الغالي هذا تقرير الاداة الاولي
ComboFix 09-03-04.01 - alaswedy 03/07/2009 23:48:16.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.502.255 [GMT 4:00]
Running from: c:\documents and settings\alaswedy\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
G:\autorun.inf
G:\ojmkk.pif
.
((((((((((((((((((((((((( Files Created from 2009-02-07 to 2009-03-07 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-07 19:50 --------- d-----w c:\documents and settings\alaswedy\Application Data\DMCache
2009-03-07 19:44 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-07 19:42 639,008 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-03-07 19:42 4,312 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-03-07 19:42 3,257,888 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-07 19:42 27,580 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-07 19:30 --------- d-----w c:\documents and settings\alaswedy\Application Data\Skype
2009-03-07 12:05 --------- d-----w c:\documents and settings\alaswedy\Application Data\skypePM
2009-03-06 08:25 --------- d-----w c:\documents and settings\alaswedy\Application Data\cleaner
2009-03-04 19:29 --------- d-----w c:\program files\Common Files\SWiSHzone.com
2009-03-04 11:55 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-04 11:18 --------- d-----w c:\program files\Spyware Doctor
2009-02-24 12:56 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-02-24 03:19 --------- d-----w c:\program files\Common Files\Adobe
2009-02-22 13:47 --------- d-----w c:\program files\Windows Live SkyDrive
2009-02-18 18:08 --------- d-----w c:\program files\Avant Browser
2009-02-11 13:18 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-11 09:01 --------- d-----w c:\program files\Snagit 9
2009-02-11 09:00 --------- d-----w c:\program files\oovooToolbar
2009-02-11 09:00 --------- d-----w c:\program files\Hotspot Shield
2009-02-11 09:00 --------- d-----w c:\program files\ESET
2009-02-11 09:00 --------- d-----w c:\program files\AskBarDis(2)
2009-02-10 21:30 --------- d-----w c:\program files\VS Revo Group
2009-02-10 17:38 --------- d-----w c:\documents and settings\alaswedy\Application Data\IDM
2009-02-06 16:43 307,576 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 15:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-04 07:24 --------- d-----w c:\documents and settings\All Users\Application Data\MSNRecorderMax
2009-02-04 07:24 --------- d-----w c:\documents and settings\alaswedy\Application Data\MSNRecorderMax
2009-02-03 19:57 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-03 19:57 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-03 11:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-03 07:13 --------- d-----w c:\documents and settings\alaswedy\Application Data\ooVoo Details
2009-02-03 03:54 --------- d-----w c:\documents and settings\alaswedy\Application Data\FTWeak
2009-01-27 11:49 --------- d-----w c:\program files\معالج الصور
2009-01-26 12:30 --------- d-----w c:\program files\Recuva
2009-01-24 16:33 --------- d-----w c:\program files\MediaMonkey
2009-01-22 16:32 --------- d-----w c:\program files\Hotspot_Shield
2009-01-22 16:32 --------- d-----w c:\program files\Conduit
2009-01-21 17:48 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-01-21 17:48 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-01-21 17:48 --------- d-----w c:\program files\Real
2009-01-21 17:48 --------- d-----w c:\program files\Common Files\xing shared
2009-01-21 17:48 --------- d-----w c:\program files\Common Files\Real
2009-01-21 17:22 --------- d-----w c:\documents and settings\alaswedy\Application Data\foobar2000
2009-01-21 17:20 --------- d-----w c:\documents and settings\alaswedy\Application Data\GRETECH
2009-01-18 23:56 --------- d-----w c:\documents and settings\alaswedy\Application Data\LimeWire
2009-01-18 15:17 --------- d-----w c:\program files\Common Files\Adobe Systems Shared
2009-01-18 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\Adobe Systems
2009-01-17 21:42 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-17 21:42 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-17 21:39 --------- d-----w c:\program files\Windows Media Bonus Pack for Windows XP
2009-01-13 20:56 --------- d-----w c:\documents and settings\alaswedy\Application Data\Desktopicon
2009-01-13 13:40 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-13 13:19 --------- d-----w c:\documents and settings\alaswedy\Application Data\vlc
2009-01-13 11:24 --------- d-----w c:\program files\Java
2009-01-13 08:26 --------- d-----w c:\documents and settings\alaswedy\Application Data\PC Tools
2009-01-12 17:58 --------- d-----w c:\program files\Windows Live
2009-01-12 16:59 --------- d-----w c:\program files\Microsoft Sync Framework
2009-01-12 16:58 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-01-12 16:58 --------- d-----w c:\program files\Microsoft
2009-01-12 16:39 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-11 17:14 --------- d-----w c:\program files\KoolMoves V3.60.1
2009-01-08 11:02 --------- d-----w c:\documents and settings\alaswedy\Application Data\CyberScrub
2009-01-04 19:21 790,528 ----a-w c:\windows\system32\FreeImage.dll
2008-12-30 18:42 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-12-30 18:42 172,032 ------w c:\windows\Setup1.exe
2008-12-20 22:31 826,368 ----a-w c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
01/22/2009 08:27 PM 204248 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [04/14/2008 07:59 PM 15360]
"IDMan"="c:\program files\anoooos\Internet Download Manager\IDMan.exe" [09/01/2008 08:04 PM 2606512]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [11/30/2006 10:49 PM 4662776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [02/11/2009 05:18 PM 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [01/21/2009 09:48 PM 185872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM 39792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 07:59 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKLM\~\startupfolder\C:^Documents and Settings^alaswedy^قائمة ابدأ^البرامج^بدء التشغيل^Ela-Salaty.lnk]
path=c:\documents and settings\alaswedy\قائمة ابدأ\البرامج\بدء التشغيل\Ela-Salaty.lnk
backup=c:\windows\pss\Ela-Salaty.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 11:16 PM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 04/14/2008 07:59 PM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveIcons]
--a------ 03/16/2006 10:07 PM 655360 c:\program files\Realtek\Card Reader Software\DriveIcon\DriveIcon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 09/01/2008 08:04 PM 2606512 c:\program files\anoooos\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 03/23/2006 01:13 PM 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 03/23/2006 01:17 PM 118784 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 03/23/2006 01:17 PM 94208 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
--a------ 06/01/2006 02:57 PM 573440 c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 01/13/2009 05:40 PM 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 03/10/2005 07:43 PM 688218 c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
--a------ 03/10/2005 07:44 PM 98394 c:\program files\Synaptics\SynTP\SynTPLpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 01/21/2009 09:48 PM 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 11/30/2006 10:49 PM 4662776 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 05/03/2005 07:43 PM 69632 c:\windows\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 06/13/2006 09:05 PM 16239616 c:\windows\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 05/16/2006 07:04 PM 2879488 c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:*
isabled
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP:*
isabled
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP:*
isabled
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP:*
isabled
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP:*
isabled
oVoo UDP المنفذ 37675
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7fdc584-e572-11dd-b461-0018de8ce524}]
\Shell\AutoRun\command - x2tpc.cmd
\Shell\open\Command - x2tpc.cmd
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{A057A204-BACC-4D26-8087-36EE87E26986} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - (no file)
HKCU-Run-LowRateVoip - d:\lowratevoip\LowRateVoip.exe
MSConfigStartUp-LowRateVoip - d:\kkk\LowRateVoip\LowRateVoip.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\msnmsgr.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ae/
uInternet Settings,ProxyOverride = local
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\anoooos\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\anoooos\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\anoooos\Internet Download Manager\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-07 23:50:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4cd82af8-ad3b-4932-9bb4-21e4021def8b}]
@Denied: (Full) (Everyone)
"Model"=dword:00000030
"Therad"=dword:00000008
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,2e,4f,dc,2e,77,e9,dc,08,03,15,e4,3e,10,0c,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):63,06,b5,db,ec,00,ac,63,1e,cc,7d,bc,1f,fb,07,bf,97,1a,7c,55,cb,
ca,15,d1,70,dc,4f,ba,02,8c,7f,d9,12,e7,6d,96,c3,43,90,4d,00,00,00,00,00,00,\
.
Completion time: 03/07/2009 23:51:15
ComboFix-quarantined-files.txt 2009-03-07 19:51:12
Pre-Run: 24,443,023,360 bytes free
Post-Run: 24,430,854,144 bytes free
213 --- E O F --- 2009-02-25 11:37:16
