تفضل هذا هو التقرير الاول :
ComboFix 08-12-12.02 - XPPRESP3 2008-12-13 9:02:43.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.247.45 [GMT 2:00]
Running from: c:\documents and settings\XPPRESP3\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\cpuinf32.dll
c:\windows\system32\unrar.dll
c:\windows\system32\xvidcore.dll
c:\windows\system32\xvidvfw.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
2008-12-13 09:02 . 2008-12-13 09:02 <DIR> d--hs---- C:\Recycled
2008-12-13 04:28 . 2008-12-13 04:28 0 --a------ c:\windows\ringtonemaker.INI
2008-12-13 04:27 . 2008-12-13 04:27 <DIR> d-------- c:\windows\system32\MAGIX
2008-12-13 04:27 . 2008-12-13 04:27 <DIR> d-------- c:\windows\LastGood
2008-12-13 04:27 . 2008-12-13 04:27 <DIR> d-------- c:\program files\Common Files\MAGIX Shared
2008-12-13 04:27 . 2003-04-18 15:46 1,233,920 --a------ c:\windows\system32\msxml4.dll
2008-12-13 04:27 . 2003-04-18 15:29 82,432 --a------ c:\windows\system32\msxml4r.dll
2008-12-13 04:27 . 2003-04-18 15:29 44,544 --a------ c:\windows\system32\msxml4a.dll
2008-12-13 04:26 . 2008-12-13 04:26 <DIR> d-------- C:\MAGIX
2008-12-13 04:26 . 2002-09-20 23:33 1,089,536 --a------ c:\windows\system32\ROBOEX32.DLL
2008-12-13 04:26 . 2004-12-10 09:47 184,320 --a------ c:\windows\system32\mgxoschk.dll
2008-12-13 04:26 . 1998-10-15 16:28 85,504 --a------ c:\windows\system32\HtmlWH.dll
2008-12-13 04:26 . 1999-01-28 13:44 49,152 --a------ c:\windows\system32\INETWH32.dll
2008-12-13 04:26 . 2004-08-13 11:35 999 --a------ c:\windows\mgxoschk.ini
2008-12-13 01:42 . 2004-09-14 22:55 88,960 -ra------ c:\windows\system32\drivers\MidiSyn.sys
2008-12-13 01:41 . 2004-08-04 00:56 130,048 --a------ c:\windows\system32\ksproxy.ax
2008-12-13 01:41 . 2004-08-04 00:56 23,552 --a------ c:\windows\system32\wdmaud.drv
2008-12-13 01:41 . 2004-08-04 00:56 4,096 --a------ c:\windows\system32\ksuser.dll
2008-12-13 01:39 . 2008-12-13 01:39 <DIR> d--hs---- C:\FOUND.003
2008-12-13 01:20 . 2008-12-13 01:20 <DIR> d-------- C:\Drivers
2008-12-13 01:15 . 2008-12-13 01:15 <DIR> d-------- c:\program files\Microsoft IntelliPoint
2008-12-13 01:15 . 2008-06-10 13:04 31,048 --a------ c:\windows\system32\drivers\point32.sys
2008-12-13 01:13 . 2008-12-13 01:13 <DIR> d-------- c:\program files\MSXML 6.0
2008-12-13 00:48 . 2008-12-13 00:48 <DIR> d-------- c:\program files\Uniblue
2008-12-13 00:48 . 2008-12-13 00:48 <DIR> d-------- c:\documents and settings\XPPRESP3\Application Data\Uniblue
2008-12-13 00:48 . 2008-12-13 00:48 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\DriverScanner
2008-12-13 00:41 . 2008-12-13 00:41 <DIR> d--h----- c:\documents and settings\All Users.WINDOWS\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2008-12-13 00:30 . 2007-04-16 15:28 577,536 --a------ c:\windows\SOUNDMAN.EXE
2008-12-13 00:30 . 2006-07-31 11:19 315,392 --a------ c:\windows\alcupd.exe
2008-12-13 00:30 . 2006-07-31 11:27 8,192 --a------ c:\windows\alcrmv.exe
2008-12-13 00:29 . 2004-08-12 17:45 137,728 --------- c:\windows\system32\drivers\Hdaudbus.sys
2008-12-13 00:29 . 2004-08-12 17:45 113,664 --------- c:\windows\system32\drivers\HFX57.tmp
2008-12-13 00:29 . 2004-08-12 17:45 113,664 --------- c:\windows\system32\drivers\Hdaudio.sys
2008-12-12 23:41 . 2008-12-12 23:41 <DIR> d--hs---- C:\FOUND.002
2008-12-12 22:33 . 2008-12-12 22:33 <DIR> d-------- c:\program files\ma-config.com
2008-12-12 22:33 . 2008-12-12 22:33 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\ma-config.com
2008-12-12 21:38 . 2005-09-20 10:36 122,880 --a------ c:\windows\system32\igfxres.dll
2008-12-12 19:33 . 2008-08-19 10:56 53,248 --a------ c:\windows\system32\CSVer.dll
2008-12-12 19:10 . 2008-12-12 19:10 552 --a------ c:\windows\system32\d3d8caps.dat
2008-12-12 19:04 . 2008-12-12 19:04 <DIR> d--hs---- C:\FOUND.001
2008-12-12 16:22 . 2008-12-12 16:22 <DIR> d-------- c:\program files\LeapFTP
2008-12-12 16:22 . 2002-08-16 15:15 65,536 --a------ c:\windows\unleap.exe
2008-12-12 11:41 . 2008-12-12 11:41 <DIR> d-------- c:\program files\Intel
2008-12-12 11:40 . 2008-12-13 01:40 11,001 --a------ c:\windows\Ascd_tmp.ini
2008-12-12 11:40 . 2005-04-30 14:30 5,824 --a------ c:\windows\system32\drivers\ASUSHWIO.SYS
2008-12-12 11:39 . 2008-12-12 11:39 <DIR> d-------- c:\windows\Drivers
2008-12-12 11:24 . 2008-12-12 19:10 664 --a------ c:\windows\system32\d3d9caps.dat
2008-12-11 18:53 . 2008-12-11 18:53 <DIR> d-------- c:\program files\AcidCO
2008-12-11 18:14 . 2008-12-11 18:14 <DIR> d-------- c:\documents and settings\XPPRESP3\Contacts
2008-12-11 16:52 . 2008-12-11 16:52 <DIR> d-------- c:\windows\system32\DRVSTORE
2008-12-11 16:31 . 2001-08-17 13:48 12,160 --a------ c:\windows\system32\drivers\mouhid.sys
2008-12-11 16:31 . 2001-08-17 14:02 9,600 --a------ c:\windows\system32\drivers\hidusb.sys
2008-12-10 19:42 . 2008-12-10 19:42 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\MumboJumbo
2008-12-10 17:25 . 2008-12-10 17:25 <DIR> d-------- C:\Intel
2008-12-10 16:42 . 2008-12-10 16:42 <DIR> d-------- c:\documents and settings\XPPRESP3\Application Data\ACD Systems
2008-12-10 16:24 . 2008-03-09 06:25 236 --ah----- c:\program files\Common Files\dx.reg
2008-12-10 14:57 . 2008-12-10 14:57 <DIR> d-------- c:\program files\Driver-Soft
2008-12-10 14:57 . 2007-09-02 20:56 1,686,016 --a------ c:\windows\system32\clinetsuitex6.ocx
2008-12-10 14:57 . 2004-03-09 16:45 662,288 --a------ c:\windows\system32\MSCOMCT2.OCX
2008-12-10 14:57 . 2004-06-14 14:56 427,864 --a------ c:\windows\system32\XceedZip.dll
2008-12-10 14:32 . 2008-12-10 14:32 <DIR> d-------- c:\windows\Sun
2008-12-10 14:32 . 2008-12-10 14:32 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-12-10 14:32 . 2008-12-10 14:32 <DIR> d-------- c:\documents and settings\XPPRESP3\Application Data\SystemRequirementsLab
2008-12-10 13:50 . 2008-12-10 13:50 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Avira
2008-12-10 13:26 . 2004-08-04 11:56 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-10 13:25 . 2008-12-10 13:25 <DIR> d-------- c:\windows\help
2008-12-10 13:25 . 2008-12-10 13:25 <DIR> d-------- c:\program files\Yahoo!
2008-12-10 13:25 . 2008-12-10 13:25 <DIR> d-------- c:\program files\Winamp
2008-12-10 13:25 . 2008-12-13 09:04 165 --a------ c:\windows\Winamp.ini
2008-12-10 13:24 . 2008-12-10 13:24 <DIR> d-------- c:\program files\TaskSwitchXP
2008-12-10 13:24 . 2008-12-10 13:24 <DIR> d-------- c:\program files\Java
2008-12-10 13:24 . 2008-12-10 13:24 <DIR> d-------- c:\program files\Common Files\Java
2008-12-10 13:24 . 2005-06-03 03:52 49,265 --a------ c:\windows\system32\jpicpl32.cpl
2008-12-10 13:24 . 2005-12-23 10:44 194 -ra------ c:\windows\Winamp5.ini
2008-12-10 13:23 . 2008-12-10 13:23 <DIR> d-------- c:\program files\MSN Messenger
2008-12-10 13:21 . 2008-12-10 13:21 <DIR> d-------- c:\windows\system32\URTTemp
2008-12-10 13:21 . 2008-12-10 17:42 2,947 --a------ c:\windows\mozver.dat
2008-12-10 13:20 . 2008-12-10 13:20 <DIR> d-------- c:\program files\K-Lite Codec Pack
2008-12-10 13:20 . 2008-12-10 13:20 <DIR> d-------- c:\documents and settings\XPPRESP3\Application Data\Media Player Classic
2008-12-10 13:20 . 2008-12-10 13:20 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer
2008-12-10 13:20 . 2004-10-14 08:33 2,024,448 --a------ c:\windows\system32\divx.dll
2008-12-10 13:20 . 2003-06-23 02:44 1,415,680 --a------ c:\windows\system32\WMV9VCM.dll
2008-12-10 13:20 . 2004-01-27 13:53 1,024,000 --a------ c:\windows\system32\3ivx.dll
2008-12-10 13:20 . 2003-04-21 15:09 245,408 --a------ c:\windows\system32\unicows.dll
2008-12-10 13:20 . 2005-10-17 20:58 65,536 --a------ c:\windows\system32\QuickTimeVR.qtx
2008-12-10 13:20 . 2005-10-17 20:57 49,152 --a------ c:\windows\system32\QuickTime.qts
2008-12-10 13:19 . 2008-12-10 13:19 <DIR> d-------- c:\windows\Downloaded Installations
2008-12-10 13:19 . 2008-12-10 13:19 <DIR> d-------- c:\program files\Google
2008-12-10 13:19 . 2008-12-10 13:19 <DIR> d-------- c:\program files\FlashGet
2008-12-10 13:19 . 2008-12-10 13:19 <DIR> d-------- c:\program files\CCleaner
2008-12-10 13:18 . 2008-12-10 13:18 <DIR> d-------- c:\program files\Common Files\Adobe
2008-12-10 13:17 . 2008-12-10 13:17 <DIR> d-------- c:\program files\Common Files\ACD Systems
2008-12-10 13:17 . 2008-12-10 13:17 <DIR> d-------- c:\program files\ACD Systems
2008-12-10 13:17 . 2008-12-10 13:17 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Application Data\ACD Systems
2008-12-10 13:17 . 2005-07-24 23:26 24,816 --a------ c:\windows\system32\mdimon.dll
2008-12-10 13:17 . 2008-12-10 13:17 376 --a------ c:\windows\ODBC.INI
2008-12-10 13:16 . 2008-12-10 13:16 <DIR> d-------- c:\windows\SHELLNEW
2008-12-10 13:16 . 2008-12-10 13:16 <DIR> d-------- c:\program files\Microsoft.NET
2008-12-10 13:16 . 2008-12-10 13:16 <DIR> d-------- c:\program files\Microsoft ActiveSync
2008-12-10 13:13 . 2008-12-10 13:13 <DIR> d-------- c:\documents and settings\XPPRESP3
2008-12-10 13:13 . 2008-12-10 13:13 <DIR> d--hs---- c:\documents and settings\NetworkService.NT AUTHORITY
2008-12-10 13:13 . 2008-12-10 13:13 <DIR> d--hs---- c:\documents and settings\LocalService.NT AUTHORITY
2008-12-10 13:13 . 2008-12-10 13:13 8,192 --a------ c:\windows\REGLOCS.OLD
2008-12-10 13:11 . 2008-12-10 13:11 <DIR> d--h----- c:\windows\$hf_mig$
2008-12-10 13:11 . 2008-12-10 13:11 316,640 --a------ c:\windows\WMSysPr9.prx
2008-12-10 13:11 . 2008-12-10 13:11 23,392 --a------ c:\windows\system32\nscompat.tlb
2008-12-10 13:11 . 2008-12-10 13:11 16,832 --a------ c:\windows\system32\amcompat.tlb
2008-12-10 13:11 . 2008-12-10 13:11 0 --a------ c:\windows\control.ini
2008-12-10 13:10 . 2008-12-10 13:10 <DIR> d--hs---- c:\documents and settings\All Users.WINDOWS\DRM
2008-12-10 13:10 . 2008-12-10 13:10 749 -rah----- c:\windows\WindowsShell.Manifest
2008-12-10 13:10 . 2008-12-10 13:10 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2008-12-10 13:10 . 2008-12-10 13:10 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2008-12-10 13:10 . 2008-12-10 13:10 749 -rah----- c:\windows\system32\nwc.cpl.manifest
2008-12-10 13:10 . 2008-12-10 13:10 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2008-12-10 13:10 . 2008-12-10 13:10 749 -rah----- c:\windows\system32\cdplayer.exe.manifest
