ابشرك اشتغلت الكومبوفيكس برضو، وهذا تقريرها كما هو
ComboFix 08-12-13.03 - al 12/14/2008 18:23:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.502.252 [GMT 3:00]
Running from: c:\documents and settings\al\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\al\Application Data\addon.dat
c:\documents and settings\al\Application Data\tazebama
c:\documents and settings\al\Application Data\tazebama\tazebama.log
c:\documents and settings\al\Application Data\tazebama\zPharaoh.dat
c:\documents and settings\All Users\Application Data\Solt Lake Software
C:\gr06t.cmd
c:\program files\Bifrost
c:\program files\bifrost\klog.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\amvo.exe
c:\windows\system32\djjhqamn.ini
c:\windows\system32\fdkkdbgd.ini
c:\windows\system32\gsjecmdy.ini
c:\windows\system32\ieupdates.exe
c:\windows\system32\msxml71.dll
c:\windows\system32\nhohclgl.ini
c:\windows\system32\npqYbccf.ini
c:\windows\system32\npqYbccf.ini2
c:\windows\system32\onvrblcx.ini
c:\windows\system32\shell31.dll
c:\windows\system32\sixkh7rx.exe.a_a
c:\windows\system32\TDSSbrsr.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSoiqh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSStkdu.log
c:\windows\system32\TDSSxfum.dll
c:\windows\system32\TEMoYJlm.ini
c:\windows\system32\TEMoYJlm.ini2
c:\windows\system32\wwucblde.ini
c:\windows\system32\yqfmiiek.ini
c:\windows\wiaservb.log
c:\windows\wiaserviv.log
D:\gr06t.cmd
E:\gr06t.cmd
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV.SYS
((((((((((((((((((((((((( Files Created from 2008-11-14 to 2008-12-14 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 14:42 --------- d-----w c:\program files\Opera
2008-12-14 03:37 107,733 --sh--r C:\3.com
2008-12-13 15:33 --------- d-----w c:\program files\Intelinet
2008-12-09 17:14 --------- d-----w c:\documents and settings\al\Application Data\Clever Ruler
2008-12-09 15:28 --------- d-----w c:\documents and settings\al\Application Data\VoipBuster
2008-12-06 15:58 --------- d-----w c:\program files\Common Files\xing shared
2008-12-06 15:58 --------- d-----w c:\program files\Common Files\Real
2008-12-01 19:49 --------- d-----w c:\documents and settings\al\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-12-01 19:47 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-12-01 19:46 --------- d-----w c:\program files\Common Files\Adobe
2008-11-27 13:37 --------- d-----w c:\program files\Alwil Software
2008-11-18 19:36 --------- d-----w c:\program files\MSN Messenger
2008-11-18 10:57 512,096 ----a-w c:\windows\system32\drivers\amon.sys
2008-11-18 10:57 15,424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2008-11-13 09:38 --------- d-----w c:\program files\Common Files\L&H
2008-11-13 09:37 --------- d-----w c:\program files\Microsoft ActiveSync
2008-11-13 09:36 --------- d-----w c:\program files\Microsoft Works
2008-11-13 09:17 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-13 09:17 --------- d-----w c:\program files\Media Investigator
2008-11-13 09:16 --------- d-----w c:\program files\JetAudio
2008-11-07 13:19 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-07 13:14 --------- d-----w c:\program files\GetData
2008-11-05 13:45 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2008-10-27 01:46 --------- d-----w c:\documents and settings\al\Application Data\Media Player Classic
2008-10-23 15:20 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-23 08:00 --------- d-----w c:\program files\Yahoo!
2008-10-23 07:57 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-10-22 10:00 --------- d-----w c:\documents and settings\al\Application Data\Yahoo!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [06/12/2008 02:38 AM 34672]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [08/04/2004 03:00 PM 158208]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/04/2004 12:56 AM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 03/23/2006 11:13 PM 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 03/23/2006 11:17 PM 118784 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 03/23/2006 11:17 PM 94208 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intelinet]
--a------ 11/05/2008 05:20 PM 7382296 c:\program files\Intelinet\Intelinet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a------ 08/31/2007 03:43 AM 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:54 PM 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 12/06/2008 06:58 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/31/2007 03:43 AM 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 05/04/2005 05:43 AM 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 04/18/2006 02:34 AM 16143872 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 01/20/2006 11:34 PM 544768 c:\windows\sm56hlpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"IntelinetSecure"=3 (0x3)
"NOD32krn"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"49128:TCP"= 49128:TCP
ORT_49128
"19867:TCP"= 19867:TCP
ORT_19867
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-11-18 15424]
S4 IntelinetSecure;IntelinetSecure;c:\program files\Intelinet\intelin2.exe [2008-12-13 861464]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{173225ff-c8a5-11dc-94e8-0018de7402ee}]
\Shell\AutoRun\command - G:\2fiji.com
\Shell\explore\Command - G:\2fiji.com
\Shell\open\Command - G:\2fiji.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{316933cd-c9e4-11dd-9524-0018de7402ee}]
\Shell\AutoRun\command - G:\3.com
\Shell\explore\Command - G:\3.com
\Shell\open\Command - G:\3.com
.
s of the 'Scheduled Tasks' folder
2008-12-12 c:\windows\Tasks\At1.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At10.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At11.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At12.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At13.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At14.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At15.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At16.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At17.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At18.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At19.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At2.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At20.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At21.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At22.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At23.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At24.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At25.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At26.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At27.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At28.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At29.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At3.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At30.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At31.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At32.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At33.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At34.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At35.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At36.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At37.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At38.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At39.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At4.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At40.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At41.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At42.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-14 c:\windows\Tasks\At43.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At44.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At45.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At46.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At47.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-13 c:\windows\Tasks\At48.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At5.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At6.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At7.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At8.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
2008-12-12 c:\windows\Tasks\At9.job
- c:\windows\system32\sixkh7rx.exe [12/12/2008 08:31 PM]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
ShellExecuteHooks-{9D0D1FD2-D1A2-40E7-94F3-A9DB5E7672EA} - (no file)
MSConfigStartUp-3cec1272 - c:\windows\system32\edlbcuww.dll
MSConfigStartUp-76781792137304045439557498469350 - c:\program files\A360\av360.exe
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-Cognac - c:\docume~1\al\LOCALS~1\Temp\~tmpb.exe
MSConfigStartUp-CrashDump - c:\windows\system32\dumpreport.exe
MSConfigStartUp-Firewall auto setup - c:\docume~1\al\LOCALS~1\Temp\winlogon.exe
MSConfigStartUp-MSFox - c:\docume~1\al\LOCALS~1\Temp\yyy10804.exe
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
MSConfigStartUp-nod32kui - c:\program files\Eset\nod32kui.exe
MSConfigStartUp-PerfectOptimizer - c:\program files\Perfect Optimizer\PerfectOptimizer.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_06\bin\jusched.exe
MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-VoipBuster - c:\program files\VoipBuster.com\VoipBuster\VoipBuster.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
O16 -: Microsoft XML Parser for Java -
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-14 18:28:57
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(804)
c:\windows\system32\imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
Completion time: 12/14/2008 18:29:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-14 15:29:50
Pre-Run: 26,104,963,072 bytes free
Post-Run: 26,199,785,472 bytes free
317
