من البرنامج الثاني
ComboFix 08-12-06.03 - Obaidah 12/06/2008 22:15:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.962.1033.18.448 [GMT 2:00]
Running from: c:\documents and settings\Obaidah\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Obaidah\Favorites\Download programs.url
c:\documents and settings\Obaidah\Favorites\Games.url
c:\documents and settings\Obaidah\Favorites\Translator.url
c:\documents and settings\Obaidah\Favorites\Videos.url
c:\windows\BM27e32007.txt
c:\windows\BM27e32007.xml
c:\windows\pskt.ini
c:\windows\system32\ecbapplp.ini
c:\windows\system32\OYGNVvut.ini
c:\windows\system32\OYGNVvut.ini2
c:\windows\system32\winio.vxd
----- BITS: Possible infected sites -----
hxxp://megauplinkbindinstaller.com
.
((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-06 20:27 25,840,672 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-06 20:26 1,212,192 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-06 20:22 353,276 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-06 20:22 119,840 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-06 20:16 --------- d-----w c:\documents and settings\Obaidah\Application Data\DMCache
2008-12-06 19:30 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-06 18:38 --------- d-----w c:\program files\SUPERAntiSpyware
2008-12-06 18:34 --------- d-----w c:\documents and settings\Obaidah\Application Data\SUPERAntiSpyware.com
2008-12-06 18:34 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-06 18:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-06 17:50 --------- d-----w c:\program files\SpyRemover Pro
2008-12-06 17:23 870,601 ----a-w c:\windows\system32\SRPExe.zip
2008-12-06 17:23 632,610 ----a-w c:\windows\system32\SRPSig.zip
2008-12-06 14:55 --------- d-----w c:\documents and settings\Obaidah\Application Data\DNA
2008-12-06 14:13 --------- d-----w c:\program files\DNA
2008-12-06 14:03 102,400 ----a-w c:\windows\system32\gzo.dll
2008-12-06 01:50 --------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2008-12-05 13:44 --------- d-----w c:\program files\McGraw-Hill Dictionary of Engineering
2008-12-05 11:30 --------- d-----w c:\documents and settings\Obaidah\Application Data\BitTorrent
2008-12-05 11:14 --------- d-----w c:\documents and settings\Obaidah\Application Data\Uniblue
2008-12-05 11:13 --------- dc-h--w c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2008-12-05 11:13 --------- d-----w c:\program files\Uniblue
2008-12-04 16:17 577,024 ----a-w c:\windows\system32\user32.dll
2008-12-04 16:16 --------- dc-h--w c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-12-04 15:49 --------- d-----w c:\program files\JetAudio
2008-12-04 15:15 --------- d-----w c:\documents and settings\Obaidah\Application Data\Malwarebytes
2008-12-04 15:15 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-04 15:12 --------- d-----w c:\program files\Common Files\COWON
2008-12-04 14:28 --------- d-----w c:\program files\BitTorrent
2008-12-04 13:50 --------- d-----w c:\program files\MyInternetTV
2008-12-04 12:19 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-03 19:40 --------- d-----w c:\program files\Atlas Link (SD7100C)
2008-12-03 19:32 --------- d-----w c:\program files\BDE
2008-12-03 19:30 --------- d-----w c:\documents and settings\Obaidah\Application Data\vlc
2008-11-29 16:32 --------- d-----w c:\documents and settings\Obaidah\Application Data\AvaFind Data
2008-11-28 15:04 --------- d-----w c:\documents and settings\Obaidah\Application Data\Azureus
2008-11-22 16:03 --------- d-----w c:\documents and settings\Obaidah\Application Data\NSeries
2008-11-22 13:18 --------- d-----w c:\program files\Common Files\Adobe
2008-11-21 16:04 --------- d-----w c:\documents and settings\Obaidah\Application Data\Babylon
2008-11-21 12:08 --------- d-----w c:\program files\Internet Download Manager
2008-11-21 12:07 --------- d-----w c:\program files\Natural Ambience
2008-11-21 12:05 720,896 ----a-w c:\windows\iun6002.exe
2008-11-20 21:51 --------- d-----w c:\program files\Chaos Group
2008-11-15 16:32 --------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2008-11-15 16:28 --------- dc-h--w c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2008-11-09 22:25 --------- d-----w c:\program files\AutoCAD Architecture 2009
2008-11-09 22:24 --------- d-----w c:\program files\Common Files\Autodesk Shared
2008-11-09 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2008-11-07 05:15 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-27 20:24 --------- d-----w c:\program files\TextPad 5
2008-10-27 19:28 --------- d-----w c:\documents and settings\Obaidah\Application Data\Helios
2008-10-26 13:43 --------- d-----w c:\program files\Common Files\ACD Systems
2008-10-26 13:43 --------- d-----w c:\program files\ACD Systems
2008-10-26 13:43 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-10-21 19:16 --------- d-----w c:\program files\ma-config.com
2008-10-21 19:16 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2008-10-14 14:19 --------- d-----w c:\program files\Microsoft Office Outlook Connector
2008-10-14 14:18 --------- d-----w c:\program files\Windows Live
2008-10-14 14:14 --------- d-----w c:\program files\Microsoft
2008-10-14 13:34 --------- d-----w c:\program files\Common Files\Windows Live
2008-10-10 12:24 --------- d-----w c:\documents and settings\Obaidah\Application Data\IDM
2008-10-09 19:34 --------- d-----w c:\program files\Common Files\ChaosGroup
2008-10-09 19:34 --------- d-----w c:\program files\Autodesk
2008-10-07 14:27 --------- d-----w c:\program files\WIBUKEY
2008-10-07 14:27 --------- d-----w c:\program files\WIBU-SYSTEMS
2008-09-08 21:03 51,712 ----a-w c:\windows\system32\sirenacm.dll
2008-08-11 15:03 0 ----a-w c:\documents and settings\Obaidah\jagex_runescape_preferences.dat
.
------- Sigcheck -------
09/26/2007 05:10 PM 824320 d6ed5e042c5207553e7f5e842918137f c:\windows\ie7updates\KB950759-IE7\wininet.dll
04/23/2008 05:35 AM 1261568 b0771dde268a8e78e6ec92dc486a4675 c:\windows\system32\WININET.DLL
04/23/2008 05:35 AM 1261568 b0771dde268a8e78e6ec92dc486a4675 c:\windows\system32\dllcache\wininet.dll
03/01/2005 03:36 PM 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
03/01/2005 03:36 PM 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp2qfe\ntkrnlpa.exe
10/07/2007 05:59 AM 2227584 9140f8cde80c7ab687b10f3e402625d7 c:\windows\system32\ntkrnlpa.exe
03/02/2005 03:04 AM 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
03/02/2005 03:04 AM 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\SoftwareDistribution\Download\dc3b8fb011c281dea1cb7a45f880da78\sp2qfe\ntoskrnl.exe
10/09/2007 10:15 AM 2364032 ccbd7abf57f5d99a6544bfd7403ed2c8 c:\windows\system32\ntoskrnl.exe
06/13/2007 12:23 PM 2711552 d3ce30cf1e403881b8c9adb9f62e6270 c:\windows\explorer.exe
06/13/2007 01:26 PM 1033216 7712df0cdde3a5ac89843e61cd5b3658 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
10/02/2007 07:19 PM 1844736 923a7a6a68f3428123c20970d57c55e3 c:\windows\$NtUninstallKB938828$\explorer.exe
06/13/2007 12:23 PM 2711552 d3ce30cf1e403881b8c9adb9f62e6270 c:\windows\system32\dllcache\explorer.exe
09/27/2007 06:10 PM 40448 e00dfa816fa5521eb44c5d63109de2a9 c:\windows\system32\ctfmon.exe
07/30/2007 04:49 PM 215384 fbbbb6fcda2ebee28f55c22e6601bb86 c:\windows\system32\wuauclt.exe
07/30/2007 04:49 PM 215384 fbbbb6fcda2ebee28f55c22e6601bb86 c:\windows\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}"= "c:\program files\myBabylon_English\tbmyBa.dll" [08/20/2008 10:03 PM 1780248]
[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{93811B7D-621D-4230-A7D2-851BF93CBBAF}]
12/06/2008 04:03 PM 102400 --a------ c:\windows\system32\gzo.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
08/20/2008 10:03 PM 1780248 --a------ c:\program files\myBabylon_English\tbmyBa.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}"= "c:\program files\myBabylon_English\tbmyBa.dll" [08/20/2008 10:03 PM 1780248]
[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [08/26/2008 06:48 PM 2019624]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [09/27/2007 06:10 PM 40448]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [09/08/2008 11:02 PM 3513344]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [12/06/2008 08:38 PM 1805552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyRemoverPro"="c:\program files\SpyRemover Pro\SpyRemoverPro.exe" [12/06/2008 07:43 PM 6135808]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [09/27/2007 06:10 PM 40448]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [09/02/2007 12:58 PM 495616]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [06/19/2007 09:17 AM 1241088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [04/23/2008 05:35 AM 124928 c:\windows\system32\advpack.dll]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [05/13/2008 09:13 AM 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
