شكرا لللاخ الديبلوماسي وهاهو التقرير:ComboFix 08-10-24.02 - YAHIA 10/25/2008 9:46:10.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.583 [GMT 7:00]
Running from: C:\Documents and Settings\YAHIA\My Documents\My Downloads\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll
((((((((((((((((((((((((( Files Created from 2008-09-25 to 2008-10-25 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-25 02:51 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-25 02:51 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-25 02:51 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-25 02:51 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-15 16:34 337,408 ------w C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-14 14:42 --------- d-----w C:\Program Files\Common Files\Nullsoft
2008-10-09 13:57 --------- d-----w C:\Program Files\DivX
2008-10-09 13:12 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-10-09 13:12 --------- d-----w C:\Program Files\Common Files\xing shared
2008-10-08 17:01 --------- d-----w C:\Documents and Settings\YAHIA\Application Data\Ahead
2008-10-07 07:19 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-10-04 12:03 --------- d-----w C:\Program Files\Microsoft.NET
2008-10-03 17:41 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-03 06:24 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-10-03 06:24 --------- d-----w C:\Program Files\Windows Live
2008-10-03 06:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-10-01 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-10-01 12:46 77,824 ----a-w C:\WINDOWS\system32\sico.exe
2008-10-01 11:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-01 03:14 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-09-30 11:32 307,968 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-30 11:32 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-09-30 11:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-29 16:58 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-09-29 14:49 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-09-29 14:48 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-29 14:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-29 14:47 --------- d-----w C:\Program Files\genial78
2008-09-29 14:35 --------- d-----w C:\Program Files\Windows Defender
2008-09-23 04:50 --------- d-----w C:\Program Files\Real
2008-09-23 04:47 --------- d-----w C:\Program Files\PowerQuest
2008-09-23 04:44 --------- d-----w C:\Program Files\Nour
2008-09-23 04:37 --------- d-----w C:\Program Files\Islamic Encyclopedia
2008-09-23 04:33 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-09-23 04:33 172,032 ------w C:\WINDOWS\Setup1.exe
2008-09-23 04:33 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-09-23 04:31 --------- d-----w C:\Documents and Settings\YAHIA\Application Data\Media Player Classic
2008-09-23 04:24 --------- d-----w C:\Program Files\MSXML 4.0
2008-09-23 04:07 --------- d-----w C:\Documents and Settings\YAHIA\Application Data\MiniDm
2008-09-23 04:01 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-23 03:19 --------- d-----w C:\Documents and Settings\YAHIA\Application Data\ATI
2008-09-23 03:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-09-23 03:17 --------- d-----w C:\Program Files\IEPro
2008-09-23 03:17 --------- d-----w C:\Documents and Settings\YAHIA\Application Data\IEPro
2008-09-23 03:10 --------- d-----w C:\Program Files\Google
2008-09-23 03:07 --------- d-----w C:\Program Files\WinAMP
2008-09-23 03:07 --------- d-----w C:\Program Files\FoxItReader
2008-09-23 03:06 --------- d-----w C:\Program Files\UltraIso
2008-09-23 03:06 --------- d-----w C:\Program Files\TuneUp Utilities 2006
2008-09-23 03:06 --------- d-----w C:\Program Files\Nero
2008-09-23 03:06 --------- d-----w C:\Program Files\D-Tools
2008-09-23 03:06 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-23 03:06 --------- d-----w C:\Program Files\Common Files\Real
2008-09-23 03:06 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-23 03:06 --------- d-----w C:\Documents and Settings\YAHIA\Application Data\TuneUp Software
2008-09-23 03:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-23 01:31 --------- d-----w C:\Program Files\MSN Messenger
2008-09-23 01:24 --------- d-----w C:\Program Files\Avira
2008-09-23 01:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-23 01:01 --------- d-----w C:\Program Files\Realtek
2008-09-23 01:01 --------- d-----w C:\Program Files\GIGABYTE
2008-09-23 00:59 --------- d-----w C:\Program Files\Intel
2008-09-22 19:48 9,883 ---ha-w C:\hwids.dat
2008-09-22 19:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-22 19:48 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-22 19:48 --------- d-----w C:\Program Files\ATI Technologies
2008-09-22 19:34 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-09-22 19:34 --------- d-----w C:\Program Files\Unlocker
2008-09-22 19:34 --------- d-----w C:\Program Files\Microsoft PowerToys
2008-09-22 19:34 --------- d-----w C:\Program Files\LClock
2008-09-22 19:34 --------- d-----w C:\Program Files\HashTab Shell Extension
2008-09-16 00:12 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-09-16 00:12 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-15 12:12 1,846,400 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-08 10:41 333,824 ------w C:\WINDOWS\system32\dllcache\srv.sys
2008-09-05 16:30 241,704 ------w C:\WINDOWS\system32\dllcache\wgaLogon.dll
2008-09-05 16:29 917,032 ------w C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-08-27 06:54 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:38 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-14 10:11 2,189,184 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 10:09 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 10:09 2,145,280 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 10:04 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-08-14 09:33 2,066,048 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 09:33 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 09:33 2,023,936 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-08-01 20:54 33,256,951 ----a-w C:\Program Files\kav.en.exe
2008-07-29 13:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-29 04:47 34,847,744 ----a-w C:\Program Files\kav.en.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5674352]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [10/12/2008 02:14 PM 68856]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [04/14/2008 07:12 AM 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [09/07/2006 01:19 PM 15872]
"LClock"="C:\Program Files\LClock\LClock.exe" [09/19/2004 12:27 PM 65536]
"Vistadrv"="C:\WINDOWS\system32\vsdrv.exe" [07/30/2006 03:37 AM 121089]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [11/22/2005 09:05 PM 344064]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM 61440]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [08/22/2004 05:05 PM 81920]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [10/09/2008 08:12 PM 185872]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [07/29/2008 08:20 PM 206088]
"SkyTel"="SkyTel.EXE" [05/16/2006 05:04 PM 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [05/18/2006 01:27 PM 16207872 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 07:12 AM 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5674352]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm
"MSACM.CTADP32"= CTADP32.ACM
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\IEPro\\MiniDM.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM 32784]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [04/14/2008 07:12 AM 14336]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM 24592]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [09/30/2008 06:32 PM 307968]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
s of the 'Scheduled Tasks' folder
2008-10-25 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [02/29/2008 02:24 PM]
2008-10-25 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [11/03/2006 07:20 PM]
.
- - - - ORPHANS REMOVED - - - -
HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll
HKU-Default-RunOnce-nltide2 - rundll32 advpack.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-10-25 09:52:55
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\catchme]
"ImagePath"="\??\C:\DOCUME~1\YAHIA\LOCALS~1\Temp\catchme.sys"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\WINDOWS\system32\config\SYSTEM~1\LOCALS~1\Temp\mc21.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\catchme]
"ImagePath"="\??\C:\DOCUME~1\YAHIA\LOCALS~1\Temp\catchme.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll
PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\Program Files\TuneUp Utilities 2006\WinStylerThemeHelper.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\TUNEUP UTILITIES 2006\WINSTYLERTHEMESVC.EXE
C:\PROGRAM FILES\WINDOWS DEFENDER\MSMPENG.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\MOM.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\CCC.EXE
.
**************************************************************************
.
Completion time: 10/25/2008 9:55:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-25 02:55:32
Pre-Run: 4,733,075,456 bytes free
Post-Run: 4,949,983,232 bytes free
231 --- E O F --- 2008-10-24 14:33:07
