[LEFT]Deckard's System Scanner v20071014.68
Run by fahd on 2008-09-12 09:23:47
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
System Restore is disabled; attempting to re-enable...success.
-- Last 1 Restore Point(s) --
1: 2008-09-12 06:23:52 UTC - RP1 - نقطة اختبار النظام
Backed up registry hives.
Performed disk cleanup.
[color=red]Percentage of Memory in Use: 81% (more than 75%).[/color]
[color=red]Total Physical Memory: 128 MiB (512 MiB recommended).[/color]
-- HijackThis (run as fahd.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:25:37 ص, on 12/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Virtual Machine Additions\vmusrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Virtual Machine Additions\vmsrvc.exe
C:\Program Files\Virtual Machine Additions\vpcmap.exe
C:\WINDOWS\system32\wscntfy.exe
E:\Poison Ivy ضحايا بالملايين\اداة Deckard's System Scanner لعمل تقرير عن فايرس أوتو رون + هايجاك\dss.exe
Z:\fahd.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [VMUserServices] C:\Program Files\Virtual Machine Additions\vmusrvc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
--
End of file - 2836 bytes
-- File Associations -----------------------------------------------------------
[COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR]
[COLOR=red].cpl - cplfile - shell\runas\command - unable to read value[/COLOR]
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
All services whitelisted.
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel 21140-Based PCI Fast Ethernet Adapter (Generic)
Device ID: PCI\VEN_1011&DEV_0009&SUBSYS_21140A00&REV_20\3&267A616A&0&50
Manufacturer: Intel
Name: Intel 21140-Based PCI Fast Ethernet Adapter (Generic)
PNP Device ID: PCI\VEN_1011&DEV_0009&SUBSYS_21140A00&REV_20\3&267A616A&0&50
Service: DC21x4
-- Files created between 2008-08-12 and 2008-09-12 -----------------------------
2008-09-12 09:20:44 0 d-------- C:\Documents and Settings\fahd\Application Data\WinRAR
2008-09-10 21:24:57 0 d--hs---- C:\WINDOWS\Installer
2008-09-10 21:24:55 0 d-------- C:\Program Files\Common Files\ODBC
2008-09-10 21:24:50 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-09-10 21:24:49 0 dr------- C:\Program Files
2008-09-10 21:24:49 0 d-------- C:\Program Files\Common Files
2008-09-10 21:24:04 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-09-10 21:24:04 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-09-10 21:24:04 0 dr------- C:\Documents and Settings\All Users\قائمة ابدأ
2008-09-10 21:24:04 0 d-------- C:\Documents and Settings\All Users\سطح المكتب
2008-09-10 21:24:04 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-09-10 21:24:04 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-09-10 21:24:04 0 dr------- C:\Documents and Settings\All Users\Documents
2008-09-10 21:24:03 0 dr------- C:\Documents and Settings\Default User\قائمة ابدأ
2008-09-10 21:24:03 0 d-------- C:\Documents and Settings\Default User\سطح المكتب
2008-09-10 21:24:03 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-09-10 21:24:03 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-09-10 21:24:03 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-09-10 21:24:03 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-09-10 21:24:03 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-09-10 21:24:03 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-09-10 21:24:03 0 d--hs---- C:\Documents and Settings\Default User\s
2008-09-10 21:23:43 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-09-10 21:23:43 0 d-------- C:\WINDOWS\system32\CatRoot
2008-09-10 21:23:37 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-09-10 21:23:37 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-09-10 21:23:36 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2008-09-10 21:23:36 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-09-10 21:23:20 0 d--hs---- C:\System Volume Information
2008-09-10 21:23:20 0 d-------- C:\Documents and Settings
2008-09-10 21:18:45 0 d-------- C:\WINDOWS
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\WinSxS
2008-09-10 21:18:45 0 dr------- C:\WINDOWS\Web
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\twain_32
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\wins
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\wbem
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\usmt
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\spool
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\ShellExt
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\Setup
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\ras
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\oobe
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\npp
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\mui
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\inetsrv
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\IME
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\icsxml
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\ias
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\export
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\drivers
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-09-10 21:18:45 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\dhcp
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\config
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\ar-sa
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\ar
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\3076
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\2052
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1054
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1042
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1041
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1037
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1033
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1031
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1028
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system32\1025
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\system
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\security
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Resources
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\repair
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Provisioning
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\PeerNet
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\pchealth
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Offline Web Pages
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\NLDRV
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Network Diagnostic
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\mui
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\msapps
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\msagent
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Media
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\L2Schemas
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\java
2008-09-10 21:18:45 0 d--h----- C:\WINDOWS\inf
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\ime
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Help
2008-09-10 21:18:45 0 dr--s---- C:\WINDOWS\Fonts
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\ehome
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Driver Cache
2008-09-10 21:18:45 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Debug
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Cursors
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Connection Wizard
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\Config
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\AppPatch
2008-09-10 21:18:45 0 d-------- C:\WINDOWS\addins
2008-09-10 19:09:47 0 d-------- C:\Program Files\InstallShield Installation Information
2008-09-10 19:09:37 0 d-------- C:\Program Files\PowerQuest
2008-09-10 19:09:24 0 d-------- C:\Program Files\Common Files\InstallShield
2008-09-10 19:02:54 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-09-10 19:02:49 0 d-------- C:\Program Files\Virtual Machine Additions
2008-09-10 18:53:52 0 d-------- C:\Documents and Settings\fahd\Application Data\Identities
2008-09-10 18:53:09 0 dr------- C:\Documents and Settings\fahd\قائمة ابدأ
2008-09-10 18:53:09 0 d-------- C:\Documents and Settings\fahd\سطح المكتب
2008-09-10 18:53:09 0 d--h----- C:\Documents and Settings\fahd\Templates
2008-09-10 18:53:09 0 dr-h----- C:\Documents and Settings\fahd\SendTo
2008-09-10 18:53:09 0 dr-h----- C:\Documents and Settings\fahd\Recent
2008-09-10 18:53:09 0 d--h----- C:\Documents and Settings\fahd\PrintHood
2008-09-10 18:53:09 1048576 --ah----- C:\Documents and Settings\fahd\NTUSER.DAT
2008-09-10 18:53:09 0 d--h----- C:\Documents and Settings\fahd\NetHood
2008-09-10 18:53:09 0 dr------- C:\Documents and Settings\fahd\My Documents
2008-09-10 18:53:09 0 d--h----- C:\Documents and Settings\fahd\Local Settings
2008-09-10 18:53:09 0 dr------- C:\Documents and Settings\fahd\Favorites
2008-09-10 18:53:09 0 d--hs---- C:\Documents and Settings\fahd\s
2008-09-10 18:53:09 0 dr-h----- C:\Documents and Settings\fahd\Application Data
2008-09-10 18:53:09 0 d-------- C:\Documents and Settings\fahd\Application Data\Real
2008-09-10 18:52:22 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-09-10 18:52:13 0 d-------- C:\WINDOWS\Prefetch
2008-09-10 18:52:12 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-09-10 18:52:10 274432 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2008-09-10 18:52:10 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2008-09-10 18:52:10 0 d--hs---- C:\Documents and Settings\LocalService\s
2008-09-10 18:52:10 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-09-10 18:52:10 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-09-10 18:51:51 274432 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-09-10 18:51:51 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-09-10 18:51:51 0 d--hs---- C:\Documents and Settings\NetworkService\s
2008-09-10 18:51:51 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-09-10 18:51:51 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-09-10 18:42:52 0 d-------- C:\WINDOWS\system32\xircom
2008-09-10 18:42:52 0 d-------- C:\Program Files\microsoft frontpage
2008-09-10 18:42:13 274432 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-09-10 18:41:56 0 d--h----- C:\WINDOWS\$hf_mig$
2008-09-10 18:41:23 164352 --a------ C:\WINDOWS\system32\unrar.dll
2008-09-10 18:41:20 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll <Not Verified; [URL="http://www.helixcommunity.org/"]www.helixcommunity.org[/URL]; Helix YV12 YUV Codec>
2008-09-10 18:41:20 755027 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-09-10 18:41:19 159839 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-09-10 18:41:19 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-09-10 18:41:19 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-09-10 18:41:18 682496 --a------ C:\WINDOWS\system32\divx.dll <Not Verified; DivX, Inc.; DivX®>
2008-09-10 18:41:17 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-09-10 18:41:15 0 d-------- C:\Program Files\K-Lite Codec Pack
2008-09-10 18:41:15 0 d-------- C:\Documents and Settings\Default User\Application Data\Real
2008-09-10 18:41:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Real
2008-09-10 18:41:04 0 d-------- C:\WINDOWStemp
2008-09-10 18:40:58 0 -rahs---- C:\MSDOS.SYS
2008-09-10 18:40:58 0 -rahs---- C:\IO.SYS
2008-09-10 18:40:58 0 --a------ C:\CONFIG.SYS
2008-09-10 18:40:58 0 --a------ C:\AUTOEXEC.BAT
2008-09-10 18:37:21 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-09-10 18:36:16 0 d--h----- C:\Program Files\WindowsUpdate
2008-09-10 18:36:06 0 d-------- C:\Program Files\Online Services
2008-09-10 18:35:22 0 d-------- C:\WINDOWS\system32\DirectX
2008-09-10 18:35:00 0 d---s---- C:\WINDOWS\Tasks
2008-09-10 18:34:59 0 d-------- C:\Program Files\Common Files\MSSoap
2008-09-10 18:34:55 0 d-------- C:\WINDOWS\srchasst
2008-09-10 18:34:54 0 d-------- C:\WINDOWS\system32\Macromed
2008-09-10 18:34:44 0 d-------- C:\Program Files\Movie Maker
2008-09-10 18:34:09 0 d-------- C:\WINDOWS\system32\Restore
2008-09-10 18:32:06 22144 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-09-10 18:31:54 0 d-------- C:\WINDOWS\Registration
2008-09-10 18:31:30 0 d-------- C:\Program Files\MSN Gaming Zone
2008-09-10 18:30:37 0 d-------- C:\Program Files\Windows NT
2008-09-10 18:30:32 0 d-------- C:\WINDOWS\system32\MsDtc
2008-09-10 18:30:30 0 d-------- C:\WINDOWS\system32\Com
-- Find3M Report ---------------------------------------------------------------
2008-09-10 21:24:03 62 --ahs---- C:\Documents and Settings\fahd\Application Data\desktop.ini
2008-09-10 18:55:38 251478 --a------ C:\WINDOWS\system32\perfh001.dat
2008-09-10 18:55:38 39982 --a------ C:\WINDOWS\system32\perfc001.dat
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMUserServices"="C:\Program Files\Virtual Machine Additions\vmusrvc.exe" [04/30/2008 02:23 AM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/15/2008 12:29 AM]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_2"=regsvr32 /s /n /i:U shell32
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideRunAsVerb"=1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService Alerter WebClient LmHosts upnphost SSDPSRV
eapsvcs eaphost
dot3svc dot3svc
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc
-- End of Deckard's System Scanner: finished at 2008-09-12 09:26:39 ------------[/LEFT]
:
