الله يوفقك اخوي الجهاز تحسن كثير بعد تحميل الأداه بس صوت الجهاز صار مرة مزعج
عموما الله لايحرمك الأجر هذا هو التقرير
ComboFix 08-08-03.05 - Administrator 08/04/2008 20:03:13.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.119 [GMT 3:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#Shareds\UP5ZYJZ8\iforex.com
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#Shareds\UP5ZYJZ8\iforex.com\Emerp\Events\flash_.swf\user_data.sol
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008.lnk
C:\Documents and Settings\Administrator\Application Data\Power-Antivirus-2009
C:\Documents and Settings\Administrator\Application Data\Power-Antivirus-2009\base.dat
C:\Documents and Settings\Administrator\Application Data\Power-Antivirus-2009\base2.dat
C:\Documents and Settings\Administrator\Application Data\Power-Antivirus-2009\Desc.dat
C:\Documents and Settings\Administrator\Application Data\Power-Antivirus-2009\spline.dat
C:\Documents and Settings\Administrator\Desktop\Error Cleaner.url
C:\Documents and Settings\Administrator\Desktop\Privacy Protector.url
C:\Documents and Settings\Administrator\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Administrator\Favorites\Error Cleaner.url
C:\Documents and Settings\Administrator\Favorites\Privacy Protector.url
C:\Documents and Settings\Administrator\Favorites\Spyware&Malware Protection.url
C:\Documents and Settings\Administrator\Start Menu\Programs\Antivirus 2008
C:\Documents and Settings\Administrator\Start Menu\Programs\Antivirus 2008\Antivirus-2008.lnk
C:\Program Files\AntiMalwareGuard
C:\Program Files\AntiMalwareGuard\BL.dat
C:\Program Files\AntiMalwareGuard\WL.dat
C:\Program Files\Antivirus 2008
C:\Program Files\Antivirus 2008\Antivirus-2008.exe
C:\Program Files\Antivirus 2008\vscan.tsi
C:\Program Files\Antivirus 2008\zlib.dll
C:\Program Files\PCHealthCenter
C:\Program Files\PCHealthCenter\
0.exe
C:\Program Files\PCHealthCenter\
0.gif
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\1.gif
C:\Program Files\PCHealthCenter\2.exe
C:\Program Files\PCHealthCenter\2.gif
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\PCHealthCenter\3.gif
C:\Program Files\PCHealthCenter\4.exe
C:\Program Files\PCHealthCenter\5.exe
C:\Program Files\PCHealthCenter\7.exe
C:\Program Files\PCHealthCenter\sex1.ico
C:\Program Files\PCHealthCenter\sex2.ico
C:\Program Files\Power-Antivirus-2009
C:\Program Files\Power-Antivirus-2009\Buy.url
C:\Program Files\Power-Antivirus-2009\Help.url
C:\Program Files\Power-Antivirus-2009\HowToBuy.txt
C:\Program Files\Power-Antivirus-2009\ID.dat
C:\Program Files\Power-Antivirus-2009\License.txt
C:\Program Files\VAV
C:\Program Files\VAV\vav.cpl
C:\Program Files\VAV\vav.exe
C:\Program Files\VAV\vav0.dat
C:\Program Files\VAV\vav1.dat
C:\WINDOWS\Downloaded Program Files\setup.dll
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\elfv.exe
C:\WINDOWS\eqvwamkl.dll
C:\WINDOWS\fdkowvbp.dll
C:\WINDOWS\grswptdl.exe
C:\WINDOWS\nfavxwdbvdf.dll
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
C:\WINDOWS\system32\efcYOifE.dll
C:\WINDOWS\system32\hgGxYOeD.dll
C:\WINDOWS\system32\hpeyjaxh.ini
C:\WINDOWS\system32\iiffFyWO.dll
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\njmxdsqk.ini
C:\WINDOWS\system32\OWyFffii.ini
C:\WINDOWS\system32\OWyFffii.ini2
C:\WINDOWS\system32\qoMDusSL.dll
C:\WINDOWS\system32\sex1.ico
C:\WINDOWS\system32\sex2.ico
C:\WINDOWS\system32\vav.cpl
C:\WINDOWS\system32\vtUmkKee.dll
C:\WINDOWS\system32\vwtwpldb.ini
C:\WINDOWS\wnslvxtf.dll
.
((((((((((((((((((((((((( Files Created from 2008-07-04 to 2008-08-04 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-04 17:04 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DMCache
2008-08-02 22:04 --------- d-----w C:\Program Files\AskPBar
2008-08-02 21:56 --------- d-----w C:\Program Files\URUSoft
2008-08-02 21:54 --------- d-----w C:\Program Files\Athan
2008-08-02 21:21 --------- d-----w C:\Program Files\SuperCleaner
2008-08-02 21:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-31 20:57 --------- d-----w C:\Program Files\Panda Security
2008-07-31 09:15 --------- d-----w C:\Program Files\Gabest
2008-07-31 08:42 --------- d-----w C:\Program Files\DivX
2008-07-25 01:41 --------- d-----w C:\Program Files\MpcStar
2008-07-24 21:18 --------- d-----w C:\Documents and Settings\Administrator\Application Data\TigerPlayer
2008-07-22 08:46 --------- d-----w C:\Program Files\Video Convert Master
2008-07-22 08:46 --------- d-----w C:\Program Files\Real_SC
2008-07-22 08:46 --------- d-----w C:\Program Files\Quranzu1
2008-07-22 08:46 --------- d-----w C:\Program Files\Paltalk Messenger
2008-07-22 08:46 --------- d-----w C:\Program Files\Mobily Connect Card
2008-07-22 08:46 --------- d-----w C:\Program Files\أحكام التجويد
2008-07-20 09:01 --------- d-----w C:\Program Files\BitComet
2008-07-18 10:36 81,920 ----a-w C:\Documents and Settings\Administrator\Application Data\ezpinst.exe
2008-07-18 10:36 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-07-18 10:36 47,360 ----a-w C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2008-07-18 10:36 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Vso
2008-07-18 10:07 --------- d-----w C:\Program Files\Witcobber
2008-07-12 20:04 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2008-07-12 20:02 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-07-10 21:34 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nero
2008-07-10 21:33 --------- d-----w C:\Program Files\Common Files\Nero
2008-07-10 21:30 --------- d-----w C:\Program Files\Nero
2008-07-10 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-07-10 17:08 --------- d-----w C:\Program Files\SlySoft
2008-07-08 20:35 --------- d-----w C:\Program Files\GRETECH
2008-07-08 19:23 --------- d-----w C:\Documents and Settings\Administrator\Application Data\BSplayer
2008-07-06 19:46 --------- d-----w C:\Documents and Settings\Administrator\Application Data\BitSpirit
2008-07-06 13:56 --------- d-----w C:\Program Files\Google
2008-07-03 07:34 --------- d-----w C:\Program Files\Ricochet Lost Worlds
2008-06-29 08:05 --------- d-----w C:\Program Files\BT Engine
2008-06-24 08:54 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-21 09:49 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-21 09:49 --------- d-----w C:\Program Files\Turtle Bay
2008-06-21 09:49 --------- d-----w C:\Program Files\Mahjong Medley
2008-06-21 09:49 --------- d-----w C:\Program Files\Mah Jong Quest
2008-06-21 09:49 --------- d-----w C:\Program Files\Magic Ball 2
2008-06-21 09:49 --------- d-----w C:\Program Files\exeqrn
2008-06-21 09:49 --------- d-----w C:\Program Files\Diner Dash
2008-06-21 09:49 --------- d-----w C:\Program Files\DDD Pool
2008-06-21 09:49 --------- d-----w C:\Program Files\Altiris
2008-06-21 09:49 --------- d-----w C:\Program Files\AirXonix
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 16:08 --------- d-----w C:\Program Files\Internet Download Manager
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 10:56 AM 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [09/27/2007 09:12 PM 893184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07/10/2008 11:06 AM 68856]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [12/13/2007 07:10 PM 1688872]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [08/20/2004 07:55 PM 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [08/20/2004 07:51 PM 118784]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [07/30/2003 07:08 PM 143360]
"Set"="C:\Program Files\Compaq\Set\Set.exe" [11/20/2003 10:01 PM 525824]
"NeroCheck"="C:\WINDOWS\system32\\NeroCheck.exe" [07/09/2001 01:50 PM 155648]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [03/03/2007 12:58 PM 950664]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/24/2008 08:21 AM 185896]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [03/01/2007 02:57 PM 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [12/03/2007 02:21 PM 2213160]
"109ca07b"="C:\WINDOWS\system32\kqsdxmjn.dll" [08/04/2008 07:56 PM 99200]
"AGRSMMSG"="AGRSMMSG.exe" [06/29/2004 01:06 PM 88363 C:\WINDOWS\AGRSMMSG.exe]
"MAKTray"="MAKTray.exe" [08/28/2004 03:07 AM 287232 C:\WINDOWS\MAKTray.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 10:56 AM 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 02:01:00 734872]
PalTalk.lnk - C:\Program Files\Paltalk Messenger\paltalk.exe [2008-05-09 01:17:29 10452992]
«©م، ¢¬نïé Adobe Reader.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 03:48:00 40048]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Mobily Connect Card\\Mobily Connect Card.exe"=
"C:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"C:\\Program Files\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"16106:TCP"= 16106:TCP:BitComet 16106 TCP
"16106:UDP"= 16106:UDP:BitComet 16106 UDP
"19671:TCP"= 19671:TCP:BitComet 19671 TCP
"19671:UDP"= 19671:UDP:BitComet 19671 UDP
"46874:TCP"= 46874:TCP:BitComet 46874 TCP
"46874:UDP"= 46874:UDP:BitComet 46874 UDP
"20825:TCP"= 20825:TCP:BitComet 20825 TCP
"20825:UDP"= 20825:UDP:BitComet 20825 UDP
"11057:TCP"= 11057:TCP:BitComet 11057 TCP
"11057:UDP"= 11057:UDP:BitComet 11057 UDP
"11323:TCP"= 11323:TCP:BitComet 11323 TCP
"11323:UDP"= 11323:UDP:BitComet 11323 UDP
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d53d0778-7e49-11dc-8430-0018f8351a13}]
\Shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d53d077c-7e49-11dc-8430-0018f8351a13}]
\Shell\AutoRun\command - E:\AutoRun.exe
.
- - - - ORPHANS REMOVED - - - -
Toolbar-{54EF0797-AF80-4CF5-AB0C-7E87CCEC3E0B} - C:\WINDOWS\fdkowvbp.dll
HKCU-Run-OpenTalk - C:\Program Files\OpenTalk\OpenTalk.exe
HKCU-Run-AdVantage - C:\Program Files\AdVantage\AdVantage.exe
HKCU-Run-\Win8E.exe - C:\Windows\system32\Win8E.exe
HKCU-Run-\Win8F.exe - C:\Windows\system32\Win8F.exe
HKCU-Run-\Win90.exe - C:\Windows\system32\Win90.exe
HKCU-Run-\Win92.exe - C:\Windows\system32\Win92.exe
HKCU-Run-\Win93.exe - C:\Windows\system32\Win93.exe
HKCU-Run-Antispyware-2008.exe - C:\Program Files\Antispyware 2008\Antispyware-2008.exe
HKLM-Run-\Win8E.exe - C:\Windows\system32\Win8E.exe
HKLM-Run-\Win8F.exe - C:\Windows\system32\Win8F.exe
HKLM-Run-\Win90.exe - C:\Windows\system32\Win90.exe
HKLM-Run-\Win92.exe - C:\Windows\system32\Win92.exe
HKLM-Run-\Win93.exe - C:\Windows\system32\Win93.exe
HKLM-Run-Antivirus - C:\Program Files\VAV\vav.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n0vebh8x.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-04 20:12:21
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\njmxdsqk.ini 1382137 bytes
scan completed successfully
hidden files: 1
**************************************************************************
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"
"
"
"
"
"
"
"
"
"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\kqsdxmjn.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\ESET\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\MAKHkey.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 08/04/2008 20:15:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-04 17:15:46
Pre-Run: 55,487,238,144 bytes free
Post-Run: 55,409,065,984 bytes free
268 --- E O F --- 2008-07-10 10:27:50
