ComboFix 09-05-25.03 - KaRaM 05/25/2009 23:56.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.511.288 [GMT 3:00]
Running from: c:\documents and settings\KaRaM\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-25 to 2009-05-25 )))))))))))))))))))))))))))))))
.
2009-05-25 20:55 . 2009-05-25 20:55 -------- d-s---w c:\documents and settings\KaRaM\UserData
2009-05-25 20:25 . 2009-05-25 20:25 -------- d-----w c:\program files\Trend Micro
2009-05-25 19:44 . 2009-05-25 19:44 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials.حرررنكش\400000800002i\wlcomm.exe
2009-05-25 19:42 . 2009-05-25 19:42 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials.حرررنكش\4000003b900002i\msnmsgr.exe
2009-05-25 19:41 . 2009-05-25 19:42 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials.حرررنكش\10000002200002i\msiexec.exe
2009-05-25 16:25 . 2009-05-25 16:25 -------- d-----w c:\documents and settings\KaRaM\Application Data\Paltalk
2009-05-25 16:25 . 2009-05-25 16:25 -------- d-----w c:\windows\PaltalkScene
2009-05-25 16:24 . 2009-05-25 16:25 -------- d-----w c:\program files\Paltalk Messenger
2009-05-25 07:28 . 2009-05-25 07:28 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-25 07:27 . 2009-05-25 07:27 -------- d-----w c:\program files\Yahoo!
2009-05-25 07:14 . 2009-05-25 07:14 -------- d-----w c:\documents and settings\KaRaM\Application Data\VistaCodecs
2009-05-25 07:14 . 2009-05-25 07:14 -------- d-----w c:\program files\VistaCodecPack
2009-05-25 07:13 . 2009-05-25 07:13 -------- d-----w c:\documents and settings\All Users\Application Data\VistaCodecs
2009-05-25 07:00 . 2009-05-25 07:00 -------- d-----w c:\windows\srchasst
2009-05-25 07:00 . 2009-05-25 07:00 -------- d-----w c:\windows\system32\xircom
2009-05-25 07:00 . 2009-05-25 07:00 -------- d-----w c:\program files\microsoft frontpage
2009-05-25 03:08 . 2009-05-25 03:08 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials\1000000b00002i\verclsid.exe
2009-05-25 02:50 . 2009-05-25 02:50 34304 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Yahoo! Messenger\4000006300002i\yupdater.exe
2009-05-25 02:39 . 2009-05-25 02:39 -------- d-----w c:\documents and settings\KaRaM\Local Settings\Application Data\Yahoo
2009-05-25 02:32 . 2009-05-25 02:32 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials\4000006a00002i\iexplore.exe
2009-05-25 02:30 . 2009-05-25 02:30 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials\400000800002i\wlcomm.exe
2009-05-25 02:29 . 2009-05-25 02:29 90112 ----a-w c:\documents and settings\KaRaM\Application Data\Thinstall\Windows Live Essentials\10000002200002i\msiexec.exe
2009-05-25 02:18 . 2009-05-25 02:18 116144 ----a-w c:\documents and settings\KaRaM\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-05-25 02:18 . 2009-05-25 02:18 -------- d-----w c:\documents and settings\KaRaM\Application Data\IDM
2009-05-25 02:18 . 2009-05-25 02:18 -------- d-----w c:\documents and settings\KaRaM\Application Data\DMCache
2009-05-25 02:15 . 2009-05-25 02:15 -------- d-----w c:\documents and settings\KaRaM\Contacts
2009-05-25 02:13 . 2009-05-25 02:13 -------- d-----w c:\documents and settings\KaRaM\Application Data\Thinstall
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 07:37 . 2009-05-25 07:37 2232 ----a-w c:\windows\java\Packages\Data\3J7PV5JB.DAT
2009-05-25 07:37 . 2009-05-25 07:37 155995 ----a-w c:\windows\java\Packages\GQ3V1VFT.ZIP
2009-05-25 07:36 . 2009-05-25 07:36 2678 ----a-w c:\windows\java\Packages\Data\C6Z1ZVVF.DAT
2009-05-25 07:36 . 2009-05-25 07:36 2678 ----a-w c:\windows\java\Packages\Data\B17LR577.DAT
2009-05-25 07:36 . 2009-05-25 07:36 2678 ----a-w c:\windows\java\Packages\Data\WOHBXZD7.DAT
2009-05-25 07:36 . 2009-05-25 07:36 2678 ----a-w c:\windows\java\Packages\Data\H735FHBH.DAT
2009-05-25 07:36 . 2009-05-25 07:36 2678 ----a-w c:\windows\java\Packages\Data\EETB53RP.DAT
2009-05-25 01:27 . 2009-05-25 01:27 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-25 01:20 . 2009-05-25 01:20 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-08 15:18 . 2009-05-08 15:18 1034752 ----a-w c:\windows\system32\VSFilter.dll
2009-04-02 12:21 . 2009-04-02 12:21 84480 ----a-w c:\windows\system32\ff_vfw.dll
2009-03-13 20:25 . 2009-04-25 02:55 25088 ----a-w c:\windows\system32\msxml3a.dll
2009-03-02 09:29 . 2009-03-02 09:29 505128 ----a-w c:\windows\system32\msvcp71.dll
.
------- Sigcheck -------
[-] 2006-09-08 22:02 2198144 BA08992ECFB4B23B9204ADD12AB385EA c:\windows\system32\ntkrnlpa.exe
[-] 2006-09-08 20:01 2321024 EF63859E4FD9CB3EC31A111481F4B1B6 c:\windows\system32\ntoskrnl.exe
[-] 2006-09-08 21:48 1616896 7F9583EFF8102BCE8BD6716744018F83 c:\windows\explorer.exe
[-] 2006-09-09 06:45 125720 B04B182A92C119511DD3CDBE18602DB1 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\documents and settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ط§ظ„ظ‚ط«ظ…ظ€ظ‡ & ط²ظٹط²ظˆظ…\Internet Download Manager\IDMan.exe" [2007-10-11 08:40 925104]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2006-07-26 4617720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2008-08-04 88363]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-4-25 11057664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSimpleStartMenu"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\KaRaM\\Desktop\\YahooMessenge 8[1].1.401 ط§ظ„ظ‚ط«ظ…ظ‡ & ط²ظٹط²ظˆظˆظ…\\YahooMessenge 8.1.401 القثمه\\YahooMessenger.exe"=
"c:\\Documents and Settings\\KaRaM\\Desktop\\Portable Windows Live Messenger 2009 14.0.8064.0206\\Windows Live Messenger 2009 14.0.8064.0206.exe"=
"c:\\Documents and Settings\\KaRaM\\Desktop\\Portable Yahoo! Messenger 9.0.0.797\\Portable Yahoo! Messenger 9.0.0.797.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [5/25/2009 4:46 AM 182101]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [5/25/2009 4:56 AM 36352]
S3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [5/25/2009 4:46 AM 5689]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-msnmsgr - c:\documents and settings\KaRaM\Desktop\msn_portable_live_8_2\msn_portable_live_8\msn portable live 8\Msn portable live 8.exe
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=%s
IE: Download all links with IDM - c:\documents and settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ط§ظ„ظ‚ط«ظ…ظ€ظ‡ & ط²ظٹط²ظˆظ…\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\documents and settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ط§ظ„ظ‚ط«ظ…ظ€ظ‡ & ط²ظٹط²ظˆظ…\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\documents and settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ط§ظ„ظ‚ط«ظ…ظ€ظ‡ & ط²ظٹط²ظˆظ…\Internet Download Manager\IEExt.htm
TCP: {2CBFD96F-331F-4461-8EF7-F5B12D1C5AE7} = 163.121.128.134,163.121.128.135
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-26 00:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(2032)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(432)
c:\documents and settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ط§ظ„ظ‚ط«ظ…ظ€ظ‡ & ط²ظٹط²ظˆظ…\Internet Download Manager\idmmkb.dll
c:\windows\system32\SETUPAPI.dll
.
Completion time: 2009-05-25 0:03
ComboFix-quarantined-files.txt 2009-05-25 21:03
Pre-Run: 7,467,212,800 bytes free
Post-Run: 7,550,017,536 bytes free
142
ده تقرير الكومبو فيكس
وده تقرير الهاي جاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:05:47 AM, on 5/26/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ط§ظ„ظ‚ط«ظ…ظ€ظ‡ & ط²ظٹط²ظˆظ…\Internet Download Manager\IDMan.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Documents and Settings\KaRaM\Desktop\dotNetFx35setup.exe
d:\fa666e1c5e972c0450d4bf\setup.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =
=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Documents and Settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ?§U„U‚?«U…U€U‡ & ?²U??²UˆU…\Internet Download Manager\IDMIECC.dll (file missing)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ?§U„U‚?«U…U€U‡ & ?²U??²UˆU…\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ?§U„U‚?«U…U€U‡ & ?²U??²UˆU…\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ?§U„U‚?«U…U€U‡ & ?²U??²UˆU…\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\KaRaM\Desktop\Internet Download Manager 5[1].11 Build 8 ?§U„U‚?«U…U€U‡ & ?²U??²UˆU…\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2CBFD96F-331F-4461-8EF7-F5B12D1C5AE7}: NameServer = 163.121.128.134,163.121.128.135
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
--
End of file - 4499 bytes
في انتظار الرد
k: