بحول الله الحلول موجوده ...
طيب لاهنت اعمل الآتي بالترتيـب ::
(1)
عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب
قم بتشغيلها واتبع الشرح :
ستظهر لك هذه الشاشة السوداء ماعليك سوى الإنتظار :
تخبرك الرسالة القادمة بأنه سيتم إعادة التشغيل تلقائيا :
بعد إعادة التشغيل وعند بدء الدخول ستظهر لك هذه النافذه ماعليـك سوى الإنتظار
هذه هو التقرير قد خرج انسخه والصقه في ردك القادم
(2)
حمل أداة الهايجاك
بعد ان تشغل البرنامج اعمل الاتي :
ستظهر لك هذه النافذه .. اتبع الشرح :
ثم ستظهر لك هذه النافذه ::
انسخ التقرير كاملا وارفقه في ردك القادم لتحليله
بنتظار التقريرين
تفضل اخى الكريم
يارب يكون كل شئ تمام وتم القضاء على الفايروس اللعين
التقرير الاول
ComboFix 08-08-14.05 - m 08/15/2008 18:48:37.2 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.98 [GMT 2:00]
Running from: C:\Documents and Settings\m\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\com\lsass.exe
C:\WINDOWS\system32\com\netcfg.000
C:\WINDOWS\system32\com\netcfg.dll
C:\WINDOWS\system32\com\smss.exe
C:\WINDOWS\system32\dnsq.dll
.
((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 07:04 --------- d-----w C:\Program Files\LeapFTP
2008-08-14 23:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-08-14 23:47 --------- d-----w C:\Documents and Settings\m\Application Data\IDM
2008-08-14 23:46 --------- d-----w C:\Program Files\Internet Download Manager
2008-08-14 23:46 --------- d-----w C:\Documents and Settings\m\Application Data\DMCache
2008-08-14 22:54 --------- d-----w C:\Documents and Settings\m\Application Data\CyberScrub
2008-08-14 22:53 --------- d-----w C:\Documents and Settings\m\Application Data\cleaner
2008-08-14 21:00 --------- d-----w C:\Program Files\AdVantage
2008-08-14 20:23 155,995 ----a-w C:\WINDOWS\java\Packages\2RNFFZRH.ZIP
2008-08-14 19:52 --------- d-----w C:\Program Files\MSN Messenger
2008-08-14 18:38 --------- d-----w C:\Program Files\Webteh
2008-08-14 18:38 --------- d-----w C:\Documents and Settings\m\Application Data\BSplayer Pro
2008-08-14 18:38 --------- d-----w C:\Documents and Settings\m\Application Data\BSplayer
2008-08-14 17:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-14 16:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
.
((((((((((((((((((((((((((((( snapshot@Thu 08-14-2008_22.57.35.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-02-25 03:34:30 14,560 ------w C:\WINDOWS\$hf_mig$\KB898461\spmsg.dll
+ 2005-02-25 03:34:30 209,120 ------w C:\WINDOWS\$hf_mig$\KB898461\spuninst.exe
+ 2005-02-25 03:34:30 22,752 ------w C:\WINDOWS\$hf_mig$\KB898461\spupdsvc.exe
+ 2005-02-25 03:34:30 22,240 ------w C:\WINDOWS\$hf_mig$\KB898461\update\spcustom.dll
+ 2005-02-25 03:34:30 714,976 ------w C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
+ 2005-02-25 03:34:30 369,888 ------w C:\WINDOWS\$hf_mig$\KB898461\update\updspapi.dll
+ 2005-02-25 03:34:30 209,120 ------w C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe
+ 2005-02-25 03:34:30 369,888 ------w C:\WINDOWS\$NtUninstallKB898461$\spuninst\updspapi.dll
- 2008-08-14 16:06:00 8,738 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
+ 2008-08-14 22:02:06 8,972 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
- 2008-08-14 16:05:50 86,327 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
+ 2008-08-15 12:06:22 86,327 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
- 2008-08-14 16:06:00 2,112 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-08-15 12:06:22 2,426 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-08-14 23:49:12 34,308 ----a-w C:\WINDOWS\system32\BASSMOD.dll
- 2004-08-03 20:55:32 66,560 ----a-w C:\WINDOWS\system32\cdm.dll
+ 2007-07-30 17:19:20 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
- 2004-08-03 20:55:32 66,560 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2007-07-30 17:19:20 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
- 2004-08-03 22:56:00 430,080 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2007-07-30 17:19:36 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
