salmasalma
زيزوومي جديد
- إنضم
- 27 مايو 2008
- المشاركات
- 59
- مستوى التفاعل
- 0
- النقاط
- 50
غير متصل
السلام عليكم
واجهتني مشكلة عويصة في الحاسوب
فقمت باستخدام
combofix
وحصلت على التقرير التالي
رجاءالمساعدة
فالكمبيوتر يعيد التشغبل حيث تظهر رسالة زرقاء تقول
***Stop 0x000000D1 (0x45eb5b4b, 0x00000002, 0x00000001, 0xf858e6b9) inspect.sys- address F858E6B9 base at F8587000, Datestamp 45bc9145. (0.21 seconds)
رجاء اخبروني ماذا افعل فانا امية في الحاسوب ولا اعرف كيفية التعاطي مع هذه المشاكل
اعمل فقط على الوورد لأني استاذة جامهية ادرس علم الاجتماع ولا معرفة لي بالتكنولوجيا
جزاكم خيرا
د.سلمى
ComboFix 08-09-22.06 - PC 2008-09-24 13:01:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.963.1033.18.669 [GMT 2:00]
Running from: C:\Documents and Settings\PC\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\blphc1dwj0e3f3.scr
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\lphc1dwj0e3f3.exe
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\tdssservers.dat
.
((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 )))))))))))))))))))))))))))))))
.
2008-09-24 11:21 . 2008-09-24 11:22 <DIR> d-------- C:\Documents and Settings\PC\Application Data\RegistrySmart
2008-09-24 00:31 . 2008-09-24 00:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-09-24 00:21 . 2008-09-24 00:26 <DIR> d-------- C:\Program Files\Intelinet
2008-09-23 22:30 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-09-23 22:29 . 2001-08-17 22:36 386,560 --a--c--- C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-09-23 22:28 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-09-23 22:27 . 2008-04-13 20:31 2,023,936 --a--c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-09-23 22:26 . 2001-08-17 13:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-09-23 22:25 . 2001-08-17 14:56 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-09-23 22:24 . 2001-08-17 12:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-09-23 22:23 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-09-23 22:22 . 2001-08-17 13:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-09-23 22:21 . 2008-04-13 21:24 2,145,280 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-09-23 22:21 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-09-23 03:00 . 2008-08-26 15:44 2,577 --a------ C:\WINDOWS\system32\config.bak
2008-09-23 03:00 . 2004-08-04 13:00 1,688 --a------ C:\WINDOWS\system32\autoexec.bak
2008-09-23 02:35 . 2008-09-23 02:35 <DIR> d-------- C:\Documents and Settings\PC\Application Data\Avira
2008-09-20 09:54 . 2008-09-20 09:54 268 --ah----- C:\sqmdata11.sqm
2008-09-20 09:54 . 2008-09-20 09:54 244 --ah----- C:\sqmnoopt11.sqm
2008-09-20 01:03 . 2008-09-20 01:03 268 --ah----- C:\sqmdata10.sqm
2008-09-20 01:03 . 2008-09-20 01:03 244 --ah----- C:\sqmnoopt10.sqm
2008-09-19 08:23 . 2008-09-19 08:23 268 --ah----- C:\sqmdata09.sqm
2008-09-19 08:23 . 2008-09-19 08:23 244 --ah----- C:\sqmnoopt09.sqm
2008-09-19 00:50 . 2008-09-19 00:50 268 --ah----- C:\sqmdata08.sqm
2008-09-19 00:50 . 2008-09-19 00:50 244 --ah----- C:\sqmnoopt08.sqm
2008-09-17 20:58 . 2008-09-17 20:58 244 --ah----- C:\sqmnoopt07.sqm
2008-09-17 20:58 . 2008-09-17 20:58 232 --ah----- C:\sqmdata07.sqm
2008-09-16 23:23 . 2008-09-23 01:26 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-13 18:44 . 2008-09-13 18:44 <DIR> d-------- C:\Program Files\PDFCreator Toolbar
2008-09-13 18:44 . 2008-09-13 18:45 <DIR> d-------- C:\Program Files\PDFCreator
2008-09-13 18:44 . 2008-09-13 18:44 253,116 --a------ C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_8468.exe
2008-09-13 18:44 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
2008-09-13 18:44 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
2008-09-13 18:44 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
2008-09-13 18:44 . 2008-09-13 18:44 14,290 --a------ C:\Program Files\settings.dat
2008-09-07 08:48 . 2008-09-19 08:25 1,555 --a------ C:\WINDOWS\ata live update.ini
2008-09-06 11:28 . 2008-09-13 19:46 <DIR> d-------- C:\Program Files\Google
2008-09-06 11:28 . 2008-09-23 19:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-09-03 19:58 . 2008-09-03 19:58 <DIR> d--h----- C:\WINDOWS\PIF
2008-09-03 18:41 . 2008-09-23 23:40 <DIR> d-------- C:\Program Files\Security Task Manager
2008-09-03 18:41 . 2008-09-23 23:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-09-03 17:08 . 2008-09-03 17:08 <DIR> d-------- C:\Program Files\Avira
2008-09-03 14:47 . 2008-09-03 14:47 <DIR> d-------- C:\Program Files\Ace Utilities
2008-09-03 14:19 . 2005-10-31 20:50 49,152 --a------ C:\WINDOWS\wipe.dll
2008-09-03 14:15 . 2005-10-31 20:50 49,152 --a------ C:\Program Files\wipe.dll
2008-09-03 14:03 . 2008-09-03 14:03 <DIR> d-------- C:\Documents and Settings\PC\Application Data\Uniblue
2008-09-03 13:57 . 2008-09-04 10:54 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-03 13:00 . 2008-09-03 13:00 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-03 13:00 . 2008-09-03 13:00 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-03 13:00 . 2008-09-03 13:00 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-03 12:57 . 2008-09-03 13:01 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-03 12:53 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-03 12:42 . 2008-04-14 02:12 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-03 12:41 . 2008-04-14 02:11 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2008-09-03 12:13 . 2008-06-23 18:01 6,068,736 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-03 12:13 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-03 12:13 . 2007-03-08 07:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-03 12:13 . 2008-06-23 18:01 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-03 12:13 . 2008-06-23 18:01 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-03 12:13 . 2008-06-23 18:01 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-03 12:13 . 2008-06-23 18:01 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-03 12:13 . 2008-06-23 18:01 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-03 12:13 . 2008-06-23 10:23 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-03 11:53 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-02 08:35 . 2008-09-02 08:35 <DIR> d-------- C:\Program Files\FirstClass
2008-09-02 08:35 . 2008-09-02 08:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FirstClass
2008-09-02 08:35 . 2001-05-03 10:36 4,710 --a------ C:\WINDOWS\system32\fc.ico
2008-09-02 08:35 . 1996-02-26 22:15 2,528 --a------ C:\WINDOWS\FCIC.INI
2008-08-28 06:04 . 2008-08-28 06:05 <DIR> d-------- C:\Program Files\Mawarith
2008-08-28 05:55 . 2008-08-28 05:55 268 --ah----- C:\sqmdata06.sqm
2008-08-28 05:55 . 2008-08-28 05:55 244 --ah----- C:\sqmnoopt06.sqm
2008-08-27 17:40 . 2008-08-28 08:11 13,030 --a------ C:\PDOXUSRS.NET
2008-08-27 17:39 . 2008-08-27 17:39 <DIR> d-------- C:\Program Files\Common Files\Borland Shared
2008-08-27 17:38 . 2008-08-27 17:39 <DIR> d-------- C:\Program Files\Lower Notpad
2008-08-27 17:38 . 2008-08-27 17:38 <DIR> d-------- C:\Documents and Settings\PC\Application Data\COWON
2008-08-27 17:37 . 2008-08-27 17:37 <DIR> d-------- C:\Program Files\AlShamel
2008-08-27 17:36 . 2001-08-17 12:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-08-27 17:36 . 2001-08-17 12:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-08-27 17:36 . 2008-04-13 20:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-08-27 17:36 . 2008-04-13 20:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-08-27 14:57 . 2008-08-27 14:57 268 --ah----- C:\sqmdata05.sqm
2008-08-27 14:57 . 2008-08-27 14:57 244 --ah----- C:\sqmnoopt05.sqm
2008-08-27 14:54 . 2008-08-27 14:54 268 --ah----- C:\sqmdata04.sqm
2008-08-27 14:54 . 2008-08-27 14:54 244 --ah----- C:\sqmnoopt04.sqm
2008-08-27 14:48 . 2008-08-27 14:48 268 --ah----- C:\sqmdata03.sqm
2008-08-27 14:48 . 2008-08-27 14:48 244 --ah----- C:\sqmnoopt03.sqm
2008-08-27 14:44 . 2008-09-24 12:45 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-27 14:37 . 2008-09-03 10:36 <DIR> d-------- C:\Program Files\AvaFind
2008-08-27 14:37 . 2008-09-23 19:04 <DIR> d-------- C:\Documents and Settings\PC\Application Data\AvaFind Data
