هذي التقارير
ComboFix 09-06-17.02 - الجميلات 06/18/2009 11:10.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1256.966.1033.18.1013.245 [GMT 3:00]
Running from: c:\users\الجميلات\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090123-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1296 [VPS 090123-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2009-05-18 to 2009-06-18 )))))))))))))))))))))))))))))))
.
2009-06-18 08:17 . 2009-06-18 08:17 -------- d-----w- c:\users\الجميلات\AppData\Local\temp
2009-06-18 08:17 . 2009-06-18 08:17 -------- d-----w- c:\users\Guest\AppData\Local\temp
2009-06-17 14:47 . 2009-06-17 14:47 -------- d-----w- c:\users\الجميلات\AppData\Local\Runscanner.net
2009-06-17 13:50 . 2009-06-17 13:50 -------- d-----w- c:\program files\Trend Micro
2009-06-15 22:42 . 2009-06-15 22:42 -------- d-----w- C:\$WINDOWS.~LS
2009-06-11 11:41 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-11 11:29 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-11 10:57 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-05-31 22:39 . 2009-04-27 11:21 28928 ----a-w- c:\windows\system32\uxtuneup.dll
2009-05-31 22:39 . 2009-04-27 11:21 17152 ----a-w- c:\windows\system32\authuitu.dll
2009-05-31 22:38 . 2009-05-31 22:38 361216 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-31 22:37 . 2009-05-31 22:37 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-29 00:34 . 2008-12-06 04:42 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-05-29 00:34 . 2008-06-06 03:27 38912 ----a-w- c:\windows\system32\xolehlp.dll
2009-05-29 00:34 . 2008-06-06 03:27 562176 ----a-w- c:\windows\system32\msdtcprx.dll
2009-05-29 00:30 . 2009-02-13 08:49 1255936 ----a-w- c:\windows\system32\lsasrv.dll
2009-05-29 00:30 . 2009-02-13 08:49 72704 ----a-w- c:\windows\system32\secur32.dll
2009-05-29 00:30 . 2009-03-17 03:38 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-05-29 00:30 . 2009-03-17 03:38 24064 ----a-w- c:\windows\system32\amxread.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-18 07:52 . 2008-08-15 20:37 9900 ----a-w- c:\windows\bthservsdp.dat
2009-06-17 01:03 . 2008-08-16 15:27 -------- d-----w- c:\program files\Windows Live
2009-06-15 20:52 . 2008-08-15 20:45 116592 ----a-w- c:\users\الجميلات\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-15 20:47 . 2009-01-26 14:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-15 20:42 . 2008-12-18 17:46 -------- d-----w- c:\programdata\Microsoft Help
2009-06-15 15:30 . 2008-12-25 15:07 -------- d-----w- c:\users\الجميلات\AppData\Roaming\Windows Live Writer
2009-06-10 12:26 . 2008-08-15 20:44 6648 ----a-w- c:\users\الجميلات\AppData\Local\d3d9caps.dat
2009-05-31 22:39 . 2009-01-15 15:58 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-31 22:35 . 2009-01-15 15:54 -------- d-sh--w- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-30 23:33 . 2008-09-20 22:25 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-29 14:22 . 2008-09-20 22:25 -------- d-----w- c:\program files\Circle Developement
2009-05-29 13:54 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-04-24 16:05 . 2009-06-11 11:38 827904 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-06-11 11:38 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-06-11 11:38 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-04-12 16:26 . 2009-04-12 16:26 733696 ----a-w- c:\windows\GPInstall.exe
2009-04-06 14:09 . 2009-04-06 15:14 38200 ----a-w- c:\users\الجميلات\AppData\Roaming\Macromedia\Flash Player\
2006-06-15 17:33 . 2009-03-06 16:17 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 15:43 . 2009-03-06 16:17 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 11:41 . 2009-03-06 16:17 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 10:10 . 2009-03-06 16:17 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 09:19 . 2009-03-06 16:17 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 15:35 . 2009-03-06 16:17 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 08:10 . 2009-03-06 16:17 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 08:42 . 2009-03-06 16:17 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 08:22 . 2009-03-06 16:17 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 08:21 . 2009-03-06 16:17 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
2009-03-06 16:18 . 2008-08-15 21:36 76 --sh--r- c:\windows\CT4CET.bin
2007-02-21 19:49 . 2007-02-21 19:49 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
(((((((((((((((((((((((((((((
SnapShot@2009-06-18_07.58.23 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-15 20:45 . 2009-06-18 07:59 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-15 20:45 . 2009-06-18 08:05 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-15 20:45 . 2009-06-18 08:05 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-15 20:45 . 2009-06-18 07:59 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-15 20:45 . 2009-06-18 08:05 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-15 20:45 . 2009-06-18 07:59 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-06-18 07:57 . 2009-06-18 07:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-06-18 07:57 . 2009-06-18 07:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Debug Does"="c:\programdata\REF ATOM ATOM.3equ177" [X]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312]
"CollaborationHost"="c:\windows\system32\p2phost.exe" [2008-01-19 192000]
"Google Update"="c:\users\الجميلات\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-06-12 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-14 185872]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-05-06 405504]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-16 133656]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-04-16 184320]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-02-01 36864]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-16 166424]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
c:\users\ںé¤êïéں¢\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-26 113664]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2008-8-16 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-162710353-2108843167-1595147925-1000]
"EnableNotificationsRef"=dword:00000002
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DA3D4F57-4D0B-4F4F-8FDD-FD9626FF2427}"= c:\program files\Dell\MediaDirect\PowerCinema.exe:CyberLink PowerCinema
"{57696A6B-08F7-4D1C-AC57-5C5875CDF08F}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{A43D1486-37BD-4649-8DB3-B68497E0D50B}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{6C70EC87-85D1-4E4B-8B8D-3B26861D2A24}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{57271D4E-8E09-4656-A9EA-601C108FEE36}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{C14EE9B5-0F62-4B80-9BB6-1A4541DD3AC8}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{E9C94ED3-4062-42AC-9D23-FD6B193B3177}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{275544C5-B991-46C0-A68B-56133D25BA9B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{0395FFA8-D667-4D5A-91F5-3CBE2155E412}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{754A1E74-1770-4BB9-8F16-363EE818B7E8}"= UDP:c:\windows\Temp\~osD22D.tmp\ossproxy.exe
ssproxy.exe
"{059B2646-4358-4FA9-BE0B-F9BB88308ACA}"= c:\program files\Skype\Phone\Skype.exe:Skype
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [20/01/09 02:37 م 114768]
R1 pelmouse;Mouse Suite Driver;c:\windows\System32\drivers\PELMouse.SYS [06/03/09 05:03 م 18944]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\System32\drivers\RtlProt.sys [11/02/09 12:59 ص 25896]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [20/01/09 02:37 م 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [20/01/09 02:37 م 51792]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [15/01/09 06:58 م 604416]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [17/07/08 01:04 م 234496]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [17/07/08 01:04 م 7424]
R3 pelps2m;PS/2 Mouse Filter Driver;c:\windows\System32\drivers\pelps2m.sys [06/03/09 05:03 م 40448]
R3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\rtl8187.sys [11/02/09 12:59 ص 248320]
S3 amoidatacard;HSDPA USB Device for Legacy Serial Communication;c:\windows\System32\drivers\amoiusbser.sys [27/06/07 12:33 م 94336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
2009-06-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37]
2009-06-18 c:\windows\Tasks\RtlVistaStart.job
- c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2009-02-10 10:11]
2009-06-17 c:\windows\Tasks\User_Feed_Synchronization-{C35B81BB-9405-46A8-A899-3AA0C7B8680F}.job
- c:\windows\system32\msfeedssync.exe [2008-09-16 07:33]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\users\الجميلات\AppData\Roaming\Mozilla\Firefox\Profiles\gzrorbxf.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\FFAlert.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-18 11:17
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-162710353-2108843167-1595147925-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D378A6EC-CC68-194C-9B9C-92A813B86B2C}*]
"japogdmncfbhldfoneom"=hex:63,61,61,66,63,6a,00,ff
"pahofhfbkplgoffbdcnanofjpefofldo"=hex:65,61,6d,65,6b,65,65,6a,6d,63,00,ff
"hapogdmncfbhldfo"=hex:61,61,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\
0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(3616)
c:\program files\RocketDock\RocketDock.dll
.
Completion time: 2009-06-18 11:19
ComboFix-quarantined-files.txt 2009-06-18 08:19
ComboFix2.txt 2009-06-18 08:03
Pre-Run: 24,171,122,688 bytes free
Post-Run: 24,144,289,792 bytes free
208 --- E O F --- 2009-06-16 12:45
.png)
.png)
