- بادئ الموضوع عديل روحي
- تاريخ البدء
- 1,860
ComboFix 08-10-17.01 - vista 10/18/2008 19:18:41.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1256.1.1025.18.262 [GMT 3:00]
Running from: C:\Users\vista\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\drivers\nod32drv.sys
C:\Windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2008-09-18 to 2008-10-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 16:24 --------- d-----w C:\Users\vista\AppData\Roaming\DMCache
2008-10-18 15:31 --------- d-----w C:\Program Files\ESET
2008-10-18 09:49 --------- d-----w C:\Program Files\مشغل الفلاش العربي
2008-10-18 09:29 --------- d-----w C:\Program Files\SWiSHmax
2008-10-18 05:22 --------- d-----w C:\Program Files\Kelk 2000
2008-10-16 14:55 --------- d-----w C:\ProgramData\Poll Anti Mix
2008-10-16 14:45 --------- d-----w C:\Program Files\Poll Anti Mix
2008-10-16 14:44 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-10-16 14:44 --------- d-----w C:\Program Files\Circle Developement
2008-10-14 16:12 --------- d-----w C:\ProgramData\Skype
2008-10-14 10:12 --------- d-----w C:\Program Files\ImTOO
2008-10-13 14:07 --------- d-----w C:\Users\vista\AppData\Roaming\IDM
2008-10-12 14:24 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-10-12 14:24 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-10-12 14:24 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-10-12 14:24 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-10-12 14:23 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-10-12 14:23 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-10-10 14:07 90,112 ----a-w C:\Windows\System32\agsaami.dll
2008-10-10 14:07 610,304 ----a-w C:\Windows\System32\agsaamg.dll
2008-10-10 14:07 372,736 ----a-w C:\Windows\System32\agsaamc.dll
2008-10-10 14:07 2,535,424 ----a-w C:\Windows\System32\agsaamj.dll
2008-10-10 14:07 196,608 ----a-w C:\Windows\System32\maag.dll
2008-10-10 14:07 1,986,560 ----a-w C:\Windows\System32\akll.dll
2008-10-10 14:07 1,245,184 ----a-w C:\Windows\System32\bkll.dll
2008-10-10 14:07 1,212,416 ----a-w C:\Windows\System32\ckll.dll
2008-10-10 14:07 --------- d-----w C:\Program Files\Real_SC
2008-10-09 20:08 --------- d-----w C:\Program Files\Internet Download Manager
2008-10-09 18:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-09 18:59 --------- d-----w C:\Program Files\Justdo Software
2008-10-09 18:59 --------- d-----w C:\Program Files\Common Files\Justdo
2008-10-09 16:45 --------- d-----w C:\Users\vista\AppData\Roaming\Nero
2008-10-09 16:43 --------- d-----w C:\Users\vista\AppData\Roaming\ACD Systems
2008-10-09 16:36 --------- d-----w C:\Program Files\Zuma
2008-10-09 15:05 --------- d-----w C:\Users\vista\AppData\Roaming\Skype
2008-10-09 14:09 --------- d-----w C:\Users\vista\AppData\Roaming\COWON
2008-10-09 13:45 --------- d-----w C:\ProgramData\Messenger Plus!
2008-10-08 17:52 --------- d-----w C:\Program Files\Toshiba
2008-10-08 17:49 --------- d-----w C:\Program Files\Intel
2008-10-08 17:48 --------- d-----w C:\Program Files\REALTEK USB Wireless LAN Driver
2008-10-08 17:47 --------- d-----w C:\Users\vista\AppData\Roaming\InstallShield
2008-10-08 17:40 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-08 17:29 --------- d-----w C:\Users\vista\AppData\Roaming\uTorrent
2008-10-08 17:27 --------- d-----w C:\Program Files\Hotspot Shield
2008-10-08 17:24 --------- d-----w C:\Program Files\Microsoft SDK for Java 4.0
2008-10-08 17:23 --------- d-----w C:\Program Files\Yahoo!
