هذا التقرير بالاداه الاولي
ComboFix 08-08-17.03 - Like_N
ther 2008-08-18 5:18:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.88 [GMT 4:00]
Running from: C:\Documents and Settings\Like_N
ther\Desktop\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Like_N
ther\UserData
C:\Documents and Settings\Like_N
ther\UserData\index.dat
C:\RECYCLER\ADAPT_Installer.exe
C:\WINDOWS\hosts
C:\WINDOWS\system32\MSINET.oca
.
((((((((((((((((((((((((( Files Created from 2008-07-18 to 2008-08-18 )))))))))))))))))))))))))))))))
.
2008-08-18 04:03 . 2008-08-18 04:03 <DIR> d-------- C:\Program Files\Marsu-Fix
2008-08-18 04:01 . 2008-08-18 04:01 159,847 --a------ C:\WINDOWS\Marsu-Fix Uninstaller.exe.bak
2008-08-18 04:01 . 2008-08-18 04:03 159,847 --a------ C:\WINDOWS\Marsu-Fix Uninstaller.exe
2008-08-18 04:00 . 2008-08-18 04:00 <DIR> d-------- C:\WINDOWS\LastGood
2008-08-18 03:17 . 2008-08-18 03:21 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-08-17 15:07 . 2008-08-17 15:07 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-17 05:42 . 2008-08-17 05:44 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\TeraCopy
2008-08-14 14:06 . 2008-07-06 14:50 597,504 --------- C:\WINDOWS\system32\dllcache\printfilterpipelinesvc.exe
2008-08-14 14:06 . 2008-07-06 16:06 575,488 --------- C:\WINDOWS\system32\xpsshhdr.dll
2008-08-14 14:06 . 2008-07-06 16:06 575,488 --------- C:\WINDOWS\system32\dllcache\xpsshhdr.dll
2008-08-14 14:06 . 2008-07-06 16:06 117,760 --------- C:\WINDOWS\system32\prntvpt.dll
2008-08-14 14:06 . 2008-07-06 16:06 89,088 --------- C:\WINDOWS\system32\dllcache\filterpipelineprintproc.dll
2008-08-14 14:05 . 2008-07-06 16:06 1,676,288 --------- C:\WINDOWS\system32\xpssvcs.dll
2008-08-14 14:05 . 2008-07-06 16:06 1,676,288 --------- C:\WINDOWS\system32\dllcache\xpssvcs.dll
2008-08-14 04:51 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
2008-08-14 04:51 . 2008-07-12 08:18 1,493,528 --a------ C:\WINDOWS\system32\D3DCompiler_39.dll
2008-08-14 04:51 . 2008-07-31 10:40 509,448 --a------ C:\WINDOWS\system32\XAudio2_2.dll
2008-08-14 04:51 . 2008-07-12 08:18 467,984 --a------ C:\WINDOWS\system32\d3dx10_39.dll
2008-08-14 04:51 . 2008-07-31 10:41 238,088 --a------ C:\WINDOWS\system32\xactengine3_2.dll
2008-08-14 04:51 . 2008-07-31 10:41 68,616 --a------ C:\WINDOWS\system32\XAPOFX1_1.dll
2008-08-13 19:44 . 2008-08-13 19:44 <DIR> d-------- C:\WINDOWS\system32\RMBin
2008-08-13 19:43 . 2008-08-13 19:43 <DIR> d-------- C:\Program Files\Real_SC
2008-08-13 14:28 . 2008-08-13 14:28 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-11 16:54 . 2008-08-11 16:54 286,720 --------- C:\WINDOWS\Setup1.exe
2008-08-11 16:54 . 2008-08-11 16:54 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-08-11 07:22 . 2006-03-23 20:53 132,880 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-08-11 07:21 . 2008-08-11 07:21 <DIR> d-------- C:\Program Files\Ubi Soft
2008-08-11 07:21 . 2002-12-18 08:31 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL
2008-08-11 07:21 . 2002-12-18 08:31 69,632 --a------ C:\WINDOWS\system32\xmltok.dll
2008-08-11 07:21 . 2002-12-18 08:31 36,864 --a------ C:\WINDOWS\system32\xmlparse.dll
2008-08-11 07:21 . 2002-12-18 08:31 35,840 --a------ C:\WINDOWS\system32\comdlg32.oca
2008-08-11 07:21 . 2002-12-18 08:31 26,088 --a------ C:\WINDOWS\system32\xmlinst.exe
2008-08-11 07:21 . 2002-12-18 08:31 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-08-11 06:57 . 2008-08-11 07:43 <DIR> d-------- C:\Program Files\PacSteam
2008-08-11 02:08 . 2008-08-11 02:13 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-08-11 01:36 . 2008-08-11 01:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith
2008-08-11 01:34 . 2008-08-11 01:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-10 18:31 . 2008-08-10 18:44 531 --a------ C:\WINDOWS\eReg.dat
2008-08-10 18:25 . 2008-08-10 18:25 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-08-10 18:23 . 2008-08-10 18:23 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\DAEMON Tools
2008-08-10 18:23 . 2008-08-10 18:23 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-08-09 10:55 . 2008-08-09 10:55 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-08-08 00:18 . 2008-08-08 00:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-08-06 04:31 . 2008-08-06 04:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-08-06 04:26 . 2008-08-06 04:26 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-08-06 02:13 . 2008-08-06 02:13 <DIR> d-------- C:\Program Files\CCleaner
2008-08-05 18:31 . 2008-08-05 21:44 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Tracing
2008-08-04 23:49 . 2008-08-04 23:49 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-08-04 23:48 . 2008-08-04 23:48 <DIR> d-------- C:\Program Files\Real Alternative
2008-08-04 21:09 . 2008-08-04 21:12 17,408 --a------ C:\WINDOWS\sysgz.dll
2008-08-04 17:46 . 2008-08-05 00:53 20,480 --a------ C:\WINDOWS\process.exe
2008-08-04 16:28 . 2008-08-04 16:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-08-04 16:25 . 2006-03-23 23:55 152,848 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-08-04 15:52 . 2008-08-04 15:52 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-08-04 15:52 . 2003-07-17 22:17 5,174 --a------ C:\WINDOWS\system32\nppt9x.vxd
2008-08-04 15:52 . 2005-01-01 13:43 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2008-08-04 14:31 . 2001-08-17 09:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-08-04 14:26 . 2008-04-13 20:15 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-08-04 14:05 . 2008-08-04 14:05 <DIR> d-------- C:\Program Files\Free RM to MP3 Converter
2008-08-04 14:05 . 2005-02-27 21:48 356,352 --a------ C:\WINDOWS\system32\RealMediaSplitter.ax
2008-08-04 06:57 . 2008-08-04 06:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-04 06:56 . 2008-08-05 19:42 <DIR> d-------- C:\Program Files\Yahoo!
2008-08-04 05:53 . 2008-08-04 05:59 <DIR> d-------- C:\Program Files\BitSpirit
2008-08-04 04:43 . 2008-08-04 04:55 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\Orbit
2008-08-04 03:38 . 2008-08-17 00:48 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\Xfire
2008-08-04 03:37 . 2008-08-14 14:36 <DIR> d-------- C:\Program Files\Xfire
2008-08-03 22:59 . 2008-08-03 22:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-08-03 22:58 . 2008-08-03 22:58 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-08-03 22:56 . 2008-08-03 23:02 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-08-03 22:04 . 2008-08-03 22:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-08-03 21:58 . 2008-08-03 21:58 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-08-03 21:56 . 2008-08-11 19:11 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Contacts
2008-08-03 21:54 . 2008-08-03 21:54 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-03 21:54 . 2008-08-03 21:54 <DIR> d-------- C:\WINDOWS\PCHEALTH
2008-08-03 21:54 . 2008-08-06 00:43 <DIR> d--h----- C:\Program Files\Windows Live
2008-08-03 21:48 . 2008-08-03 21:48 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\ESET
2008-08-03 21:47 . 2008-08-18 03:59 <DIR> d-------- C:\Program Files\ESET
2008-08-03 21:47 . 2008-08-18 03:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-08-03 21:43 . 2008-08-03 21:43 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-08-03 21:42 . 2008-08-06 02:15 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-08-03 21:42 . 2008-08-03 21:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-08-03 21:42 . 2007-11-30 15:18 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-08-03 21:34 . 2008-08-03 21:34 520,528 --a------ C:\WINDOWS\HHCTRL.OCX
2008-08-03 21:31 . 2008-08-03 21:31 <DIR> d-------- C:\Program Files\Easy GIF Animator
2008-08-03 21:28 . 2008-08-18 03:06 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-08-03 21:28 . 2008-08-17 23:31 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\IDM
2008-08-03 21:28 . 2008-08-18 05:20 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\DMCache
2008-08-03 21:22 . 2008-08-03 21:22 0 --a------ C:\WINDOWS\nsreg.dat
2008-08-03 21:19 . 2008-08-03 21:19 <DIR> d-------- C:\Program Files\Realtek AC97
2008-08-03 21:19 . 2006-11-17 05:40 18,804,736 --a------ C:\WINDOWS\system32\alsndmgr.cpl
2008-08-03 21:18 . 2008-08-03 21:18 <DIR> d-------- C:\Program Files\sisagp
2008-08-03 21:18 . 2008-08-03 21:18 <DIR> d-------- C:\Program Files\SiS VGA Utilities V3.82
2008-08-03 21:18 . 2008-08-11 17:02 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-08-03 21:18 . 2008-08-03 21:18 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-08-03 21:17 . 2008-08-04 12:44 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\Media Player Classic
2008-08-03 21:13 . 2001-08-23 15:00 195,618 --a------ C:\WINDOWS\system32\c_10002.nls
2008-08-03 21:12 . 2001-08-23 15:00 189,986 --a------ C:\WINDOWS\system32\c_1361.nls
2008-08-03 21:08 . 2008-08-03 21:17 <DIR> d-------- C:\Documents and Settings\Like_N
ther\Application Data\Notepad++
2008-08-03 21:08 . 2008-08-18 05:19 <DIR> d-------- C:\Documents and Settings\Like_N
ther
2008-08-03 21:08 . 2007-08-08 02:49 100,247 --a------ C:\Documents and Settings\Like_N
ther\xmlUpdater.exe
2008-08-03 20:07 . 2008-08-03 20:07 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2008-08-03 20:07 . 2008-08-03 20:07 <DIR> d--hs---- C:\Documents and Settings\NetworkService
2008-08-03 20:07 . 2008-08-03 20:07 <DIR> d--hs---- C:\Documents and Settings\LocalService
2008-08-03 20:07 . 2008-08-03 20:07 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-08-03 20:06 . 2007-08-08 02:49 100,247 --a------ C:\WINDOWS\system32\config\systemprofile\xmlUpdater.exe
2008-08-03 20:05 . 2003-03-19 07:14 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-08-03 20:04 . 2004-01-12 02:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-08-03 20:00 . 2008-08-18 03:19 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2008-08-03 20:00 . 2008-08-03 21:43 <DIR> d--hs---- C:\Documents and Settings\All Users\DRM
2008-08-03 20:00 . 2008-08-03 20:00 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-08-03 20:00 . 2008-08-03 20:00 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-03 20:00 . 2008-08-03 20:00 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-08-03 20:00 . 2008-08-03 20:00 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-08-03 20:00 . 2008-08-03 20:00 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-03 20:00 . 2008-08-03 20:00 749 -rah----- C:\WINDOWS\system32\cdplayer.exe.manifest
2008-08-03 20:00 . 2008-08-03 20:00 488 -rah----- C:\WINDOWS\system32\WindowsLogon.manifest
2008-08-03 20:00 . 2008-08-03 20:00 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-07-29 18:03 . 2008-07-09 18:34 206,256 --a------ C:\WINDOWS\system32\idmmbc.dll
2008-07-25 11:16 . 2008-07-25 11:16 83,968 --a------ C:\WINDOWS\system32\mscories.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-18 20:37 2,045,459 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-05-30 10:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 10:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 10:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 10:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 10:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 10:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 10:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll
2008-05-22 22:22 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-05-22 22:19 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-08-07 22:49 100,247 ----a-w C:\Documents and Settings\Default User\xmlUpdater.exe
.
------- Sigcheck -------
2008-05-03 17:46 361344 68f06fe0021b01e670af37b8c5964fdf C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 06:42 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-07-29 18:18 2610608]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 13:39 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072]
"SiSPower"="SiSPower.dll" [2007-08-03 16:07 53248 C:\WINDOWS\system32\SiSPower.dll]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]
C:\Documents and Settings\Like_N
ther\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
SnagIt 9.lnk - E:\Installed Programs\SnagIt 9.0\SnagIt32.exe [2008-05-15 16:49:44 6822728]
win32.exe [2008-08-17 05:43:57 11776]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2008-08-03 21:18:44 262144]
win32.exe [2008-08-17 05:43:29 11776]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-14 05:42 1695232 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Games\\Counter Strike 1.6\\hltv.exe"=
"D:\\Games\\Counter Strike 1.6\\hlds.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Games\\Counter Strike 1.6\\hl.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"D:\\Games\\GunboundWC\\GunBound.gme"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52]
*Newly Created Service* - CATCHME
*Newly Created Service* - EKRN
*Newly Created Service* - EPFWTDIR
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
HKLM-Run-rtu - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
MSConfigStartUp-BitTorrent DNA - C:\Program Files\DNA\btdna.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Like_N
ther\Application Data\Mozilla\Firefox\Profiles\a6fesa2p.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-18 05:20:10
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
rtu = ??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-08-18 5:21:45
ComboFix-quarantined-files.txt 2008-08-18 01:21:40
Pre-Run: 7,258,034,176 bytes free
Post-Run: 7,279,271,936 bytes free
259
وهذا التقرير بالهايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:23:24 AM, on 8/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\sistray.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\win32.exe
E:\Installed Programs\SnagIt 9.0\SnagIt32.exe
E:\Installed Programs\SnagIt 9.0\TSCHelp.exe
E:\Installed Programs\SnagIt 9.0\SnagPriv.exe
E:\Installed Programs\SnagIt 9.0\snagiteditor.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Like_N
ther\Desktop\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
O1 - Hosts: 74.125.19.147 latinhackz.net
O1 - Hosts: 74.125.19.147 gamerztools.net
O1 - Hosts: 74.125.19.147
O1 - Hosts: 74.125.19.147
O1 - Hosts: 74.125.19.147
O1 - Hosts: 74.125.19.147
O1 - Hosts: 74.125.19.147 hacksantana.com
O1 - Hosts: 74.125.19.147
O1 - Hosts: 74.125.19.147
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: SnagIt 9.lnk = E:\Installed Programs\SnagIt 9.0\SnagIt32.exe
O4 - Startup: win32.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: win32.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCD288A3-16BC-4167-A2DB-CD18A76EC10E}: NameServer = 213.131.66.138,213.131.66.246
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5838 bytes