2008-12-10 13:10 . 2008-12-10 13:10 488 -rah----- c:\windows\system32\WindowsLogon.manifest
2008-12-10 13:10 . 2008-12-10 13:10 488 -rah----- c:\windows\system32\logonui.exe.manifest
2008-12-10 13:09 . 2004-08-04 11:56 120,320 --a------ c:\windows\system32\wuweb.dll
2008-12-10 13:09 . 2001-08-23 16:00 118,784 --a------ c:\windows\system32\msg723.acm
2008-12-10 13:09 . 2004-08-04 11:56 112,640 --a------ c:\windows\system32\wucltui.dll
2008-12-10 13:09 . 2001-08-23 16:00 64,512 --a------ c:\windows\system32\acctres.dll
2008-12-10 13:09 . 2001-08-23 16:00 48,680 ---hs---- c:\windows\winnt256.bmp
2008-12-10 13:09 . 2001-08-23 16:00 48,680 ---hs---- c:\windows\winnt.bmp
2008-12-10 13:09 . 2001-08-23 16:00 16,384 --a------ c:\windows\system32\icfgnt5.dll
2008-12-10 13:09 . 2001-08-23 16:00 12,288 --a------ c:\windows\system32\nmevtmsg.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-09 21:00 --------- d-----w c:\program files\Marvell
2008-12-09 20:58 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 20:58 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-09 20:58 --------- d-----w c:\program files\Analog Devices
2008-12-09 20:50 --------- d-----w c:\program files\microsoft frontpage
2008-09-19 08:04 270,336 ----a-w c:\windows\system32\ykx32mpcoinst.dll
2005-03-11 15:28 20,640 ----a-w c:\windows\inf\pxhelp20.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2005-07-27 61952]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\ypager.exe" [2005-08-05 3092480]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-12-10 266497]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"nlhr"="c:\windows\System32\AdvPack.Dll" [2004-08-04 99840]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= c:\progra~1\K-LITE~1\codecs\3IVXVF~1.DLL
"VIDC.VP60"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP61"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP62"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP70"= c:\progra~1\K-LITE~1\codecs\vp7vfw.dll
"VIDC.VP31"= c:\progra~1\K-LITE~1\codecs\vp31vfw.dll
"VIDC.FFDS"= c:\progra~1\K-LITE~1\ffdshow\ff_vfw.dll
"msacm.ac3acm"= c:\progra~1\K-LITE~1\codecs\ac3acm.acm
"msacm.l3fhg"= c:\progra~1\K-LITE~1\codecs\l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-12-09 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;"c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-12-09 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;"c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-12-09 41217]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc []
S3 maconfservice;Ma-Config Service;"c:\program files\ma-config.com\maconfservice.exe" [2008-11-17 195752]
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
wuauserv
ShellHWDetection
WmdmPmSN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c59a248-c6e1-11dd-97b5-001bfc4c3b29}]
\Shell\AutoRun\command - 2u.com
\Shell\explore\Command - 2u.com
\Shell\open\Command - 2u.com
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-12-12 c:\windows\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job
- c:\program files\Microsoft IntelliPoint\ipoint.exe [2008-06-10 12:56]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Download All by FlashGet - c:\progra~1\FLASHGET\jc_all.htm
IE: Download using FlashGet - c:\progra~1\FLASHGET\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
LSP: avsda.dll
FF - ProfilePath - c:\documents and settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\zslifs2q.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\XPPRESP3\Application Data\Mozilla\Firefox\Profiles\zslifs2q.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
FF - plugin: c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-13 09:04:23
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\avsda.dll
.
Completion time: 2008-12-13 9:05:03
ComboFix-quarantined-files.txt 2008-12-13 07:05:02
Pre-Run: 5,123,121,152 bytes free
Post-Run: 5,276,827,648 bytes free
311
وهذا هو التقرير الثانى
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:08, on 12/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\XPPRESP3\Desktop\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)
--
End of file - 7176 bytes
.png)
.png)
