ايوا الـ other delection
أول سطر واخر سطر
خصوصا الاخير مكتوب فيه اسم الفيروس ومكانه
والكلام اللي في الوسط مجرد مسار للمحفظات عندي في المفضلة ومافيها شي << معليش يمكن شهادة اليسنس في الحاسب اللي معاي على قدي :d:
..........................
اسفين مشرفنا
وبارك الله في وفي مساعيك ...
أخي شادي هذا تقريرك بعد الرعب اللي سببته لي أداتك الموقرة
...........................................................................................
ComboFix 09-08-04.03 - hawaseeb 08/05/2009 15:25.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.1014.586 [GMT 3:00]
Running from: c:\documents and settings\hawaseeb\سطح المكتب\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Outpost Firewall Pro *enabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\hawaseeb\Application Data\tazebama
c:\program files\bifrost
c:\program files\Bifrost\logg.dat
c:\windows\Installer\17a1e188.msp
c:\windows\Installer\76b573f.msp
c:\windows\Installer\76b5745.msp
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2009-07-05 to 2009-08-05 )))))))))))))))))))))))))))))))
.
2009-08-05 11:28 . 2009-08-05 11:28 -------- d-----w- c:\program files\Trend Micro
2009-08-04 02:31 . 2009-08-04 02:31 -------- d-----w- C:\Rbackup
2009-08-03 05:05 . 2009-08-04 02:31 -------- d-----w- c:\program files\Perfect Uninstaller
2009-07-13 08:46 . 2009-07-13 09:03 -------- d-----w- c:\windows\vf_hip
2009-07-13 08:46 . 2009-07-13 08:47 -------- d-----w- c:\program files\Hide IP Platinum
2009-07-13 06:32 . 2009-07-13 06:32 -------- d-----w- c:\program files\Microsoft.NET
2009-07-13 06:31 . 2009-07-13 06:32 -------- d-----w- c:\windows\SHELLNEW
2009-07-12 05:24 . 2009-07-12 05:24 -------- d--h--w- c:\windows\PIF
2009-07-08 12:09 . 2009-07-08 12:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith
2009-07-08 12:09 . 2009-07-08 12:09 -------- d-----w- c:\program files\TechSmith
2009-07-08 12:09 . 2009-07-08 12:09 -------- d-----w- c:\documents and settings\hawaseeb\Local Settings\Application Data\TechSmith
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-05 12:32 . 2009-05-24 07:44 -------- d-----w- c:\documents and settings\hawaseeb\Application Data\DMCache
2009-08-05 00:41 . 2001-09-19 11:00 40180 ----a-w- c:\windows\system32\perfc001.dat
2009-08-05 00:41 . 2001-09-19 11:00 251750 ----a-w- c:\windows\system32\perfh001.dat
2009-08-03 04:44 . 2009-05-24 07:55 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-03 04:43 . 2009-05-24 07:33 -------- d-----w- c:\program files\mpegable
2009-07-13 07:01 . 2009-05-24 06:46 94168 ----a-w- c:\documents and settings\hawaseeb\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 03:20 . 2009-05-31 23:32 -------- d-----w- c:\documents and settings\hawaseeb\Application Data\Hide IP NG
2009-06-29 03:09 . 2009-06-29 03:09 7168 ----a-w- c:\documents and settings\hawaseeb\Application Data\Thinstall\ProxySwitcher Standard\4000003af00002i\ProxySwitcher.exe
2009-06-29 03:09 . 2009-06-29 03:09 -------- d-----w- c:\documents and settings\hawaseeb\Application Data\Thinstall
2009-05-24 07:44 . 2009-05-24 07:44 112048 ----a-w- c:\documents and settings\hawaseeb\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-05-24 07:39 . 2009-05-24 07:39 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-05-24 07:39 . 2009-05-24 07:39 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-05-24 07:39 . 2009-05-24 07:39 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-05-24 07:39 . 2009-05-24 07:39 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-05-24 07:39 . 2009-05-24 07:39 1986560 ----a-w- c:\windows\system32\akll.dll
2009-05-24 07:39 . 2009-05-24 07:39 196608 ----a-w- c:\windows\system32\maag.dll
2009-05-24 07:39 . 2009-05-24 07:39 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-05-24 07:39 . 2009-05-24 07:39 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-05-24 07:35 . 2009-05-24 07:35 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-05-24 07:35 . 2009-05-24 07:35 172032 ------w- c:\windows\Setup1.exe
2009-05-24 07:33 . 2009-05-24 07:33 47104 ------w- c:\windows\AKDeInstall.exe
2009-05-24 07:32 . 2009-05-24 07:32 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-24 07:32 . 2009-05-24 07:32 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-24 07:29 . 2009-05-24 07:29 2232 ----a-w- c:\windows\java\Packages\Data\V5BZZ9B5.DAT
2009-05-24 07:29 . 2009-05-24 07:29 155995 ----a-w- c:\windows\java\Packages\1FXV3TFL.ZIP
2009-05-24 07:29 . 2009-05-24 07:29 2678 ----a-w- c:\windows\java\Packages\Data\TVVN5BFP.DAT
2009-05-24 07:29 . 2009-05-24 07:29 2678 ----a-w- c:\windows\java\Packages\Data\ZPZ1BH3J.DAT
2009-05-24 07:29 . 2009-05-24 07:29 2678 ----a-w- c:\windows\java\Packages\Data\IMLZZHJX.DAT
2009-05-24 07:29 . 2009-05-24 07:29 2678 ----a-w- c:\windows\java\Packages\Data\HJTRZ9F5.DAT
2009-05-24 07:29 . 2009-05-24 07:29 2678 ----a-w- c:\windows\java\Packages\Data\6V1735FZ.DAT
2009-05-24 07:27 . 2009-05-24 07:27 10368 ----a-w- c:\windows\system32\drivers\pfc.sys
2009-05-24 06:54 . 2009-05-24 06:54 315392 ----a-w- c:\windows\HideWin.exe
2009-05-23 20:37 . 2009-05-23 20:17 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-23 20:15 . 2009-05-23 20:15 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-18 14:21 . 2009-05-24 07:37 843 ----a-w- C:\ChangeWinXPKey.vbs
.
------- Sigcheck -------
[-] 2008-01-02 04:58 1547776 D74083DCEC51D5291EF24D8D055D133A c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2007-09-11 2540976]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-13 142104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-13 138008]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-10-17 858632]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-15 1229640]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall Pro\feedback.exe" [2009-04-14 433480]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-01 198160]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-13 162584]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-05-28 16132608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
2.exe [2009-8-4 67072]
Snagit 9.lnk - c:\program files\TechSmith\Snagit 9\Snagit32.exe [2008-11-6 7217480]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [25/05/2009 12:42 ص 704384]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [25/05/2009 12:40 ص 1267528]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [24/05/2009 10:41 ص 108289]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [25/05/2009 12:40 ص 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [25/05/2009 12:42 ص 257432]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll [25/05/2009 12:42 ص 33888]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{853990B8-07DB-BC22-B4C8-041BA8C961BB}]
c:\program files\Bifrost\erwx.exe s
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = hxxp://www.plusnetwork.com/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: إفحص باستخدام د. وب -
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-08-05 15:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{06a27b8d-8b62-4efc-9a86-123142e44dc8}]
@Denied: (Full) (Everyone)
"Model"=dword:000000d5
"Therad"=dword:0000000e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,32,31,56,07,b2,cc,3e,4a,46,8f,3c,f2,5c,68,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ee,7b,c6,00,60,13,00,7c,13,2f,cc,4a,94,4b,49,29,f1,33,4f,4c,45,
ac,5b,67,01,a1,60,69,4f,d2,3a,b1,71,f7,16,7c,4c,d5,19,64,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(116)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
c:\program files\Launch Manager\LManager.exe
c:\program files\Agnitum\Outpost Firewall Pro\op_mon.exe
c:\windows\system32\igfxsrvc.exe
c:\documents and settings\All Users\c:\program files\TechSmith\Snagit 9\Snagit32.exe
c:\windows\system32\igfxext.exe
c:\program files\TechSmith\Snagit 9\TscHelp.exe
c:\program files\TechSmith\Snagit 9\SnagPriv.exe
c:\program files\TechSmith\Snagit 9\SnagitEditor.exe
c:\docume~1\hawaseeb\LOCALS~1\temp\RtkBtMnt.exe
.
**************************************************************************
.
Completion time: 2009-08-05 15:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-05 12:35
Pre-Run: 29,864,783,872 bytes free
Post-Run: 30,030,065,664 bytes free
540
:
