Al jNtEeL
أبوغـازي
boob77
الله يعطيكم العافية ويبيض وجيهكم ماقصرتو وان شاء الله ان المشكلة انحلت
وهذا التقرير
ComboFix 08-06-12.2 - Administrator 06/15/2008 0:12:40.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.268 [GMT 3:00]
Running from: C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\~.exe.53546.exe
C:\WINDOWS\system32\3721B965.DLL
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pthreadVC.dll
C:\WINDOWS\system32\Ultra.dll
C:\WINDOWS\system32\wpcap.dll
D:\Autorun.inf
D:\pagefile.pif
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 10:14 155,995 ----a-w C:\WINDOWS\java\Packages\O9FTVVRB.ZIP
2008-06-02 14:11 --------- d-----w C:\Program Files\NoAdware5.0
2008-06-02 13:43 --------- d-----w C:\Program Files\Alwil Software
2008-06-02 13:36 18,829 ----a-w C:\WINDOWS\system32\drivers\alg.exe
2008-06-02 13:36 154,112 --sh--w C:\WINDOWS\system32\AntiTool.exe
2008-06-02 13:16 --------- d-----w C:\Program Files\Yahoo!
2008-06-02 13:16 --------- d-----w C:\Program Files\CCleaner
2008-05-30 20:30 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IEPro
2008-05-30 18:14 --------- d-----w C:\Program Files\WIDCOMM
2008-05-27 19:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\SITEguard
2008-05-27 19:24 --------- d-----w C:\Program Files\Common Files\iS3
2008-05-27 19:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-05-27 19:09 --------- d-----w C:\Documents and Settings\Administrator\Application Data\STOPzilla!
2008-05-27 18:09 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ESET
2008-05-26 21:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-25 17:16 --------- d-----w C:\Program Files\Mass Downloader
2008-05-25 17:00 --------- d-----w C:\Program Files\Internet Download Manager
2008-05-25 17:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IDM
2008-05-25 17:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DMCache
2008-05-20 21:36 --------- d-----w C:\Program Files\PCBugDoctor
2008-05-20 20:07 --------- d-----w C:\Documents and Settings\Administrator\Application Data\COWON
2008-05-19 19:58 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-19 19:57 --------- d-----w C:\Program Files\Windows Live
2008-05-19 19:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-14 11:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-05-14 10:30 --------- d-----w C:\Program Files\ESET
2008-05-14 10:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-05-14 10:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\GRETECH
2008-05-14 10:21 --------- d-----w C:\Program Files\GRETECH
2008-05-14 10:21 --------- d-----w C:\Documents and Settings\Administrator\Application Data\GRETECH
2008-05-14 09:44 --------- d-----w C:\Program Files\Synaptics
2008-05-14 09:43 --------- d-----w C:\Program Files\CONEXANT
2008-05-13 14:01 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:14 1,285,632 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:14 1,285,632 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 19:16 3,591,680 ----a-w C:\WINDOWS\system32\SET21.tmp
2008-04-23 19:16 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-22 07:38 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:38 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-04-14 15:51 271,616 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-04-14 15:51 271,616 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-03-25 04:49 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:49 158,496 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:04 1,845,120 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [05/27/2008 09:15 PM 2594224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iPMS.exe]
Debugger=dummy.dat
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\iPMS20.exe]
Debugger=dummy.dat
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
S2 CB369265;CB369265;C:\WINDOWS\system32\27609310.EXE []
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-06-15 00:14:48
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\INTERNET DOWNLOAD MANAGER\IEMONITOR.EXE
.
**************************************************************************
.
Completion time: 06/15/2008 0:15:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-14 21:15:38
Pre-Run: 25,588,842,496 bytes free
Post-Run: 25,643,827,200 bytes free
136 --- E O F --- 2008-06-14 20:47:42
