وهذا تقرير الكمبو فكس
ComboFix 09-05-24.07 - Hook 05/25/2009 19:01.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.447.240 [GMT 3:00]
Running from: c:\documents and settings\Hook.HOOK-CD03ABBD97\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Mozilla Firefox\components\aa70de7a-2f6c-1b5c-caaf-2d382fd10e08.dll
c:\windows\IE4 Error Log.txt
.
((((((((((((((((((((((((( Files Created from 2009-04-25 to 2009-05-25 )))))))))))))))))))))))))))))))
.
2009-05-24 19:32 . 2009-05-24 19:32 -------- d-----w c:\documents and settings\Hook.HOOK-CD03ABBD97\Application Data\URSoft
2009-05-24 19:32 . 2009-05-25 06:58 -------- d---a-w c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-05-24 19:32 . 2009-05-24 19:32 -------- d-----w c:\program files\Your Uninstaller 2008
2009-05-21 16:52 . 2009-05-21 16:52 -------- d-sh--w c:\documents and settings\NetworkService.NT AUTHORITY\IETldCache
2009-05-19 16:18 . 2009-05-19 16:18 -------- d-sh--w c:\documents and settings\Hook.HOOK-CD03ABBD97\IECompatCache
2009-05-19 16:17 . 2009-05-19 16:17 -------- d-sh--w c:\documents and settings\Hook.HOOK-CD03ABBD97\PrivacIE
2009-05-19 16:12 . 2009-05-19 16:12 -------- d-sh--w c:\documents and settings\Hook.HOOK-CD03ABBD97\IETldCache
2009-05-19 16:10 . 2009-05-24 19:43 -------- d-----w c:\windows\ie8updates
2009-05-19 16:02 . 2009-05-19 16:09 -------- dc-h--w c:\windows\ie8
2009-05-06 14:16 . 2009-05-24 16:11 -------- d-----w C:\Garmin
2009-04-27 01:04 . 2009-04-27 01:04 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Messenger Plus!
2009-04-27 00:50 . 2009-04-27 00:50 -------- d-----w c:\program files\Windows Live
2009-04-27 00:50 . 2009-04-27 00:50 -------- d-----w c:\program files\Messenger Plus! Live
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 16:08 . 2009-01-07 23:23 -------- d-----w c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2009-05-25 16:06 . 2009-01-07 23:23 3864 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-25 16:06 . 2009-01-07 23:23 507936 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-25 16:06 . 2009-01-07 23:23 2308128 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-25 16:06 . 2009-01-07 23:23 19112 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-25 04:29 . 2009-02-13 12:46 -------- d-----w c:\program files\Google
2009-05-24 19:39 . 2009-01-26 19:53 -------- d-----w c:\program files\BandRich
2009-05-20 12:41 . 2009-01-07 23:24 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-20 12:41 . 2009-01-07 23:24 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-27 00:50 . 2008-09-04 20:13 -------- d-----w c:\program files\MSN Messenger
2009-04-10 17:49 . 2009-02-09 20:11 85747 -c--a-w c:\windows\system32\3ef73fb2-63b0-bbd5-fe66-3cff030157d7.exe
2009-04-09 10:47 . 2009-04-09 10:47 714752 ----a-w c:\windows\system32\nso322.dll
2009-03-16 13:34 . 2008-07-31 15:31 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-03-16 13:34 . 2008-07-31 15:31 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-03-16 13:29 . 2009-03-16 13:29 390664 -c--a-w c:\documents and settings\Hook.HOOK-CD03ABBD97\Application Data\Real\RealPlayer\setup\AU_setup6.exe
2009-03-08 01:34 . 2004-08-04 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-04 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-04 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-04 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-04 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-04 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-04 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-04 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-04 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2004-08-04 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2004-08-04 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2003-08-27 22:19 . 2003-12-02 23:14 36963 -c--a-r c:\program files\Common Files\SM1updtr.dll
2008-12-03 22:09 . 2008-12-03 22:09 1379921 -csh--w c:\windows\system32\uhudezuk.tmp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{383ba4ef-ba4c-f467-647c-8e18f408bfbb}]
2009-04-09 10:47 714752 ----a-w c:\windows\system32\nso322.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-10 201992]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-16 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DIRECWAY\\BIN\\dpcnav.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [1/29/2008 6:29 PM 33808]
R2 permmgr;permmgr;c:\windows\system32\drivers\permmgr.sys [8/26/2008 6:44 PM 5412]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [3/13/2008 7:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [3/25/2008 8:07 PM 24592]
S2 gupdate1c98dd965bd4af6;Google Update Service (gupdate1c98dd965bd4af6);c:\program files\Google\Update\GoogleUpdate.exe [2/13/2009 3:48 PM 133104]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys --> c:\windows\system32\DRIVERS\br3gmdm.sys [?]
S3 DPCNET5U;Satellite USB Driver;c:\windows\system32\drivers\dpcnet5u.sys [8/26/2008 6:32 PM 164557]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 12:48]
2009-05-25 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-25 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-25 c:\windows\Tasks\User_Feed_Synchronization-{94A28695-F090-4DDB-818F-E39A844D4604}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.222z.net/old
uInternet Connection Wizard,ShellNext = iexplore
TCP: {83026818-280F-4271-81BA-332661723862} = 195.238.50.254,195.238.40.45
TCP: {B3EBB9B0-FE99-4955-9ADB-ED70413B4A0F} = 195.238.50.254,195.238.40.45,62.128.191.6
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Hook.HOOK-CD03ABBD97\Application Data\Mozilla\Firefox\Profiles\t2gk2uaf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www4.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://www.222z.net/old
FF - prefs.js: keyword.URL - hxxp://www4.yoog.com/search.php?q=
FF - prefs.js: network.proxy.ftp - 192.168.0.1
FF - prefs.js: network.proxy.ftp_port - 83
FF - prefs.js: network.proxy.gopher - 192.168.0.1
FF - prefs.js: network.proxy.gopher_port - 83
FF - prefs.js: network.proxy.http - 192.168.0.1
FF - prefs.js: network.proxy.http_port - 83
FF - prefs.js: network.proxy.socks - 192.168.0.1
FF - prefs.js: network.proxy.socks_port - 83
FF - prefs.js: network.proxy.ssl - 192.168.0.1
FF - prefs.js: network.proxy.ssl_port - 83
FF - prefs.js: network.proxy.type - 2
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www4.yoog.com/search.php?q=
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www4.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-25 19:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(976)
c:\windows\system32\klogon.dll
- - - - - - - > 'explorer.exe'(3432)
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\progra~1\DIRECWAY\BIN\dpcproxy.exe
.
**************************************************************************
.
Completion time: 2009-05-25 19:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-25 16:17
ComboFix2.txt 2008-09-15 12:11
ComboFix3.txt 2008-09-14 17:54
Pre-Run: 48,928,645,120 bytes free
Post-Run: 48,989,720,576 bytes free
175 --- E O F --- 2009-05-25 15:49