2008-10-08 17:22 --------- d-----w C:\Program Files\Windows Live
2008-10-08 17:21 --------- d-----w C:\Users\vista\AppData\Roaming\Paltalk
2008-10-08 17:21 --------- d-----w C:\Program Files\Paltalk Messenger
2008-10-08 17:19 --------- d-----w C:\Program Files\BounceOut
2008-10-08 17:16 --------- d-----w C:\Users\vista\AppData\Roaming\CyberLink
2008-10-08 17:16 --------- d-----w C:\Program Files\Quranzu1
2008-10-08 17:15 --------- d-----w C:\ProgramData\CyberLink
2008-10-08 17:13 --------- d-----w C:\Program Files\Real
2008-10-08 17:13 --------- d-----w C:\Program Files\Nero
2008-10-08 17:13 --------- d-----w C:\Program Files\JetAudio
2008-10-08 17:13 --------- d-----w C:\Program Files\CyberLink
2008-10-08 17:13 --------- d-----w C:\Program Files\Common Files\xing shared
2008-10-08 17:13 --------- d-----w C:\Program Files\Common Files\Nero
2008-10-08 17:13 --------- d-----w C:\Program Files\Common Files\COWON
2008-10-08 17:12 --------- d-----w C:\Program Files\Common Files\Real
2008-10-08 17:11 155,995 ----a-w C:\Windows\Java\Packages\4NPBPRJ9.ZIP
2008-10-08 17:11 --------- d-----w C:\Users\vista\AppData\Roaming\PC Suite
2008-10-08 17:11 --------- d-----w C:\Users\vista\AppData\Roaming\Nokia
2008-10-08 17:11 --------- d-----w C:\ProgramData\PC Suite
2008-10-08 17:11 --------- d-----w C:\ProgramData\Nero
2008-10-08 17:11 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-10-08 17:10 499,712 ----a-w C:\Windows\System32\msvcp71.dll
2008-10-08 17:10 348,160 ----a-w C:\Windows\System32\msvcr71.dll
2008-10-08 17:10 --------- d-----w C:\ProgramData\Macrovision
2008-10-08 17:09 --------- d-----w C:\Program Files\Nokia
2008-10-08 17:09 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-10-08 17:09 --------- d-----w C:\Program Files\Common Files\Nokia
2008-10-08 17:08 --------- d-----w C:\Program Files\DIFX
2008-10-08 17:08 --------- d-----w C:\Program Files\Common Files\Macromedia Shared
2008-10-08 17:07 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-10-08 17:07 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-10-08 17:06 --------- d-----w C:\Program Files\Macromedia
2008-10-08 17:06 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-10-08 17:05 --------- d-----w C:\ProgramData\ACD Systems
2008-10-08 17:05 --------- d-----w C:\Program Files\ACD Systems
2008-10-08 17:04 --------- d-----w C:\ProgramData\Installations
2008-10-08 17:04 --------- d-----w C:\Program Files\SereneScreen
2008-10-08 17:03 --------- d-----w C:\Program Files\Video Convert Master
2008-10-08 17:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-08 16:48 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-10-08 16:46 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-10-08 16:46 172,032 ------w C:\Windows\Setup1.exe
2008-10-08 16:42 512,096 ----a-w C:\Windows\system32\drivers\amon.sys
2008-10-08 16:42 298,104 ----a-w C:\Windows\System32\imon.dll
2008-10-08 16:39 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-08 16:38 --------- d-----w C:\Program Files\Microsoft Works
2008-10-08 16:37 --------- d-----w C:\Program Files\Microsoft.NET
2008-10-08 16:12 240,128 ----a-w C:\Windows\system32\drivers\royal.sys
2008-10-08 15:59 --------- d-sh--w C:\ProgramData\قائمة ابدأ
2008-10-08 15:59 --------- d-sh--w C:\ProgramData\سطح المكتب
2008-08-10 18:18 267,056 ----a-w C:\utorrent.exe
2006-11-02 12:49 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [11/02/2006 03:33 PM 1196032]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [10/08/2008 08:17 PM 920064]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [08/16/2007 04:19 PM 5728112]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [11/02/2006 03:34 PM 125440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dash idol"="C:\ProgramData\HECK ANTE ANTE.ezixyi" [X]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [10/08/2008 07:42 PM 949376]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [10/02/2007 11:38 AM 142104]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [10/02/2007 11:38 AM 154392]
"Persistence"="C:\Windows\system32\igfxpers.exe" [10/02/2007 11:38 AM 138008]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10/08/2008 08:10 PM 185896]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [09/29/2006 09:58 PM 49152]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 08/16/2007 04:19 PM 5728112 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 06/17/2008 04:00 PM 1249280 C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 08/11/2008 08:31 AM 1124352 C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 09/18/2006 11:08 AM 29696 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 10/27/2007 07:51 AM 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-807637830-1228134173-3847359455-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9AF7BC1A-8201-4EFC-A08A-06567123179D}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{D2BFE9EC-F102-4277-A963-824F114FFA38}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{B29889F6-E38C-429B-ADF8-8CC712FD1009}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{39CDC084-1A7F-43F5-B58F-8CCD4B498924}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B235D349-705B-4C74-8B4D-FE3FB0737806}"= UDP:C:\Users\vista\Desktop\dsoft10\utorrent.exe:µTorrent (TCP-In)
"{33ED25B0-21D0-4668-8503-3C1B05B080A9}"= TCP:C:\Users\vista\Desktop\dsoft10\utorrent.exe:µTorrent (UDP-In)
"{B5D548A0-D798-4FF7-805D-2064C33CE310}"= UDP:C:\utorrent.exe:µTorrent (TCP-In)
"{32C4923E-950C-4B8F-A57E-BD2DF5D98F00}"= TCP:C:\utorrent.exe:µTorrent (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187B.sys [10/02/2007 11:32 AM 252416]
R3 tapvpn;TAP VPN Adapter;C:\Windows\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM 27136]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [10/08/2008 07:12 PM 240128]
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-SystemBackup - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\vista\AppData\Roaming\Mozilla\Firefox\Profiles\gejls6d3.default\
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-10-18 19:24:37
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 10/18/2008 19:26:08
ComboFix-quarantined-files.txt 2008-10-18 16:26:05
Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 29,863,202,816 bytes free
226
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1256.1.1025.18.262 [GMT 3:00]
Running from: C:\Users\vista\Desktop\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\drivers\nod32drv.sys
C:\Windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2008-09-18 to 2008-10-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-18 16:24 --------- d-----w C:\Users\vista\AppData\Roaming\DMCache
2008-10-18 15:31 --------- d-----w C:\Program Files\ESET
2008-10-18 09:49 --------- d-----w C:\Program Files\مشغل الفلاش العربي
2008-10-18 09:29 --------- d-----w C:\Program Files\SWiSHmax
2008-10-18 05:22 --------- d-----w C:\Program Files\Kelk 2000
2008-10-16 14:55 --------- d-----w C:\ProgramData\Poll Anti Mix
2008-10-16 14:45 --------- d-----w C:\Program Files\Poll Anti Mix
2008-10-16 14:44 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-10-16 14:44 --------- d-----w C:\Program Files\Circle Developement
2008-10-14 16:12 --------- d-----w C:\ProgramData\Skype
2008-10-14 10:12 --------- d-----w C:\Program Files\ImTOO
2008-10-13 14:07 --------- d-----w C:\Users\vista\AppData\Roaming\IDM
2008-10-12 14:24 53,080 ----a-w C:\Windows\System32\wuauclt.exe
2008-10-12 14:24 43,352 ----a-w C:\Windows\System32\wups2.dll
2008-10-12 14:24 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll
2008-10-12 14:24 1,524,224 ----a-w C:\Windows\System32\wucltux.dll
2008-10-12 14:23 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-10-12 14:23 163,000 ----a-w C:\Windows\System32\wuwebv.dll
2008-10-10 14:07 90,112 ----a-w C:\Windows\System32\agsaami.dll
2008-10-10 14:07 610,304 ----a-w C:\Windows\System32\agsaamg.dll
2008-10-10 14:07 372,736 ----a-w C:\Windows\System32\agsaamc.dll
2008-10-10 14:07 2,535,424 ----a-w C:\Windows\System32\agsaamj.dll
2008-10-10 14:07 196,608 ----a-w C:\Windows\System32\maag.dll
2008-10-10 14:07 1,986,560 ----a-w C:\Windows\System32\akll.dll
2008-10-10 14:07 1,245,184 ----a-w C:\Windows\System32\bkll.dll
2008-10-10 14:07 1,212,416 ----a-w C:\Windows\System32\ckll.dll
2008-10-10 14:07 --------- d-----w C:\Program Files\Real_SC
2008-10-09 20:08 --------- d-----w C:\Program Files\Internet Download Manager
2008-10-09 18:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-09 18:59 --------- d-----w C:\Program Files\Justdo Software
2008-10-09 18:59 --------- d-----w C:\Program Files\Common Files\Justdo
2008-10-09 16:45 --------- d-----w C:\Users\vista\AppData\Roaming\Nero
2008-10-09 16:43 --------- d-----w C:\Users\vista\AppData\Roaming\ACD Systems
2008-10-09 16:36 --------- d-----w C:\Program Files\Zuma
2008-10-09 15:05 --------- d-----w C:\Users\vista\AppData\Roaming\Skype
2008-10-09 14:09 --------- d-----w C:\Users\vista\AppData\Roaming\COWON
2008-10-09 13:45 --------- d-----w C:\ProgramData\Messenger Plus!
2008-10-08 17:52 --------- d-----w C:\Program Files\Toshiba
2008-10-08 17:49 --------- d-----w C:\Program Files\Intel
2008-10-08 17:48 --------- d-----w C:\Program Files\REALTEK USB Wireless LAN Driver
2008-10-08 17:47 --------- d-----w C:\Users\vista\AppData\Roaming\InstallShield
2008-10-08 17:40 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-08 17:29 --------- d-----w C:\Users\vista\AppData\Roaming\uTorrent
2008-10-08 17:27 --------- d-----w C:\Program Files\Hotspot Shield
2008-10-08 17:24 --------- d-----w C:\Program Files\Microsoft SDK for Java 4.0
2008-10-08 17:23 --------- d-----w C:\Program Files\Yahoo!
2008-10-08 17:22 --------- d-----w C:\Program Files\Windows Live
2008-10-08 17:21 --------- d-----w C:\Users\vista\AppData\Roaming\Paltalk
2008-10-08 17:21 --------- d-----w C:\Program Files\Paltalk Messenger
2008-10-08 17:19 --------- d-----w C:\Program Files\BounceOut
2008-10-08 17:16 --------- d-----w C:\Users\vista\AppData\Roaming\CyberLink
2008-10-08 17:16 --------- d-----w C:\Program Files\Quranzu1
2008-10-08 17:15 --------- d-----w C:\ProgramData\CyberLink
2008-10-08 17:13 --------- d-----w C:\Program Files\Real
2008-10-08 17:13 --------- d-----w C:\Program Files\Nero
2008-10-08 17:13 --------- d-----w C:\Program Files\JetAudio
2008-10-08 17:13 --------- d-----w C:\Program Files\CyberLink
2008-10-08 17:13 --------- d-----w C:\Program Files\Common Files\xing shared
2008-10-08 17:13 --------- d-----w C:\Program Files\Common Files\Nero
2008-10-08 17:13 --------- d-----w C:\Program Files\Common Files\COWON
2008-10-08 17:12 --------- d-----w C:\Program Files\Common Files\Real
2008-10-08 17:11 155,995 ----a-w C:\Windows\Java\Packages\4NPBPRJ9.ZIP
2008-10-08 17:11 --------- d-----w C:\Users\vista\AppData\Roaming\PC Suite
2008-10-08 17:11 --------- d-----w C:\Users\vista\AppData\Roaming\Nokia
2008-10-08 17:11 --------- d-----w C:\ProgramData\PC Suite
2008-10-08 17:11 --------- d-----w C:\ProgramData\Nero
2008-10-08 17:11 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-10-08 17:10 499,712 ----a-w C:\Windows\System32\msvcp71.dll
2008-10-08 17:10 348,160 ----a-w C:\Windows\System32\msvcr71.dll
2008-10-08 17:10 --------- d-----w C:\ProgramData\Macrovision
2008-10-08 17:09 --------- d-----w C:\Program Files\Nokia
2008-10-08 17:09 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-10-08 17:09 --------- d-----w C:\Program Files\Common Files\Nokia
2008-10-08 17:08 --------- d-----w C:\Program Files\DIFX
2008-10-08 17:08 --------- d-----w C:\Program Files\Common Files\Macromedia Shared
2008-10-08 17:07 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-10-08 17:07 --------- d-----w C:\Program Files\Common Files\Macromedia
2008-10-08 17:06 --------- d-----w C:\Program Files\Macromedia
2008-10-08 17:06 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-10-08 17:05 --------- d-----w C:\ProgramData\ACD Systems
2008-10-08 17:05 --------- d-----w C:\Program Files\ACD Systems
2008-10-08 17:04 --------- d-----w C:\ProgramData\Installations
2008-10-08 17:04 --------- d-----w C:\Program Files\SereneScreen
2008-10-08 17:03 --------- d-----w C:\Program Files\Video Convert Master
2008-10-08 17:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-08 16:48 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-10-08 16:46 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-10-08 16:46 172,032 ------w C:\Windows\Setup1.exe
2008-10-08 16:42 512,096 ----a-w C:\Windows\system32\drivers\amon.sys
2008-10-08 16:42 298,104 ----a-w C:\Windows\System32\imon.dll
2008-10-08 16:39 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-08 16:38 --------- d-----w C:\Program Files\Microsoft Works
2008-10-08 16:37 --------- d-----w C:\Program Files\Microsoft.NET
2008-10-08 16:12 240,128 ----a-w C:\Windows\system32\drivers\royal.sys
2008-10-08 15:59 --------- d-sh--w C:\ProgramData\قائمة ابدأ
2008-10-08 15:59 --------- d-sh--w C:\ProgramData\سطح المكتب
2008-08-10 18:18 267,056 ----a-w C:\utorrent.exe
2006-11-02 12:49 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [11/02/2006 03:33 PM 1196032]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [10/08/2008 08:17 PM 920064]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [08/16/2007 04:19 PM 5728112]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [11/02/2006 03:34 PM 125440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dash idol"="C:\ProgramData\HECK ANTE ANTE.ezixyi" [X]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [10/08/2008 07:42 PM 949376]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [10/02/2007 11:38 AM 142104]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [10/02/2007 11:38 AM 154392]
"Persistence"="C:\Windows\system32\igfxpers.exe" [10/02/2007 11:38 AM 138008]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10/08/2008 08:10 PM 185896]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [09/29/2006 09:58 PM 49152]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 08/16/2007 04:19 PM 5728112 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 06/17/2008 04:00 PM 1249280 C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 08/11/2008 08:31 AM 1124352 C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 09/18/2006 11:08 AM 29696 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 10/27/2007 07:51 AM 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-807637830-1228134173-3847359455-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9AF7BC1A-8201-4EFC-A08A-06567123179D}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{D2BFE9EC-F102-4277-A963-824F114FFA38}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{B29889F6-E38C-429B-ADF8-8CC712FD1009}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{39CDC084-1A7F-43F5-B58F-8CCD4B498924}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B235D349-705B-4C74-8B4D-FE3FB0737806}"= UDP:C:\Users\vista\Desktop\dsoft10\utorrent.exe:µTorrent (TCP-In)
"{33ED25B0-21D0-4668-8503-3C1B05B080A9}"= TCP:C:\Users\vista\Desktop\dsoft10\utorrent.exe:µTorrent (UDP-In)
"{B5D548A0-D798-4FF7-805D-2064C33CE310}"= UDP:C:\utorrent.exe:µTorrent (TCP-In)
"{32C4923E-950C-4B8F-A57E-BD2DF5D98F00}"= TCP:C:\utorrent.exe:µTorrent (UDP-In)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187B.sys [10/02/2007 11:32 AM 252416]
R3 tapvpn;TAP VPN Adapter;C:\Windows\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM 27136]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [10/08/2008 07:12 PM 240128]
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-SystemBackup - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\vista\AppData\Roaming\Mozilla\Firefox\Profiles\gejls6d3.default\
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2008-10-18 19:24:37
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 10/18/2008 19:26:08
ComboFix-quarantined-files.txt 2008-10-18 16:26:05
Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 29,863,202,816 bytes free
226
تأييد
0