07/23/2008 03:28 PM 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=c:\windows\pss\AutoCAD Startup Accelerator.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Delivery.lnk]
backup=c:\windows\pss\Delivery.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=c:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Obaidah^Start Menu^Programs^Startup^LingvoSoft Talking Dictionary 2008 (English-Arabic).lnk]
backup=c:\windows\pss\LingvoSoft Talking Dictionary 2008 (English-Arabic).lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Obaidah^Start Menu^Programs^Startup^Styler.lnk]
backup=c:\windows\pss\Styler.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowBlinds
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 10/15/2008 01:04 AM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 11/08/2008 09:41 PM 2356088 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
--a------ 09/09/2008 01:20 AM 3551456 c:\program files\Babylon\Babylon-Pro\Babylon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 05/08/2007 05:17 PM 153136 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 11/14/2008 03:34 PM 342336 c:\program files\DNA\btdna.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 10/26/2006 10:17 PM 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 05/15/2007 01:25 PM 1057328 c:\program files\Nero\Nero 7\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 09/29/2006 08:58 PM 49152 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 09/08/2008 11:02 PM 3513344 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 03/01/2007 01:27 PM 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 06/18/2007 02:10 PM 271360 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 03/15/2008 01:50 AM 233472 c:\program files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 05/27/2008 08:20 AM 413696 c:\program files\Ringz Studio\Storm Codec\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RAMDrive]
--a------ 09/14/2004 01:54 PM 36864 c:\program files\FarStone\VDPBS\Vhd\RDTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 09/18/2006 10:08 AM 29696 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung Common SM]
-ra------ 07/03/2005 03:20 PM 372736 c:\windows\Samsung\ComSMMgr\SSMMgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 05/15/2007 01:25 PM 1628208 c:\program files\Nero\Nero 7\InCD\NBHGui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 03/25/2008 01:58 AM 144784 c:\program files\Java\jre1.6.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2009]
--a------ 08/26/2008 06:48 PM 2019624 c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualDrive]
--a------ 09/30/2004 03:11 PM 139264 c:\program files\FarStone\VDPBS\VDP\vdtask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VistaDrive]
--a------ 10/05/2006 07:56 PM 280779 c:\windows\VistaDrive\vistadrive.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 11/03/2006 05:20 PM 866584 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-ra------ 05/04/2005 04:43 AM 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Resume copy]
--a------ 09/24/2007 11:29 PM 46080 c:\windows\copyfstq.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-ra------ 10/15/2005 03:51 AM 14864384 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Autodesk\\3ds Max 2009\\3dsmax.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 archlp;archlp;c:\windows\system32\drivers\archlp.sys [2008-07-31 10624]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-11-17 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-11-17 55024]
R2 fssfltr;FssFltr;c:\windows\system32\DRIVERS\fssfltr.sys [2008-10-14 56344]
R2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit;"c:\program files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe" [2008-03-09 65536]
R2 Stormser;Stormser;c:\progra~1\RINGZS~1\STORMC~1\Stormser.exe [2008-06-24 991232]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]
R3 fvdscsi;fvdscsi;c:\windows\system32\DRIVERS\fvdscsi.sys [2008-06-15 72478]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-11-17 7408]
S3 fsssvc;Windows Live Family Safety;"c:\program files\Windows Live\Family Safety\fsssvc.exe" [2008-09-04 512536]
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-09-02 191656]
S3 SD7100C;GSL SD7100C Electronic Dictionary;c:\windows\system32\Drivers\SD7100C.sys [2008-12-03 33733]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\setup.exe
.
s of the 'Scheduled Tasks' folder
2008-12-06 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [11/03/2006 05:20 PM]
.
- - - - ORPHANS REMOVED - - - -
BHO-{75C1B482-17B7-4B47-96F1-FD0F6889471F} - (no file)
Notify-WBSrv - c:\program files\Stardock\ Desktop\WindowBlinds\wbsrv.dll
Notify-khffGwXo - khffGwXo.dll
Notify-urqQGWpM - urqQGWpM.dll
Notify-WgaLogon - (no file)
MSConfigStartUp-ArcSoft Connection Service - c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.jo/
mStart Page = about:blank
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: English<->Arabic - c:\program files\LingvoSoft\LingvoSoft Talking Dictionary 2007 (English-Arabic) for Windows\Plugins\IE.htm
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {4112549E-AF75-7448-8733-357EF18A2FC6} - c:\program files\LingvoSoft\LingvoSoft Talking Dictionary 2007 (English-Arabic) for Windows\Plugins\IE.htm
IE: {4112549E-AF75-7448-8733-357EF18A2FC6} - c:\program files\LingvoSoft\LingvoSoft Talking Dictionary 2007 (English-Arabic) for Windows\Plugins\IE.htm -
FireFox -: Profile - c:\documents and settings\Obaidah\Application Data\Mozilla\Firefox\Profiles\r6yz2124.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
FF -: plugin - c:\documents and settings\Obaidah\Application Data\Mozilla\Firefox\Profiles\r6yz2124.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - c:\program files\ma-config.com\nphardwaredetection.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-06 22:24:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1092)
c:\windows\system32\SETUPAPI.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\klogon.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll
c:\windows\system32\cscui.dll
c:\windows\system32\COMRes.dll
- - - - - - - > 'lsass.exe'(1160)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\windows\system32\SETUPAPI.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(3336)
c:\windows\system32\CRYPT32.dll
c:\windows\system32\MSASN1.dll
c:\windows\system32\msctfime.ime
c:\windows\system32\COMRes.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\windows\System32\cscui.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ntshrui.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\scrchpg.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 12/06/2008 22:31:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-06 20:31:27
Pre-Run: 21,013,606,400 bytes free
Post-Run: 20,908,003,328 bytes free
356 --- E O F --- 2008-12-06 17
من البرنامج الاول
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:36:39 م, on 06/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\RINGZS~1\STORMC~1\Stormser.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Documents and Settings\Obaidah\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: LopeNinja - {93811B7D-621D-4230-A7D2-851BF93CBBAF} - C:\WINDOWS\system32\gzo.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll
O4 - HKLM\..\Run: [SpyRemoverPro] C:\Program Files\SpyRemover Pro\SpyRemoverPro.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: English<->Arabic - C:\Program Files\LingvoSoft\LingvoSoft Talking Dictionary 2007 (English-Arabic) for Windows\Plugins\IE.htm
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: English<->Arabic - {4112549E-AF75-7448-8733-357EF18A2FC6} - C:\Program Files\LingvoSoft\LingvoSoft Talking Dictionary 2007 (English-Arabic) for Windows\Plugins\IE.htm
O9 - Extra 'Tools' menuitem: English<->Arabic - {4112549E-AF75-7448-8733-357EF18A2FC6} - C:\Program Files\LingvoSoft\LingvoSoft Talking Dictionary 2007 (English-Arabic) for Windows\Plugins\IE.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max Design 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Stormser - ???? - C:\PROGRA~1\RINGZS~1\STORMC~1\Stormser.exe
--
End of file - 9405 bytes