2008-08-27 10:38 . 2008-08-27 10:38 268 --ah----- C:\sqmdata02.sqm
2008-08-27 10:38 . 2008-08-27 10:38 244 --ah----- C:\sqmnoopt02.sqm
2008-08-26 20:03 . 2008-08-26 20:03 <DIR> d-------- C:\Documents and Settings\PC\Application Data\Nero
2008-08-26 20:03 . 2008-08-26 20:03 268 --ah----- C:\sqmdata01.sqm
2008-08-26 20:03 . 2008-08-26 20:03 244 --ah----- C:\sqmnoopt01.sqm
2008-08-26 20:02 . 2008-08-26 20:02 <DIR> d-------- C:\Program Files\Nero
2008-08-26 20:02 . 2008-08-26 20:02 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-08-26 20:02 . 2008-08-26 20:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-26 20:02 . 2006-03-17 10:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2008-08-26 20:02 . 2006-03-17 10:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2008-08-26 20:02 . 2006-03-17 10:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2008-08-26 20:02 . 2006-03-17 13:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-08-26 20:02 . 2006-03-17 10:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2008-08-26 19:59 . 2008-08-26 19:59 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-08-26 19:42 . 2008-08-26 19:42 268 --ah----- C:\sqmdata00.sqm
2008-08-26 19:42 . 2008-08-26 19:42 244 --ah----- C:\sqmnoopt00.sqm
2008-08-26 19:25 . 2008-09-03 17:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-08-26 19:06 . 2008-08-26 19:06 <DIR> d-------- C:\Program Files\Yahoo!
2008-08-26 19:06 . 2008-08-26 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-26 16:13 . 2007-06-19 15:26 126,976 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-26 16:10 . 2008-08-26 16:10 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-26 16:10 . 2007-03-01 11:47 2,732,032 --a------ C:\WINDOWS\system32\Netw2r32.dll
2008-08-26 16:10 . 2007-03-01 11:47 2,209,408 --a------ C:\WINDOWS\system32\drivers\w29n51.sys
2008-08-26 16:10 . 2007-03-01 11:47 557,056 --a------ C:\WINDOWS\system32\Netw2c32.dll
2008-08-26 16:07 . 2007-02-14 13:20 530,861 --a------ C:\WINDOWS\system32\drivers\btaudio.sys
2008-08-26 16:07 . 2007-02-14 13:20 149,123 --a------ C:\WINDOWS\system32\drivers\btwdndis.sys
2008-08-26 16:07 . 2007-02-14 13:21 67,960 --a------ C:\WINDOWS\system32\drivers\btwusb.sys
2008-08-26 16:07 . 2007-02-14 13:20 47,907 --a------ C:\WINDOWS\system32\drivers\btwhid.sys
2008-08-26 16:07 . 2007-02-14 13:20 30,459 --a------ C:\WINDOWS\system32\drivers\btport.sys
2008-08-26 16:07 . 2007-02-14 13:21 30,285 --a------ C:\WINDOWS\system32\drivers\btwmodem.sys
2008-08-26 16:04 . 2008-08-26 16:04 <DIR> d-------- C:\Program Files\WIDCOMM
2008-08-26 16:04 . 2007-02-14 13:20 868,298 --a------ C:\WINDOWS\system32\drivers\btkrnl.sys
2008-08-26 16:04 . 2007-02-14 13:20 106,557 --a------ C:\WINDOWS\system32\btw_ci.dll
2008-08-26 16:02 . 2008-08-26 16:02 <DIR> d-------- C:\WINDOWS\Options
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-23 00:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-03 16:26 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-09-03 11:59 --------- d-----w C:\Program Files\Microsoft Works
2008-09-02 05:37 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-28 04:03 286,720 ------w C:\WINDOWS\Setup1.exe
2008-08-26 16:59 --------- d-----w C:\Program Files\Windows Live
2008-08-26 16:51 73,216 ------w C:\WINDOWS\ST6UNST.EXE
2008-08-26 16:51 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-08-26 16:50 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-08-26 16:50 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-08-26 16:50 --------- d-----w C:\Program Files\Real
2008-08-26 16:50 --------- d-----w C:\Program Files\Common Files\xing shared
2008-08-26 16:50 --------- d-----w C:\Program Files\Common Files\Real
2008-08-26 16:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-26 16:48 --------- d-----w C:\Program Files\CyberLink
2008-08-26 16:43 --------- d-----w C:\Documents and Settings\PC\Application Data\ACD Systems
2008-08-26 16:42 --------- d-----w C:\Program Files\JetAudio
2008-08-26 16:42 --------- d-----w C:\Program Files\Common Files\COWON
2008-08-26 16:42 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-08-26 16:42 --------- d-----w C:\Program Files\ACD Systems