- 2004-08-03 22:56:36 110,592 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2007-07-30 17:19:16 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2004-08-03 22:56:02 1,134,592 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2007-07-30 17:19:42 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2004-08-03 22:56:02 112,128 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2007-07-30 17:19:32 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
- 2004-08-03 22:56:02 36,864 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2007-07-30 17:18:40 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
- 2004-08-03 22:56:02 120,320 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2007-07-30 17:19:28 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2007-07-30 17:18:40 33,624 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll
+ 2005-02-25 03:34:30 14,560 ------w C:\WINDOWS\system32\spmsg.dll
+ 2005-02-25 03:34:30 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
- 2004-08-03 22:56:00 430,080 ----a-w C:\WINDOWS\system32\wuapi.dll
+ 2007-07-30 17:19:36 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
- 2004-08-03 22:56:36 110,592 ----a-w C:\WINDOWS\system32\wuauclt.exe
+ 2007-07-30 17:19:16 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
- 2004-08-03 22:56:02 1,134,592 ----a-w C:\WINDOWS\system32\wuaueng.dll
+ 2007-07-30 17:19:42 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
- 2004-08-03 22:56:02 112,128 ----a-w C:\WINDOWS\system32\wucltui.dll
+ 2007-07-30 17:19:32 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
- 2004-08-03 22:56:02 36,864 ----a-w C:\WINDOWS\system32\wups.dll
+ 2007-07-30 17:18:40 33,624 ----a-w C:\WINDOWS\system32\wups.dll
+ 2007-07-30 17:19:12 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
- 2004-08-03 22:56:02 120,320 ----a-w C:\WINDOWS\system32\wuweb.dll
+ 2007-07-30 17:19:28 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
+ 2002-08-16 13:15:52 65,536 ----a-w C:\WINDOWS\unleap.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5735792]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/29/2008 04:18 PM 2672048]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run_CF]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 10:56 PM 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [08/04/2004 01:09 AM 1729024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [08/04/2004 12:56 AM 158208]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/03/2004 10:56 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/03/2004 10:56 PM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 07/29/2008 04:18 PM 2672048 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\ctfmon.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Internet Download Manager\\IEMonitor.exe"=
"F:\\Zyzoom_HijackThis.exe"=
"C:\\WINDOWS\\system32\\CF17105.exe"=
"C:\\Program Files\\Internet Download Manager\\IDMan.exe"=
R3 aic32p;aic32p;C:\WINDOWS\system32\drivers\mhieln.sys []
R3 trid3d;trid3d;C:\WINDOWS\system32\DRIVERS\trid3dm.sys [08/17/2001 12:51 PM]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run_CF-amva - C:\WINDOWS\system32\amvo.exe
HKCU-Run_CF-kamsoft - C:\WINDOWS\system32\ckvo.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\m\Application Data\Mozilla\Firefox\Profiles\zxupuf27.default\
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-15 18:55:16
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 08/15/2008 18:58:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-15 16:58:32
ComboFix2.txt 2008-08-14 21:01:58
Pre-Run: 2,179,416,064 bytes free
Post-Run: 2,256,728,064 bytes free
158 --- E O F --- 2008-08-15 12:57:45
التقرير الثانى
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:59:17 م, on 15/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
F:\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{66AC29E4-5D93-4477-AFCB-A3B96663E7E9}: NameServer = 10.0.0.138
--
End of file - 2640 bytes
بانتظاركــــــــ
k:
