الجهاز بطى شديد

anascoo · 22 سبتمبر 2008

الحاسوب بطى شديد

نزلت

avg

هذا هو التقرير
AVG 8.0 Anti-Virus command line scanner
Copyright (c) 1992 - 2008 AVG Technologies
Program version 8.0.145, engine 8.0.0
Virus Database: Version 270.6.6/1631 2008-08-24

C:\Documents and Settings\Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\1000000b00002h\verclsid.exe Trojan horse Generic11.LON was moved to Virus Vault.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Administrator\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\Administrator\ntuser.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\NetworkService\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Locked file. Not tested.
C:\pagefile.sys Locked file. Not tested.
C:\RECYCLER\S-1-5-21-606747145-1214440339-1177238915-500\Dc37\New Folder\1575158116051583 1586160416051577\Portable Microsoft Office 2007 Enterprise\Portable Microsoft Office 2007 Enterprise\MSACCESS.EXE Trojan horse Generic11.LON was moved to Virus Vault.
C:\System Volume Information\ Locked file. Not tested.
C:\WINDOWS\system32\config\default Locked file. Not tested.
C:\WINDOWS\system32\config\default.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SAM Locked file. Not tested.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\software Locked file. Not tested.
C:\WINDOWS\system32\config\software.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\system Locked file. Not tested.
C:\WINDOWS\system32\config\system.LOG Locked file. Not tested.
D:\10329b2daf7b5520a6\update\ Locked file. Not tested.
D:\15fa8da3fc53237c3fdb2ae332ca\update\ Locked file. Not tested.
D:\1768bccda0ca831df709268f91a84aef\update\ Locked file. Not tested.
D:\3e46aab33b2ffbb32d8b06f0d30dd3\update\ Locked file. Not tested.
D:\67accba09a82c8b1cb4184ae3fb14943\update\ Locked file. Not tested.
D:\6f7e53bd4eb523ef3a3ab9bfb7513a8c\update\ Locked file. Not tested.
D:\autorun.inf\ Locked file. Not tested.
D:\b7fdb3e3c901f79de1d216c856ff4fe8\update\ Locked file. Not tested.
D:\d48076b40d79671ef8438754af\update\ Locked file. Not tested.
D:\f14c79d10d544667a2fe\update\ Locked file. Not tested.
D:\fc262338c01587bd4e9603bbe3\update\ Locked file. Not tested.
D:\RECYCLER\S-1-5-21-861567501-796845957-725345543-500\XHH\update\ Locked file. Not tested.
D:\System Volume Information\ Locked file. Not tested.
E:\autorun.inf\ Locked file. Not tested.
E:\System Volume Information\ Locked file. Not tested.

------------------------------------------------------------
s scanned : 347565
Found infections : 2
Found PUPs : 0
Healed infections : 2
Healed PUPs : 0
Warnings : 0
------------------------------------------------------------

AbOdy · 22 سبتمبر 2008

اعمل التالي وانا اخوك

==============

(1)
عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
(2)
واعمل تقرير للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم

بالأنتظار للتقريرين الأول والثاني

؟؟

anascoo · 22 سبتمبر 2008

هذا تقريرComboFix.exe

ComboFix 08-09-20.05 - Administrator 09/22/2008 13:34:58.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.251 [GMT 3:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-22 to 2008-09-22 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 10:39 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Free Download Manager
2008-09-22 09:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg8
2008-09-21 18:38 --------- d-----w C:\Program Files\AVG
2008-09-21 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Norton
2008-09-21 18:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-09-21 13:40 286,720 ----a-w C:\WINDOWS\iun506.exe
2008-09-21 13:40 --------- d-----w C:\Program Files\MEDIA_PRO_dic
2008-09-20 19:07 --------- d-----w C:\Program Files\Hotspot Shield
2008-09-20 19:06 --------- d-----w C:\Program Files\Hotspot_Shield
2008-09-20 19:06 --------- d-----w C:\Program Files\Conduit
2008-09-20 13:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2008-09-20 13:29 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-20 13:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-20 13:26 --------- d-----w C:\Program Files\Real
2008-09-20 13:26 --------- d-----w C:\Program Files\Common Files\Real
2008-09-18 07:50 --------- d-----w C:\Program Files\Windows Live
2008-09-17 13:16 549,159 --sha-r C:\Program Files\Norton2009Reset.exe
2008-09-15 11:50 --------- d-----w C:\Program Files\MyLanViewer
2008-09-15 08:05 --------- d-----w C:\Program Files\PC Washer
2008-09-15 07:51 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Thinstall
2008-09-15 07:26 --------- d-----w C:\Program Files\AnalogX
2008-09-14 17:34 --------- d-----w C:\Program Files\Thoosje Vista Sidebar
2008-09-14 14:43 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Toolbars
2008-09-14 14:43 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Desktopicon
2008-09-14 08:50 --------- d-----w C:\Program Files\Free Download Manager
2008-09-14 08:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
2008-09-13 07:03 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-13 07:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-13 07:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-09 15:45 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ZTEEVDO
2008-09-09 11:21 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-08 18:50 --------- d-----w C:\Program Files\Opera
2008-09-08 15:27 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-08 15:25 --------- d-----w C:\Program Files\UltraISO
2008-09-08 15:25 --------- d-----w C:\Program Files\Common Files\EZB Systems
2008-09-08 12:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-09-08 12:01 --------- d-----w C:\Program Files\mDSL
2008-09-08 11:38 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "C:\Program Files\Hotspot_Shield\tbHots.dll" [06/24/2008 11:17 PM 1569304]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper s\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
06/24/2008 11:17 PM 1569304 --a------ C:\Program Files\Hotspot_Shield\tbHots.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "C:\Program Files\Hotspot_Shield\tbHots.dll" [06/24/2008 11:17 PM 1569304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "C:\Program Files\Hotspot_Shield\tbHots.dll" [06/24/2008 11:17 PM 1569304]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [01/26/2008 06:57 AM 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [11/07/2007 03:34 PM 3739672]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [12/16/2007 08:39 PM 2449455]
"Free Upload Manager"="C:\Program Files\Free Download Manager\fum\fum.exe" [07/29/2007 07:13 PM 253952]
"Free Uploader Oe Integration"="C:\Program Files\Free Download Manager\FUM\fumoei.exe" [06/10/2007 06:02 PM 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [10/05/2006 08:56 PM 280779]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [01/13/2007 04:47 AM 131072]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [01/13/2007 04:47 AM 163840]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [01/13/2007 04:46 AM 135168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [01/26/2008 06:57 AM 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-13 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"vidc.yv12"= yv12vfw.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"msacm.imc"= imc32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [05/23/2007 10:15 PM 547744]
R3 ev19x8mp;Creative SB AudioPCI Audio Driver (WDM);C:\WINDOWS\system32\drivers\ev19x8mp.sys [11/24/2000 09:10 PM 522268]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [01/24/2008 12:25 AM 27136]
R3 zteusbser;ZTE USB Device for Legacy Serial Communication;C:\WINDOWS\system32\DRIVERS\ZTEUsbser.sys [02/06/2007 10:21 AM 97920]
S2 .norton2009Reset;Norton2009 Reset;C:\Program Files\Norton2009Reset.exe [09/17/2008 04:16 PM 549159]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4e5891e-87e2-11dd-b0e1-001e584b8aaa}]
\Shell\AutoRun\command - tpfbusg.cmd
\Shell\explore\Command - tpfbusg.cmd
\Shell\open\Command - tpfbusg.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca3181cc-7d9d-11dd-b085-001e584b8aaa}]
\Shell\AutoRun\command - b.com
\Shell\explore\Command - b.com
\Shell\open\Command - b.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3aa26d7-7fda-11dd-b094-001e584b8aaa}]
\Shell\AutoRun\command - G:\tpfbusg.cmd
\Shell\explore\Command - G:\tpfbusg.cmd
\Shell\open\Command - G:\tpfbusg.cmd
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0sfpb3gr.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nprpjplug.dll
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,