التقرير الاول
ComboFix 08-12-09.02 - Administrator 12/10/2008 3:19:29.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.210 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Messenger\msgmr.dll
c:\windows\AppPatch\AcXtrnel.sdb
c:\windows\Downloaded Program Files\ThunderAdvise.dll
c:\windows\Fonts\Framdee.ttf
c:\windows\MKMKrnl.dll
c:\windows\system32\
01AFE3DC.dll
c:\windows\system32\
08223B03.cfg
c:\windows\system32\
08223B03.dll
c:\windows\system32\122B901E.cfg
c:\windows\system32\122B901E.dll
c:\windows\system32\201476D0.cfg
c:\windows\system32\29EA67E0.dll
c:\windows\system32\2EF0D734.cfg
c:\windows\system32\2EF0D734.dll
c:\windows\system32\3D144530.cfg
c:\windows\system32\4D023DE9.cfg
c:\windows\system32\4D023DE9.dll
c:\windows\system32\56BC86C7.cfg
c:\windows\system32\56BC86C7.dll
c:\windows\system32\5934EA2B.cfg
c:\windows\system32\5934EA2B.dll
c:\windows\system32\6457aed.sys
c:\windows\system32\66AFCB56.cfg
c:\windows\system32\950D1600.cfg
c:\windows\system32\950D1600.dll
c:\windows\system32\9CA963CA.cfg
c:\windows\system32\9CA963CA.dll
c:\windows\system32\A1A6BC2E.cfg
c:\windows\system32\A55F538E.cfg
c:\windows\system32\A55F538E.dll
c:\windows\system32\b71fe93.sys
c:\windows\system32\BA7EDF54.cfg
c:\windows\system32\C8FFD223.cfg
c:\windows\system32\D9C002DD.cfg
c:\windows\system32\DA63E650.cfg
c:\windows\system32\DA63E650.dll
c:\windows\system32\DFB3DAC5.cfg
c:\windows\system32\DFB3DAC5.dll
c:\windows\system32\drivers\HBKernel32.sys
c:\windows\system32\E0D39066.cfg
c:\windows\system32\E0D39066.dll
c:\windows\system32\E4814792.cfg
c:\windows\system32\E4814792.dll
c:\windows\system32\f28907d.sys
c:\windows\system32\F8E07BB2.cfg
c:\windows\system32\FFAE967F.cfg
c:\windows\system32\HBmhly.dll
c:\windows\system32\HBQQFFO.dll
c:\windows\system32\oleadp.dll
c:\windows\system32\system.exe
c:\windows\Update.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_6457AED
-------\Legacy_B71FE93
-------\Legacy_F28907D
-------\Legacy_ISODRIVE
-------\Legacy_NVMINI
-------\Service_6457aed
-------\Service_b71fe93
-------\Service_f28907d
-------\Service_HBKernel32
-------\Service_ISODrive
((((((((((((((((((((((((( Files Created from 2008-11-10 to 2008-12-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 01:21 --------- d-----w c:\program files\microsoft frontpage
2008-12-10 01:19 --------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2008-11-10 00:46 17,014 --sha-w c:\windows\system32\FFAE967F.dll
2008-11-10 00:46 17,012 --sha-w c:\windows\system32\1FD51F1F.dll
2008-11-10 00:11 13,936 --sha-w c:\windows\system32\B6E23E89.dll
2008-11-10 00:11 13,926 --sha-w c:\windows\system32\3D144530.dll
2008-11-10 00:10 14,982 --sha-w c:\windows\system32\66AFCB56.dll
2008-11-10 00:10 14,440 --sha-w c:\windows\system32\C8FFD223.dll
2008-11-10 00:10 13,938 --sha-w c:\windows\system32\BA7EDF54.dll
2008-11-10 00:08 221,834 --sha-w c:\windows\system32\D9C002DD.dll
2008-11-10 00:08 220,778 --sha-w c:\windows\system32\A1A6BC2E.dll
2008-11-10 00:08 18,020 --sha-w c:\windows\system32\201476D0.dll
2008-11-10 00:07 5,504 ----a-w c:\windows\system32\b1a18a3e.sys
2008-11-10 00:07 219,756 --sha-w c:\windows\system32\4FBFD5A4.dll
2008-11-10 00:07 218,710 --sha-w c:\windows\system32\F8E07BB2.dll
2008-11-09 23:28 --------- d-----w c:\documents and settings\Administrator\Application Data\COWON
2008-11-09 21:29 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2008-11-09 21:18 --------- d-----w c:\documents and settings\Administrator\Application Data\Media Player Classic
2008-11-09 10:57 --------- d-----w c:\program files\Unlocker
2008-11-09 10:54 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-09 10:51 352,256 ----a-w c:\windows\system32\IJL151.dll
2008-11-09 10:50 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-09 10:50 --------- d-----w c:\program files\JetAudio
2008-11-09 10:50 --------- d-----w c:\program files\Common Files\COWON
2008-11-09 10:50 --------- d-----w c:\documents and settings\Administrator\Application Data\InstallShield
2008-11-09 10:49 --------- d-----w c:\program files\Yahoo!
2008-11-09 10:49 --------- d-----w c:\program files\Internet Download Manager
2008-11-09 10:48 --------- d-----w c:\documents and settings\Administrator\Application Data\Nero
2008-11-09 10:47 --------- d-----w c:\documents and settings\All Users\Application Data\Avg7
2008-11-09 10:45 --------- d-----w c:\program files\sisagp
2008-11-09 10:45 --------- d-----w c:\program files\SiS VGA Utilities V3.65
2008-11-09 10:44 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-09 10:43 --------- d-----w c:\program files\Realtek Sound Manager
2008-11-09 10:43 --------- d-----w c:\program files\AvRack
2008-11-09 10:33 --------- d-----w c:\program files\Windows Live
2008-11-09 10:32 --------- d-----w c:\program files\UltraISO
2008-11-09 10:32 --------- d-----w c:\program files\Common Files\EZB Systems
2008-11-09 10:32 --------- d-----w c:\documents and settings\All Users\Application Data\TEMP
2008-11-09 10:31 --------- d-----w c:\program files\Notepad2
2008-11-09 10:31 --------- d-----w c:\program files\Msn Explorer7
2008-11-09 10:31 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-09 10:31 --------- d-----w c:\documents and settings\Administrator\Application Data\Notepad2
2008-11-09 10:30 --------- d-----w c:\program files\Rainmeter
2008-11-09 10:30 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-09 10:29 --------- d-----w c:\program files\Nero
2008-11-09 10:29 --------- d-----w c:\program files\Lavalys
2008-11-09 10:29 --------- d-----w c:\program files\Common Files\Nero
2008-11-09 10:28 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-09 10:28 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-11-09 10:28 --------- d-----w c:\program files\AIMP MMC PRO
2008-11-09 10:22 --------- d-----w c:\program files\Windows Media Connect 2
2005-11-23 15:39 45,139 ----a-w c:\program files\Anti NetCut.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/03/2004 11:56 PM 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [07/29/2008 04:18 PM 2610608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [11/15/2004 12:20 PM 77824 c:\windows\SOUNDMAN.EXE]
"SiSPower"="SiSPower.dll" [03/03/2005 08:50 PM 49152 c:\windows\system32\SiSPower.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/03/2004 11:56 PM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [01/05/2007 10:29 PM 124928 c:\windows\system32\advpack.dll]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2008-11-09 118784]
Utility Tray.lnk - c:\windows\system32\sistray.exe [2008-11-09 266240]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideRunAsVerb"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\HelpSvc.exe]
"Debugger"=ntsd -d
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\UIHost.kxp]
"Debugger"=ntsd -d
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"=
S3 b1a18a3e;b1a18a3e;\??\c:\windows\system32\b1a18a3e.sys [2008-11-10 5504]
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
wuauserv
ShellHWDetection
WmdmPmSN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
*Newly Created Service* - HELPSVC
*Newly Created Service* - NVMINI
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe
HKU-Default-Run-LClock - c:\program files\LClock\LClock.exe
HKU-Default-Run-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe
HKU-Default-Run-TaskSwitchXP - c:\program files\TaskSwitchXP\TaskSwitchXP.exe
HKLM-Explorer_Run-MPMKrnl - c:\windows\MKMKrnl.dll
ShellExecuteHooks-{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96} - 4FBFD5A4.dll
ShellExecuteHooks-{C8FFD223-C0FB-40C5-94A0-FD7891AC18E9} - C8FFD223.dll
ShellExecuteHooks-{29EA67E0-9EE5-4D1A-A056-5B7BDAC4CF97} - 29EA67E0.dll
ShellExecuteHooks-{B6E23E89-C925-4BF7-92EB-77EFDF8C58A6} - B6E23E89.dll
ShellExecuteHooks-{01AFE3DC-2242-436E-9B44-6DD1C664E828} - 01AFE3DC.dll
ShellExecuteHooks-{1FD51F1F-97E4-498C-AB12-93332EEAD266} - 1FD51F1F.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.internetdownloadmanager.com/welcome.html
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
c:\windows\Downloaded Program Files\ewidoOnlineScan.dll - O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1}
hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-10 03:22:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\linkinfo.dll 46592 bytes executable
c:\windows\system32\drivers\nvmini.sys 17152 bytes executable
c:\windows\system32\linkinfo.dll 19968 bytes executable
scan completed successfully
hidden files: 3
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]
"ImagePath"="system32\DRIVERS\nvmini.sys"
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 12/10/2008 15:24:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-10 13:24:49
Pre-Run: 5,909,512,192 bytes free
Post-Run: 5,973,565,440 bytes free
262
التقرير التانى
HijackThis.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:27:46 م, on 10/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Anti NetCut.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\RunOnce: PlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
--
End of file - 3580 bytes