2008-08-26 16:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-08-26 16:26 --------- d-----w C:\Program Files\Common Files\L&H
2008-08-26 16:25 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-26 16:25 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-08-26 14:03 --------- d-----w C:\Program Files\Broadcom
2008-08-26 14:01 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-08-26 14:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-26 13:59 --------- d-----w C:\Program Files\Analog Devices
2008-08-26 13:44 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-26 13:39 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ------w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AvaFind"="C:\Program Files\AvaFind\AvaFind.exe" [2004-06-01 295936]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-09-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-03-14 54832]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-09-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
backup=C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
C:\WINDOWS\system32\bcmntray [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intelinet
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistrySmart
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2009
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-09-03 18:26 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-06 11:09 133104 C:\Documents and Settings\PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-01 23:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2007-06-19 15:26 84760 C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2007-06-19 15:26 125720 C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2007-06-19 15:26 101144 C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-08-16 15:19 5728112 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
--a------ 2004-09-23 11:41 860160 C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-08-26 18:50 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-10-27 06:51 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2005-11-16 13:12 88209 C:\WINDOWS\AGRSMMSG.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"SVCHOST.EXE"=C:\WINDOWS\system32\drivers\svchost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"lphc1dwj0e3f3"=C:\WINDOWS\system32\lphc1dwj0e3f3.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2007-09-19 20:37 41456]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-11 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-06-12 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-05-09 41217]
S3 IntelinetSecure;IntelinetSecure;C:\Program Files\Intelinet\intelin2.exe [2008-09-17 856064]
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.yahoo.com/
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-24 13:03:40
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv]
"imagepath"="\systemroot\system32\drivers\TDSSserv.sys"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-09-24 13:04:42
ComboFix-quarantined-files.txt 2008-09-24 11:04:36
Pre-Run: 21,143,277,568 bytes free
Post-Run: 21,148,590,080 bytes free
300 --- E O F --- 2008-09-23 22:55:51
واجهتني مشكلة عويصة في الحاسوب
فقمت باستخدام
combofix
وحصلت على التقرير التالي
رجاءالمساعدة
فالكمبيوتر يعيد التشغبل حيث تظهر رسالة زرقاء تقول
***Stop 0x000000D1 (0x45eb5b4b, 0x00000002, 0x00000001, 0xf858e6b9) inspect.sys- address F858E6B9 base at F8587000, Datestamp 45bc9145. (0.21 seconds)
رجاء اخبروني ماذا افعل فانا امية في الحاسوب ولا اعرف كيفية التعاطي مع هذه المشاكل
اعمل فقط على الوورد لأني استاذة جامهية ادرس علم الاجتماع ولا معرفة لي بالتكنولوجيا
جزاكم خيرا
د.سلمى
ComboFix 08-09-22.06 - PC 2008-09-24 13:01:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.963.1033.18.669 [GMT 2:00]
Running from: C:\Documents and Settings\PC\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\blphc1dwj0e3f3.scr
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\lphc1dwj0e3f3.exe
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\tdssservers.dat
.
