شكرا لك هذا المطلوب
ComboFix 09-07-21.03 - Administrator 07/22/2009 11:33.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1014.512 [GMT 3:00]
Running from: c:\documents and settings\Administrator\My Documents\Downloads\Programs\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090610-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-06-22 to 2009-07-22 )))))))))))))))))))))))))))))))
.
2009-07-22 08:04 . 2009-07-22 08:04 -------- d-----w- c:\windows.1\system32\xircom
2009-07-22 08:04 . 2009-07-22 08:04 -------- d-----w- c:\windows.1\system32\wbem\snmp
2009-07-22 08:04 . 2009-07-22 08:04 -------- d-----w- c:\program files\microsoft frontpage
2009-07-17 07:16 . 2009-07-17 07:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avant Profiles
2009-07-13 17:19 . 2009-07-13 17:19 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-06-30 22:05 . 2009-06-30 22:05 315296 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-30 18:29 . 2008-01-29 22:41 25216 ----a-w- c:\windows.1\system32\drivers\tap0901.sys
2009-06-30 18:29 . 2009-06-30 18:29 -------- d-----w- c:\program files\S.A.D
2009-06-28 14:50 . 2009-06-28 14:50 -------- d-----w- c:\program files\Sound Pilot
2009-06-26 15:07 . 2003-11-04 12:11 159744 ----a-w- c:\windows.1\system32\lfpng13n.dll
2009-06-25 11:08 . 2009-06-25 11:08 90112 ----a-w- c:\windows.1\system32\ALOAudioFormatSettings3.dll
2009-06-25 11:08 . 2009-06-25 11:08 780288 ----a-w- c:\windows.1\system32\ALOVideoCompress.dll
2009-06-25 11:08 . 2009-06-25 11:08 495104 ----a-w- c:\windows.1\system32\ALOVideoCoreM.dll
2009-06-25 11:08 . 2009-06-25 11:08 403968 ----a-w- c:\windows.1\system32\ALOWMAFile2.dll
2009-06-25 11:08 . 2009-06-25 11:08 382464 ----a-w- c:\windows.1\system32\ALOAVIFile.dll
2009-06-25 11:08 . 2009-06-25 11:08 249856 ----a-w- c:\windows.1\system32\ALOQuickTimeFile.dll
2009-06-25 11:08 . 2009-06-25 11:08 215552 ----a-w- c:\windows.1\system32\ALOWMVFile.dll
2009-06-25 11:08 . 2009-06-25 11:08 188416 ----a-w- c:\windows.1\system32\ALOVideoFile.dll
2009-06-25 11:08 . 2009-06-25 11:08 877568 ----a-w- c:\windows.1\system32\ALOAudioFile2.dll
2009-06-25 11:08 . 2009-06-25 11:08 778240 ----a-w- c:\windows.1\system32\ALOAudioCompress2.dll
2009-06-25 11:08 . 2009-06-25 11:08 2846720 ----a-w- c:\windows.1\system32\ALOAudioCompress3.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-22 08:35 . 2009-06-11 11:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\DMCache
2009-07-22 08:08 . 2001-09-19 21:00 72342 ----a-w- c:\windows.1\system32\perfc001.dat
2009-07-22 08:08 . 2001-09-19 21:00 378594 ----a-w- c:\windows.1\system32\perfh001.dat
2009-07-22 03:33 . 2009-07-22 03:33 2232 ----a-w- c:\windows.1\java\Packages\Data\VDNHVF3R.DAT
2009-07-22 03:33 . 2009-07-22 03:33 155995 ----a-w- c:\windows.1\java\Packages\GDB31F3V.ZIP
2009-07-22 03:33 . 2009-07-22 03:33 2678 ----a-w- c:\windows.1\java\Packages\Data\OX3ZNV9R.DAT
2009-07-22 03:33 . 2009-07-22 03:33 2678 ----a-w- c:\windows.1\java\Packages\Data\EFDJPFHF.DAT
2009-07-22 03:33 . 2009-07-22 03:33 2678 ----a-w- c:\windows.1\java\Packages\Data\Y3RBLZXZ.DAT
2009-07-22 03:33 . 2009-07-22 03:33 2678 ----a-w- c:\windows.1\java\Packages\Data\HVNDBHRN.DAT
2009-07-22 03:33 . 2009-07-22 03:33 2678 ----a-w- c:\windows.1\java\Packages\Data\FFL37B17.DAT
2009-07-21 18:32 . 2009-06-11 11:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\IDM
2009-07-16 00:03 . 2009-06-11 10:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-06 18:49 . 2009-06-11 10:09 101000 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-28 14:47 . 2009-06-11 10:41 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-28 14:45 . 2009-06-11 11:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-25 11:08 . 2009-06-23 19:29 90112 ----a-w- c:\windows.1\system32\agsaami.dll
2009-06-25 11:08 . 2009-06-23 19:29 626688 ----a-w- c:\windows.1\system32\agsaamh.dll
2009-06-25 11:08 . 2009-06-23 19:29 551424 ----a-w- c:\windows.1\system32\agsaame.dll
2009-06-25 11:08 . 2009-06-23 19:29 2846720 ----a-w- c:\windows.1\system32\agsaamj.dll
2009-06-25 11:08 . 2009-06-23 19:29 753664 ----a-w- c:\windows.1\system32\agsaamg.dll
