اخوي العزيز ماكس الله يعطيك العافيه
التقرير
ComboFix 08-08-15.04 - user 08/16/2008 22:54:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.1567 [GMT 3:00]
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-07-16 to 2008-08-16 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-16 19:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-16 19:57 221,216 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-16 19:57 1,836 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-16 19:56 14,756 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-16 19:56 1,616,416 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-15 23:43 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-15 23:31 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-08-15 23:31 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-15 22:06 --------- d-----w C:\Program Files\MTC USB Connect
2008-08-15 21:40 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-15 21:04 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-08-15 21:04 --------- d-----w C:\Program Files\Unlocker
2008-08-15 21:04 --------- d-----w C:\Program Files\Tweak Marketing
2008-08-15 21:04 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-08-15 21:04 --------- d-----w C:\Program Files\Paltalk Messenger
2008-08-15 21:04 --------- d-----w C:\Program Files\Mgutil
2008-08-15 21:04 --------- d-----w C:\Program Files\GVR
2008-08-15 21:04 --------- d-----w C:\Program Files\Free Download Manager
2008-08-15 21:04 --------- d-----w C:\Program Files\EleFun Desktops
2008-08-15 21:04 --------- d-----w C:\Program Files\CCleaner
2008-08-15 21:04 --------- d-----w C:\Documents and Settings\user\Application Data\Paltalk
2008-08-15 21:04 --------- d-----w C:\Documents and Settings\user\Application Data\Desktopicon
2008-08-15 21:03 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{6CF41A80-289A-4651-96E0-C4829485C662}
2008-08-15 21:03 --------- d-----w C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic
2008-08-15 21:03 --------- d-----w C:\Program Files\Real
2008-08-15 21:03 --------- d-----w C:\Program Files\Common Files\xing shared
2008-08-15 21:03 --------- d-----w C:\Program Files\Common Files\Real
2008-08-15 21:03 --------- d-----w C:\Program Files\Alwil Software
2008-08-15 21:01 --------- d-----w C:\Program Files\Spider
2008-08-15 21:01 --------- d-----w C:\Program Files\Kaspersky Lab(2)
2008-08-15 21:01 --------- d-----w C:\Program Files\Internet Download Manager
2008-08-15 21:01 --------- d-----w C:\Program Files\Common Files\Kaspersky Lab
2008-08-15 20:26 --------- d-----w C:\Documents and Settings\user\Application Data\Thinstall
2008-08-14 21:01 --------- d-----w C:\Program Files\Golden Bow
2008-08-13 21:13 --------- d-----w C:\Documents and Settings\user\Application Data\IDM
2008-08-13 21:11 --------- d-----w C:\Documents and Settings\user\Application Data\DMCache
2008-08-13 21:07 --------- d-----w C:\Program Files\VIVIplayer3
2008-08-09 21:49 155,995 ----a-w C:\WINDOWS\java\Packages\CSLRPBTV.ZIP
2008-08-09 17:55 --------- d-----w C:\Documents and Settings\user\Application Data\URSoft
2008-08-09 17:50 --------- d-----w C:\Program Files\VS Revo Group
2008-07-30 00:29 --------- d-----w C:\Program Files\MSXML 6.0
2008-07-29 17:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-29 17:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-07-21 15:34 121,872 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-19 23:22 1,718,272 ----a-w C:\WINDOWS\system32\AnipUninst1.exe
2008-07-19 23:17 --------- d-----w C:\Documents and Settings\user\Application Data\elefundesktops
2008-07-18 16:11 306,432 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-07-18 16:11 --------- d-----w C:\Documents and Settings\user\Application Data\TuneUp Software
2008-07-18 16:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-07-18 14:27 65,536 ----a-w C:\WINDOWS\IFinst27.exe
2008-07-18 11:50 203,776 ----a-w C:\WINDOWS\system32\clrviddc.dll
2008-07-17 14:02 --------- d-----w C:\Program Files\Ashampoo
2008-07-16 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\XP
2008-07-16 23:34 --------- d-----w C:\Program Files\TOSHIBA
2008-07-16 23:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Vista64
2008-07-16 23:20 --------- d-----w C:\Program Files\Synaptics
2008-07-16 22:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-07-16 22:21 --------- d-----w C:\Program Files\ATI Technologies
2008-07-16 22:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-16 21:44 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-07-16 21:44 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-07-16 21:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-07-16 21:42 --------- d-----w C:\Program Files\CyberLink
2008-07-16 21:40 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-16 21:40 --------- d-----w C:\Program Files\Ahead
2008-07-16 21:14 24,576 ------w C:\WINDOWS\system32\TSBWLS.dll
2008-07-16 20:46 --------- d-----w C:\Program Files\ATI
2008-07-16 20:02 --------- d-----w C:\Documents and Settings\user\Application Data\MTC Kuwait
2008-07-16 20:02 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Bytemobile
2008-07-16 19:56 --------- d-----w C:\Documents and Settings\user\Application Data\Bytemobile
2008-07-16 19:53 8,464 ----a-w C:\WINDOWS\system32\SpOrder.dll
2008-07-16 19:51 --------- d-----w C:\Documents and Settings\user\Application Data\ATI
2008-07-16 19:37 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-07-16 19:37 --------- d-----w C:\Program Files\Realtek
2008-07-16 19:35 --------- d-----w C:\Program Files\Intel
2008-07-16 19:33 --------- d-----w C:\Documents and Settings\user\Application Data\InstallShield
2008-07-16 19:30 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-16 19:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-07-16 19:09 --------- d-----w C:\Program Files\microsoft frontpage
2006-12-12 08:13 32,768 ----a-w C:\Documents and Settings\All Users\Application Data\EBLib.dll
2006-07-28 13:25 19,456 ----a-w C:\Documents and Settings\All Users\Application Data\LPCFilter.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [02/12/2007 01:37 PM 174872]
"HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [05/01/2004 01:45 PM 28672]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 10:50 AM 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [12/07/2005 10:57 PM 30208]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [04/13/2006 11:09 AM 49152]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 12:35 PM 90112]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [06/01/2007 05:40 AM 53248]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [11/20/2007 10:25 AM 888832]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [07/06/2007 06:49 AM 651264]
"Ashampoo FireWall PRO"="C:\Program Files\Ashampoo\Ashampoo FireWall PRO\FireWall.exe" [12/21/2006 02:10 AM 3543552]
"'Ashampoo AntiSpyWare 2 Guard'"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [03/13/2008 02:36 PM 2316632]
"DWPersistentQueuedReporting"="C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE" [04/25/2005 01:45 PM 36040]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/17/2008 08:14 PM 185896]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [07/29/2008 08:20 PM 206088]
"TFncKy"="TFncKy.exe" [BU]
"TDispVol"="TDispVol.exe" [12/27/2005 01:06 PM 73728 C:\WINDOWS\system32\TDispVol.exe]
"RTHDCPL"="RTHDCPL.EXE" [12/28/2007 01:15 AM 16377344 C:\WINDOWS\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-05-22 16:57:26 2756608]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 03/02/2008 09:14 PM 5725208 C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live Messenger Khalid Edition v5.5 Arabic\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [03/13/2008 02:36 PM]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 03:56 AM]
R3 DrvFltIp;DrvFltIp;C:\Documents and Settings\user\Local Settings\TEMP\DrvFltIp [12/21/2006 02:34 AM]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [07/18/2008 07:11 PM]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48b98684-538e-11dd-8772-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48b98685-538e-11dd-8772-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af098664-5370-11dd-876e-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af098667-5370-11dd-876e-0013e852690b}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7ce60f0-5585-11dd-8790-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b7ce60f1-5585-11dd-8790-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1b05592-566b-11dd-8796-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1b05593-566b-11dd-8796-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e1502ef2-6b17-11dd-87a8-00037ac5d5d2}]
\Shell\AutoRun\command - F:\AutoRun.exe
.
s of the 'Scheduled Tasks' folder
2008-07-18 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe [12/21/2007 03:17 PM]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.internetdownloadmanager.com/welcome.html
O8 -: "إضافة إلى حاجب الدعايات" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-16 22:58:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\C:\Documents and Settings\user\Local Settings\TEMP\ASFWHide"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DrvFltIp]
"ImagePath"="\??\C:\Documents and Settings\user\Local Settings\TEMP\DrvFltIp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\TDispVol.dll
PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\Program Files\Ashampoo\Ashampoo FireWall PRO\MD5.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe
.
**************************************************************************
.
Completion time: 08/16/2008 22:59:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-16 19:59:47
Pre-Run: 64,037,912,576 bytes free
Post-Run: 64,306,204,672 bytes free
225
