هلا اخوي
وهدا التقرير
ComboFix 09-06-06.03 - Administrator 06/07/2009 4:37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1015.625 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
c:\windows\system32\tmp.reg
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-07 to 2009-06-07 )))))))))))))))))))))))))))))))
.
2009-06-06 18:40 . 2009-06-06 18:40 -------- d-----w- c:\program files\Trend Micro
2009-06-01 16:05 . 2009-06-01 16:05 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-06-01 16:05 . 2009-06-01 16:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\AdobeUM
2009-06-01 16:05 . 2009-06-01 16:05 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-01 16:01 . 2009-06-01 16:01 -------- d-----w- c:\windows\Cache
2009-05-29 10:12 . 2009-05-29 10:12 15890 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2009-05-29 10:11 . 2009-06-06 18:46 -------- d-----w- c:\program files\DWL-G520M Wireless 108G MIMO PCI Adapter
2009-05-18 16:47 . 2009-05-18 16:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-05-18 11:14 . 2009-05-18 11:14 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-05-18 11:14 . 2009-05-18 11:14 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-05-18 11:14 . 2009-05-18 11:14 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-05-18 10:56 . 2009-05-21 00:04 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-18 10:56 . 2009-05-21 00:04 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-18 10:56 . 2009-06-07 01:40 2304544 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-18 10:56 . 2009-06-07 01:40 204832 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-18 03:54 . 2009-05-18 03:54 0 ----a-w- c:\windows\nsreg.dat
2009-05-18 03:54 . 2009-05-18 03:54 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-05-14 23:06 . 2009-05-14 23:09 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-05-14 19:27 . 2009-05-14 19:27 98304 ----a-w- c:\windows\system32\viscomtran.dll
2009-05-12 17:04 . 2009-05-12 17:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-12 14:55 . 2009-05-18 13:58 172032 ------w- c:\windows\Setup1.exe
2009-05-12 14:55 . 2009-05-18 13:58 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-05-12 13:56 . 2009-06-07 01:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-12 12:01 . 2009-05-12 12:01 181680 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-05-12 11:34 . 2009-05-12 11:34 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero
2009-05-12 09:57 . 2009-05-12 09:58 -------- d-----w- c:\windows\system32\NtmsData
2009-05-12 09:42 . 2009-05-12 09:42 171008 ----a-w- c:\windows\system32\GeeKz_db.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 01:40 . 2009-05-18 10:56 2828 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-07 01:40 . 2009-05-18 10:56 22228 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-07 01:36 . 2009-05-03 22:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\DMCache
2009-05-29 10:11 . 2009-05-02 09:03 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-19 05:58 . 2009-05-02 08:35 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-18 13:24 . 2009-05-03 22:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\IDM
2009-05-18 11:14 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-05-15 21:39 . 2009-05-02 16:44 -------- d-----w- c:\program files\Kaspersky Lab
2009-05-15 19:42 . 2009-05-04 12:00 -------- d-----w- c:\program files\Common Files\Real
2009-05-14 23:03 . 2009-05-14 23:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\CyberScrub
2009-05-14 23:03 . 2009-05-14 23:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\cleaner
2009-05-12 12:00 . 2009-05-03 22:20 -------- d-----w- c:\program files\Internet Download Manager
2009-05-12 01:58 . 2009-05-02 16:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-05 02:09 . 2009-05-04 11:59 -------- d-----w- c:\program files\Windows Media Connect 2
2009-05-04 12:28 . 2009-05-04 12:00 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-04 12:28 . 2009-05-03 22:08 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-04 12:11 . 2009-05-04 12:11 390664 ----a-w- c:\documents and settings\Administrator\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-04 07:30 . 2009-05-04 07:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-05-04 07:26 . 2009-05-04 07:26 -------- d-----w- c:\program files\Ares
2009-05-03 22:14 . 2009-05-03 22:09 -------- d-----w- c:\program files\Google
2009-05-03 22:09 . 2009-05-03 22:08 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-03 13:08 . 2009-05-03 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-03 13:05 . 2009-05-03 13:05 -------- d-----w- c:\program files\Circle Developemen
2009-05-03 13:05 . 2009-05-03 13:05 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-03 12:57 . 2009-05-03 12:57 -------- d-----w- c:\program files\Nero
2009-05-03 12:57 . 2009-05-03 12:57 -------- d-----w- c:\program files\Common Files\Nero
2009-05-03 12:57 . 2009-05-03 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-05-03 12:56 . 2009-05-03 12:56 -------- d-----w- c:\program files\Windows Live
2009-05-02 09:04 . 2009-05-02 09:04 -------- d-----w- c:\program files\GIGABYTE
2009-05-02 09:04 . 2009-05-02 09:04 -------- d-----w- c:\program files\BroadCom GB LAN
2009-05-02 09:03 . 2009-05-02 09:03 -------- d-----w- c:\program files\Realtek
2009-05-02 09:03 . 2009-05-02 09:03 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-02 08:59 . 2009-05-02 08:59 -------- d-----w- c:\program files\Intel
2009-05-02 08:58 . 2009-05-02 08:58 27824 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-02 08:43 . 2009-05-02 08:43 -------- d-----w- c:\program files\microsoft frontpage
2009-05-02 08:40 . 2009-05-02 08:40 83160 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-02 08:39 . 2009-05-02 08:39 -------- d-----w- c:\program files\MSBuild
2009-05-02 08:39 . 2009-05-02 08:39 -------- d-----w- c:\program files\Reference Assemblies
2009-05-02 08:33 . 2009-05-02 08:33 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-04-11 13:58 . 2009-04-11 13:58 1614848 ----a-w- c:\windows\system32\sfcfiles.dll
2009-04-11 13:58 . 2009-04-11 13:58 209 ----a-w- c:\windows\system32\nlite.cmd
2009-04-11 11:39 . 2009-04-11 11:39 990208 ----a-w- c:\windows\system32\syssetup.dll
2009-04-11 01:33 . 2009-04-11 01:33 144896 ----a-w- c:\windows\system32\schannel.dll
2009-04-11 01:33 . 2009-04-11 01:33 1847552 ----a-w- c:\windows\system32\win32k.sys
2009-04-11 00:43 . 2009-04-11 00:43 756224 ----a-w- c:\windows\system32\winntbbu.dll
2009-04-11 00:43 . 2009-04-11 00:43 4569 ----a-w- c:\windows\system32\secupd.dat
.
------- Sigcheck -------
[-] 2009-04-11 13:58 1614848 5D400EF48AF6BB4066727AB2F38FF5D3 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-05-18 206088]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-09-22 14854144]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [11/04/2009 02:39 م 25067]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.googel.com/
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\nh0d4df5.default\
FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-07 04:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\docume~1\ADMINI~1\LOCALS~1\Temp\Perflib_Perfdata_fe0.dat 16384 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1606980848-682003330-1177238915-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="MsnMsgr.Exe"
"MRUList"="ba"
"b"="firefox.exe"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2132)
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-06-07 4:43 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-07 01:43
Pre-Run: 99,812,364,288 bytes free
Post-Run: 99,944,366,080 bytes free
173