2009-06-25 11:08 . 2009-06-23 19:29 544256 ----a-w- c:\windows.1\system32\agsaamd.dll
2009-06-25 11:08 . 2009-06-23 19:29 538624 ----a-w- c:\windows.1\system32\agsaamb.dll
2009-06-25 11:08 . 2009-06-23 19:29 372736 ----a-w- c:\windows.1\system32\agsaamc.dll
2009-06-25 11:08 . 2009-06-23 19:29 331776 ----a-w- c:\windows.1\system32\agsaama.dll
2009-06-25 11:08 . 2009-06-23 19:29 1245184 ----a-w- c:\windows.1\system32\bkll.dll
2009-06-23 22:50 . 2009-06-20 07:49 -------- d-----w- c:\program files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility
2009-06-20 07:49 . 2009-06-20 07:49 21035 ----a-w- c:\windows.1\system32\drivers\AegisP.sys
2009-06-20 07:48 . 2009-06-20 07:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-06-17 10:44 . 2009-06-17 10:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\CyberScrub
2009-06-17 10:44 . 2009-06-17 10:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\cleaner
2009-06-17 10:27 . 2009-06-17 10:27 -------- d-----w- c:\program files\Trend Micro
2009-06-16 14:36 . 2008-04-15 00:29 119808 ----a-w- c:\windows.1\system32\t2embed.dll
2009-06-16 14:36 . 2008-04-15 00:29 81920 ----a-w- c:\windows.1\system32\fontsub.dll
2009-06-15 10:38 . 2009-06-11 14:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-06-14 23:41 . 2009-06-14 23:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\ACD Systems
2009-06-14 14:50 . 2009-06-14 14:50 -------- d-----w- c:\program files\myBabylon_English
2009-06-14 14:50 . 2009-06-14 14:50 -------- d-----w- c:\program files\Conduit
2009-06-14 14:50 . 2009-06-14 14:50 -------- d-----w- c:\program files\Babylon
2009-06-13 18:38 . 2009-06-13 18:35 152576 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-13 18:35 . 2009-06-13 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-06-13 14:34 . 2009-06-13 14:34 -------- d-----w- c:\documents and settings\Administrator\Application Data\Thinstall
2009-06-11 19:25 . 2009-06-11 19:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-06-11 19:25 . 2009-06-11 19:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX
2009-06-11 14:55 . 2009-06-11 14:55 -------- d-----w- c:\program files\WIDCOMM
2009-06-11 14:37 . 2009-06-11 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-06-11 14:32 . 2009-06-11 11:00 -------- d-----w- c:\program files\Microsoft Works
2009-06-11 14:22 . 2009-06-11 14:22 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-06-11 13:58 . 2009-06-11 10:04 86339 ----a-w- c:\windows.1\pchealth\helpctr\OfflineCache\index.dat
2009-06-11 11:52 . 2009-06-11 11:52 -------- d-----w- c:\program files\القرآن الكريم
2009-06-11 11:45 . 2009-06-11 11:45 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-11 11:39 . 2009-06-11 11:39 198064 ----a-w- c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-11 11:32 . 2009-06-11 11:32 -------- d-----w- c:\program files\Sigmatel
2009-06-11 11:31 . 2009-06-11 11:31 -------- d-----w- c:\program files\CONEXANT
2009-06-11 11:15 . 2009-06-11 11:15 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-11 11:14 . 2009-06-11 11:12 -------- d-----w- c:\program files\Windows Live
2009-06-11 11:14 . 2009-06-11 11:14 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-06-11 11:13 . 2009-06-11 11:13 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-06-11 11:12 . 2009-06-11 11:12 -------- d-----w- c:\program files\Microsoft
2009-06-11 11:12 . 2009-06-11 11:12 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-11 11:11 . 2009-06-11 11:11 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-11 11:09 . 2009-06-11 11:09 -------- d-----w- c:\program files\GlobFX Technologies
2009-06-11 11:00 . 2009-06-11 10:39 -------- d-----w- c:\program files\MSBuild
2009-06-11 10:59 . 2009-06-11 10:59 -------- d-----w- c:\program files\Microsoft.NET
2009-06-11 10:57 . 2009-06-11 10:57 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-06-11 10:46 . 2009-06-11 10:46 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-11 10:46 . 2009-06-11 10:46 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-11 10:46 . 2009-06-11 10:45 -------- d-----w- c:\program files\Common Files\Real
