:\program files\Microsoft Common\svchost.exe
c:\program files\Microsoft Common\wuacult.exe
c:\windows\system32\digiwet.dll
E:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_OREANS32
-------\Legacy_SHELLHWDETECTIONTHEMES
-------\Service_oreans32
-------\Service_ShellHWDetectionThemes
((((((((((((((((((((((((( Files Created from 2009-04-23 to 2009-05-23 )))))))))))))))))))))))))))))))
.
2009-05-23 19:17 . 2009-05-23 19:17 20480 ----a-w c:\documents and settings\user\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-6357014b-n\gluegen-rt.dll
2009-05-18 19:38 . 2009-05-18 19:42 53248 ----a-w c:\windows\PSEXESVC.EXE
2009-05-17 14:29 . 2004-05-23 12:00 2944 -c--a-w c:\windows\system32\dllcache\null.sys
2009-05-17 14:29 . 2004-05-23 12:00 2944 ----a-w c:\windows\system32\drivers\null.sys
2009-05-17 14:29 . 2004-05-23 12:00 4224 -c--a-w c:\windows\system32\dllcache\beep.sys
2009-05-17 14:29 . 2004-05-23 12:00 4224 ----a-w c:\windows\system32\drivers\beep.sys
2009-05-17 14:28 . 2009-05-17 14:28 32 --s-a-w c:\windows\system32\340401571.dat
2009-05-14 08:19 . 2009-05-14 08:19 -------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2009-05-14 08:14 . 2009-05-14 11:33 -------- d-----w c:\program files\Sony Ericsson
2009-05-13 22:40 . 2009-05-13 22:40 33824 ----a-w c:\windows\system32\drivers\oreans32.sys
2009-05-09 09:08 . 2009-05-09 09:08 -------- d-----w c:\documents and settings\user\Local Settings\Application Data\Help
2009-05-09 02:06 . 2009-05-09 02:06 152576 ----a-w c:\documents and settings\user\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-05 00:23 . 2009-05-23 19:26 81984 ----a-w c:\windows\system32\bdod.bin
2009-05-04 23:56 . 2009-05-04 23:56 -------- d-----w c:\documents and settings\user\Application Data\BitDefender
2009-05-04 23:55 . 2009-05-05 00:00 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-04 23:55 . 2009-05-04 23:55 -------- d-----w c:\program files\BitDefender
2009-05-04 23:54 . 2009-05-04 23:56 -------- d-----w c:\program files\Common Files\BitDefender
2009-05-04 19:32 . 2009-05-04 19:54 -------- d-----w c:\program files\Common Files\delet
2009-05-03 09:12 . 2008-06-19 13:24 28544 ----a-w c:\windows\system32\drivers\pavboot.sys
2009-05-03 09:12 . 2009-05-03 09:12 -------- d-----w c:\program files\Panda Security
2009-05-03 08:56 . 2009-05-03 09:24 -------- d-----w c:\windows\BDOSCAN8
2009-05-03 05:02 . 2009-05-03 05:02 -------- d-----w c:\program files\AxBx
2009-05-02 20:03 . 2009-05-02 20:03 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-02 20:03 . 2009-05-02 20:05 -------- d-----w c:\program files\MpcStar
2009-05-01 12:46 . 2009-05-01 12:46 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-01 12:11 . 2009-05-23 18:32 -------- d-----w c:\documents and settings\user\Tracing
2009-05-01 12:09 . 2009-05-01 12:09 -------- d-----w c:\program files\Microsoft Sync Framework
2009-05-01 12:08 . 2006-11-29 10:06 3426072 ----a-w c:\windows\system32\d3dx9_32.dll
2009-05-01 12:07 . 2009-05-01 12:07 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-05-01 12:05 . 2009-05-01 12:05 -------- d-----w c:\program files\Microsoft
2009-05-01 12:05 . 2009-05-01 12:05 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-01 12:04 . 2009-05-01 12:09 -------- d-----w c:\program files\Windows Live
2009-05-01 11:58 . 2009-05-01 11:58 -------- d-----w c:\program files\Common Files\Windows Live
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-23 19:31 . 2008-11-29 18:27 -------- d-----w c:\documents and settings\user\Application Data\DMCache
2009-05-23 19:17 . 2008-11-29 18:23 -------- d-----w c:\documents and settings\user\Application Data\Azureus
2009-05-14 08:14 . 2008-11-30 03:36 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-13 22:40 . 2008-11-29 18:27 -------- d-----w c:\documents and settings\user\Application Data\IDM
2009-05-12 19:46 . 2009-02-08 17:53 -------- d-----w c:\program files\Google
2009-05-09 02:08 . 2008-11-30 05:19 -------- d-----w c:\program files\Java
2009-05-04 23:39 . 2009-01-11 00:55 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-03 14:47 . 2009-04-10 11:03 -------- d-----w c:\program files\Hotspot_Shield
2009-05-01 20:26 . 2009-04-17 15:19 -------- d-----w c:\program files\avisplit
2009-05-01 12:16 . 2008-11-30 05:19 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-01 12:10 . 2008-11-30 05:18 97552 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 19:39 . 2008-11-29 23:28 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-04-19 10:53 . 2008-12-31 01:19 -------- d-----w c:\program files\eMule
2009-04-17 15:42 . 2009-04-17 15:42 -------- d-----w c:\program files\Boilsoft Video Splitter
2009-04-17 14:00 . 2009-04-17 14:00 -------- d-----w c:\program files\Zealot Software
2009-04-17 12:02 . 2009-04-17 12:02 -------- d-----w c:\program files\Witcobber
2009-04-10 17:17 . 2008-11-29 18:21 -------- d-----w c:\program files\Vuze
2009-04-10 11:04 . 2009-01-02 13:40 -------- d-----w c:\program files\Hotspot Shield
2009-04-10 11:03 . 2009-04-10 11:03 -------- d-----w c:\program files\Conduit
2009-04-05 22:54 . 2009-04-05 22:52 -------- d-----w c:\documents and settings\user\Application Data\Paltalk
2009-04-05 22:53 . 2009-04-05 22:51 -------- d-----w c:\program files\Paltalk Messenger
2009-04-03 18:18 . 2009-04-10 11:01 33256 ----a-w c:\windows\system32\drivers\hssdrv.sys
2009-03-23 06:49 . 2009-03-23 06:49 152576 ----a-w c:\documents and settings\user\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-03-19 13:58 . 2009-03-19 13:58 194840 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-03-19 04:58 . 2004-05-23 12:00 12528 ----a-w c:\windows\system32\drivers\secdrv.sys
2009-03-19 03:48 . 2009-03-19 03:48 223128 ----a-w c:\windows\system32\drivers\vaxscsi.sys
2009-03-19 03:39 . 2009-03-19 03:39 96256 ----a-w c:\windows\system32\drivers\sptd4253.sys
2009-03-19 03:39 . 2009-03-19 03:39 642560 ----a-w c:\windows\system32\drivers\sptd.sys
2009-03-09 02:19 . 2008-12-18 10:07 410984 ----a-w c:\windows\system32\deploytk.dll
2008-12-29 00:09 . 2009-01-05 11:01 3072 ----a-w c:\program files\Microsofts.exe
2009-03-05 15:08 . 2009-05-05 00:01 49664 ----a-w c:\program files\mozilla firefox\components\FFComm.dll
.
((((((((((((((((((((((((((((( SnapShot_2009-05-18_19.44.04 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-23 19:29 . 2009-05-23 19:29 16384 c:\windows\Temp\Perflib_Perfdata_278.dat
+ 2009-01-10 21:38 . 2009-05-23 19:04 7494992 c:\windows\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2009-05-03 14:47 1883672 ----a-w c:\program files\Hotspot_Shield\tbHot1.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-04-10 11:01 332776 ----a-w c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-05-23 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2007-10-11 802816]
"RemoveIT Pro v7Ent"="c:\program files\InCode Solutions\RemoveIT Pro v7 Enterprise\removeit.exe" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-02 118784]
"QuickTime Task"="c:\program files\MpcStar\Codecs\QuickTime\QTSystem\qttask.exe" [2009-05-02 282624]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-08 778240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-30 185896]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-1-28 10950144]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Adobe\\Acrobat 9.0\\Designer 8.2\\FormDesigner.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/05/2009 12:12 م 28544]
R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [06/10/2008 06:16 م 82696]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [03/04/2009 09:18 م 364008]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [18/09/2008 12:09 م 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [12/02/2009 04:52 م 104328]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\hssdrv.sys [10/04/2009 02:01 م 33256]
S1 glaide32;glaide32;\??\c:\windows\system32\drivers\glaide32.sys --> c:\windows\system32\drivers\glaide32.sys [?]
S2 gupdate1c98a162ebc8d90;Google Update Service (gupdate1c98a162ebc8d90);c:\program files\Google\Update\GoogleUpdate.exe [08/02/2009 08:53 م 133104]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [20/01/2009 07:16 م 172032]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder
2009-05-23 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-08 17:53]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyServer = 212.116.219.52:80
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: IDM بواسطة FLV تحميل محتوى فيديو - c:\program files\Internet Download Manager\IEGetVL.htm
IE: IDM تحميل بواسطة - c:\program files\Internet Download Manager\IEExt.htm
IE: IDM تحميل جميع الروابط بواسطة - c:\program files\Internet Download Manager\IEGetAll.htm
TCP: {37C487D7-3153-4A4B-9B32-7340F05B6FB2} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\sl6cujhd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1970595&SearchSource=3&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.aldahereyah.net/forums
FF - component: c:\documents and settings\user\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\sl6cujhd.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
FF - component: c:\program files\Google\Google Gears\Firefox\components\gears.dll
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvlc.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-23 22:30
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{6d701890-71e8-4999-92fa-70f7a57c7f8f}]
@Denied: (Full) (Everyone)
"Model"=dword:0000005d
"Therad"=dword:0000001e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,d9,3b,af,b2,3b,cc,0b,7d,10,7d,21,64,b9,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):eb,45,2d,50,84,54,73,8b,ae,be,87,23,5a,00,f2,65,10,d6,64,4b,04,
74,e4,5c,b1,63,4c,c5,21,80,0d,f9,15,a9,9b,9d,a5,3d,b6,11,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3956)
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2009-05-23 22:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-23 19:40
ComboFix2.txt 2009-05-10 08:15
ComboFix3.txt 2009-05-04 23:49
ComboFix4.txt 2009-05-04 01:18
Pre-Run: 18,422,767,616 bytes free
Post-Run: 18,404,798,464 bytes free
233