2009-06-11 10:45 . 2009-06-11 10:32 499712 ----a-w- c:\windows.1\system32\msvcp71.dll
2009-06-11 10:45 . 2009-06-11 10:32 348160 ----a-w- c:\windows.1\system32\msvcr71.dll
2009-06-11 10:45 . 2009-06-11 10:45 -------- d-----w- c:\program files\Real
2009-06-11 10:43 . 2009-06-11 10:43 -------- d-----w- c:\program files\Golden Al-Wafi Portable
2009-06-11 10:43 . 2009-06-11 10:43 0 ----a-w- c:\windows.1\nsreg.dat
2009-06-11 10:43 . 2009-06-11 10:43 -------- d-----w- c:\program files\DivX
2009-06-11 10:43 . 2009-06-11 10:43 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-11 10:42 . 2009-06-11 10:41 -------- d-----w- c:\program files\Avant Browser
2009-06-11 10:40 . 2009-06-11 10:40 -------- d-----w- c:\program files\CCleaner
2009-06-11 10:40 . 2009-06-11 10:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-11 10:39 . 2009-06-11 10:39 -------- d-----w- c:\program files\Reference Assemblies
2009-06-11 10:38 . 2009-06-11 10:38 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-06-11 10:38 . 2009-06-11 10:38 -------- d-----w- c:\program files\UltraISO
2009-06-11 10:37 . 2009-06-11 10:37 -------- d-----w- c:\program files\Total Video Converter
2009-06-11 10:36 . 2009-06-11 10:36 -------- d-----w- c:\program files\My Company
2009-06-11 10:36 . 2009-06-11 10:36 6335 ----a-w- c:\program files\un_Internet Download Manager_16575.txt
2009-06-11 10:36 . 2009-06-11 10:36 -------- d-----w- c:\program files\Internet Download Manager
2009-06-11 10:32 . 2009-06-11 10:32 -------- d-----w- c:\program files\Alwil Software
2009-06-11 10:31 . 2009-06-11 10:30 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-06-11 10:30 . 2009-06-11 10:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-06-11 10:30 . 2009-06-11 10:30 -------- d-----w- c:\program files\ACD Systems
2009-06-11 10:29 . 2009-06-11 10:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ashampoo
2009-06-11 10:28 . 2009-06-11 10:28 -------- d-----w- c:\documents and settings\All Users\Application Data\ashampoo
2009-06-11 10:28 . 2009-06-11 10:28 -------- d-----w- c:\program files\Ashampoo
2009-06-11 10:06 . 2009-06-11 10:06 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-11 10:02 . 2009-06-11 10:02 22144 ----a-w- c:\windows.1\system32\emptyregdb.dat
2009-06-03 19:10 . 2008-04-15 00:29 1289216 ----a-w- c:\windows.1\system32\quartz.dll
2009-05-21 08:33 . 2009-06-11 10:44 410984 ----a-w- c:\windows.1\system32\deploytk.dll
2009-05-13 05:02 . 2008-05-07 08:08 915456 ----a-w- c:\windows.1\system32\wininet.dll
2009-05-07 15:32 . 2008-04-15 00:29 345600 ----a-w- c:\windows.1\system32\localspl.dll
2009-05-01 21:03 . 2009-06-11 10:43 9464 ------w- c:\windows.1\system32\drivers\cdralw2k.sys
2009-05-01 21:03 . 2009-06-11 10:43 9336 ------w- c:\windows.1\system32\drivers\cdr4_xp.sys
2009-05-01 21:03 . 2009-06-11 10:43 43528 ------w- c:\windows.1\system32\drivers\PxHelp20.sys
2009-04-24 04:52 . 2009-06-11 10:42 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-07-22_08.04.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-09-19 21:00 . 2009-07-22 05:32 72238 c:\windows.1\system32\perfc009.dat
+ 2001-09-19 21:00 . 2009-07-22 08:08 72238 c:\windows.1\system32\perfc009.dat
+ 2001-09-19 21:00 . 2009-07-22 08:08 444362 c:\windows.1\system32\perfh009.dat
- 2001-09-19 21:00 . 2009-07-22 05:32 444362 c:\windows.1\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.1\system32\ctfmon.exe" [2008-04-15 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-04-03 2794928]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-11 198160]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"OEM02Mon.exe"="c:\windows.1\OEM02Mon.exe" [2007-05-09 36864]
"IgfxTray"="c:\windows.1\system32\igfxtray.exe" [2007-05-16 137752]
"HotKeysCmds"="c:\windows.1\system32\hkcmd.exe" [2007-05-16 162328]
"Persistence"="c:\windows.1\system32\igfxpers.exe" [2007-05-16 137752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows.1\system32\CTFMON.EXE" [2008-04-15 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-28 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 ulsata2;ulsata2;c:\windows.1\system32\drivers\ulsata2.sys [07/05/2008 11:09 ص 124928]
R1 aswSP;avast! Self Protection;c:\windows.1\system32\drivers\aswSP.sys [11/06/2009 01:33 م 114768]
R2 aswFsBlk;aswFsBlk;c:\windows.1\system32\drivers\aswFsBlk.sys [11/06/2009 01:33 م 20560]
R2 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\S.A.D\CyberGhost VPN\CGVPNCliService.exe [30/06/2009 09:29 م 1940992]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows.1\system32\drivers\EAPPkt.sys [20/06/2009 10:49 ص 38144]
R3 OEM02Afx;Provides a software interface to control audio effects of OEM002 camera.;c:\windows.1\system32\drivers\OEM02Afx.sys [11/06/2009 02:44 م 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows.1\system32\drivers\OEM02Dev.sys [11/06/2009 02:44 م 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows.1\system32\drivers\OEM02Vfx.sys [11/06/2009 02:44 م 7424]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows.1\system32\drivers\tap0901.sys [30/06/2009 09:29 م 25216]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows.1\system32\drivers\RTL8187.sys [20/06/2009 10:45 ص 194304]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows.1\system32\rundll32.exe" "c:\windows.1\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-07-21 c:\windows.1\Tasks\OGADaily.job
- c:\windows.1\system32\OGAVerify.exe [2008-12-31 14:04]
2009-07-22 c:\windows.1\Tasks\OGALogon.job
- c:\windows.1\system32\OGAVerify.exe [2008-12-31 14:04]
2009-07-22 c:\windows.1\Tasks\User_Feed_Synchronization-{AF686C13-90B6-4595-B581-F13AF1717260}.job
- c:\windows.1\system32\msfeedssync.exe [2008-05-07 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ae/
uInternet Connection Wizard,ShellNext = iexplore
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\w1863vuy.default\
FF - prefs.js: browser.startup.homepage -
FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-22 11:35
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-790525478-1532298954-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,cc,68,52,93,47,c9,44,a1,35,1b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,10,cc,68,52,93,47,c9,44,a1,35,1b,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2496)
c:\windows.1\system32\WININET.dll
c:\windows.1\system32\btmmhook.dll
c:\windows.1\system32\ieframe.dll
c:\windows.1\system32\webcheck.dll
c:\windows.1\system32\WPDShServiceObj.dll
c:\windows.1\system32\PortableDeviceTypes.dll
c:\windows.1\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-22 11:36
ComboFix-quarantined-files.txt 2009-07-22 08:36
ComboFix2.txt 2009-07-22 08:21
ComboFix3.txt 2009-07-22 08:07
Pre-Run: 42,036,932,608 bytes free
Post-Run: 42,031,878,144 bytes free
251 --- E O F --- 2009-07-16 00:03
الهاي جااك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:38:58 ص, on 22/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS.1\System32\smss.exe
C:\WINDOWS.1\system32\winlogon.exe
C:\WINDOWS.1\system32\services.exe
C:\WINDOWS.1\system32\lsass.exe
C:\WINDOWS.1\system32\svchost.exe
C:\WINDOWS.1\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.1\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS.1\system32\svchost.exe
C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\WINDOWS.1\OEM02Mon.exe
C:\WINDOWS.1\system32\hkcmd.exe
C:\WINDOWS.1\system32\igfxpers.exe
C:\WINDOWS.1\system32\ctfmon.exe
C:\WINDOWS.1\system32\igfxsrvc.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS.1\explorer.exe
C:\WINDOWS.1\system32\notepad.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\WINDOWS.1\OEM02Mon.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS.1\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS.1\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS.1\system32\igfxpers.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.1\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.1\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.1\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.1\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.1\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberGhost VPN Client (CGVPNCliSrvc) - mobile concepts GmbH - C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
--
End of file - 8119 bytes
.png)
.png)