((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 )))))))))))))))))))))))))))))))
.
2008-09-24 11:21 . 2008-09-24 11:22 <DIR> d-------- C:\Documents and Settings\PC\Application Data\RegistrySmart
2008-09-24 00:31 . 2008-09-24 00:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-09-24 00:21 . 2008-09-24 00:26 <DIR> d-------- C:\Program Files\Intelinet
2008-09-23 22:30 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-09-23 22:29 . 2001-08-17 22:36 386,560 --a--c--- C:\WINDOWS\system32\dllcache\sgiul50.dll
2008-09-23 22:28 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-09-23 22:27 . 2008-04-13 20:31 2,023,936 --a--c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-09-23 22:26 . 2001-08-17 13:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-09-23 22:25 . 2001-08-17 14:56 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-09-23 22:24 . 2001-08-17 12:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-09-23 22:23 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-09-23 22:22 . 2001-08-17 13:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-09-23 22:21 . 2008-04-13 21:24 2,145,280 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-09-23 22:21 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-09-23 03:00 . 2008-08-26 15:44 2,577 --a------ C:\WINDOWS\system32\config.bak
2008-09-23 03:00 . 2004-08-04 13:00 1,688 --a------ C:\WINDOWS\system32\autoexec.bak
2008-09-23 02:35 . 2008-09-23 02:35 <DIR> d-------- C:\Documents and Settings\PC\Application Data\Avira
2008-09-20 09:54 . 2008-09-20 09:54 268 --ah----- C:\sqmdata11.sqm
2008-09-20 09:54 . 2008-09-20 09:54 244 --ah----- C:\sqmnoopt11.sqm
2008-09-20 01:03 . 2008-09-20 01:03 268 --ah----- C:\sqmdata10.sqm
2008-09-20 01:03 . 2008-09-20 01:03 244 --ah----- C:\sqmnoopt10.sqm
2008-09-19 08:23 . 2008-09-19 08:23 268 --ah----- C:\sqmdata09.sqm
2008-09-19 08:23 . 2008-09-19 08:23 244 --ah----- C:\sqmnoopt09.sqm
2008-09-19 00:50 . 2008-09-19 00:50 268 --ah----- C:\sqmdata08.sqm
2008-09-19 00:50 . 2008-09-19 00:50 244 --ah----- C:\sqmnoopt08.sqm
2008-09-17 20:58 . 2008-09-17 20:58 244 --ah----- C:\sqmnoopt07.sqm
2008-09-17 20:58 . 2008-09-17 20:58 232 --ah----- C:\sqmdata07.sqm
2008-09-16 23:23 . 2008-09-23 01:26 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-13 18:44 . 2008-09-13 18:44 <DIR> d-------- C:\Program Files\PDFCreator Toolbar
2008-09-13 18:44 . 2008-09-13 18:45 <DIR> d-------- C:\Program Files\PDFCreator
2008-09-13 18:44 . 2008-09-13 18:44 253,116 --a------ C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_8468.exe
2008-09-13 18:44 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
2008-09-13 18:44 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
2008-09-13 18:44 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
2008-09-13 18:44 . 2008-09-13 18:44 14,290 --a------ C:\Program Files\settings.dat
2008-09-07 08:48 . 2008-09-19 08:25 1,555 --a------ C:\WINDOWS\ata live update.ini
2008-09-06 11:28 . 2008-09-13 19:46 <DIR> d-------- C:\Program Files\Google
2008-09-06 11:28 . 2008-09-23 19:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-09-03 19:58 . 2008-09-03 19:58 <DIR> d--h----- C:\WINDOWS\PIF
2008-09-03 18:41 . 2008-09-23 23:40 <DIR> d-------- C:\Program Files\Security Task Manager
2008-09-03 18:41 . 2008-09-23 23:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-09-03 17:08 . 2008-09-03 17:08 <DIR> d-------- C:\Program Files\Avira
2008-09-03 14:47 . 2008-09-03 14:47 <DIR> d-------- C:\Program Files\Ace Utilities
2008-09-03 14:19 . 2005-10-31 20:50 49,152 --a------ C:\WINDOWS\wipe.dll
2008-09-03 14:15 . 2005-10-31 20:50 49,152 --a------ C:\Program Files\wipe.dll
2008-09-03 14:03 . 2008-09-03 14:03 <DIR> d-------- C:\Documents and Settings\PC\Application Data\Uniblue
2008-09-03 13:57 . 2008-09-04 10:54 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-03 13:00 . 2008-09-03 13:00 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-03 13:00 . 2008-09-03 13:00 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-03 13:00 . 2008-09-03 13:00 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-03 12:57 . 2008-09-03 13:01 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-03 12:53 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-03 12:42 . 2008-04-14 02:12 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-09-03 12:41 . 2008-04-14 02:11 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2008-09-03 12:13 . 2008-06-23 18:01 6,068,736 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-03 12:13 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-03 12:13 . 2007-03-08 07:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-03 12:13 . 2008-06-23 18:01 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-03 12:13 . 2008-06-23 18:01 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-03 12:13 . 2008-06-23 18:01 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-03 12:13 . 2008-06-23 18:01 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-03 12:13 . 2008-06-23 18:01 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-03 12:13 . 2008-06-23 10:23 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-03 11:53 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-02 08:35 . 2008-09-02 08:35 <DIR> d-------- C:\Program Files\FirstClass
2008-09-02 08:35 . 2008-09-02 08:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FirstClass
2008-09-02 08:35 . 2001-05-03 10:36 4,710 --a------ C:\WINDOWS\system32\fc.ico
2008-09-02 08:35 . 1996-02-26 22:15 2,528 --a------ C:\WINDOWS\FCIC.INI
2008-08-28 06:04 . 2008-08-28 06:05 <DIR> d-------- C:\Program Files\Mawarith
2008-08-28 05:55 . 2008-08-28 05:55 268 --ah----- C:\sqmdata06.sqm
2008-08-28 05:55 . 2008-08-28 05:55 244 --ah----- C:\sqmnoopt06.sqm
2008-08-27 17:40 . 2008-08-28 08:11 13,030 --a------ C:\PDOXUSRS.NET
2008-08-27 17:39 . 2008-08-27 17:39 <DIR> d-------- C:\Program Files\Common Files\Borland Shared
2008-08-27 17:38 . 2008-08-27 17:39 <DIR> d-------- C:\Program Files\Lower Notpad
2008-08-27 17:38 . 2008-08-27 17:38 <DIR> d-------- C:\Documents and Settings\PC\Application Data\COWON
2008-08-27 17:37 . 2008-08-27 17:37 <DIR> d-------- C:\Program Files\AlShamel
2008-08-27 17:36 . 2001-08-17 12:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-08-27 17:36 . 2001-08-17 12:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-08-27 17:36 . 2008-04-13 20:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-08-27 17:36 . 2008-04-13 20:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-08-27 14:57 . 2008-08-27 14:57 268 --ah----- C:\sqmdata05.sqm
2008-08-27 14:57 . 2008-08-27 14:57 244 --ah----- C:\sqmnoopt05.sqm
2008-08-27 14:54 . 2008-08-27 14:54 268 --ah----- C:\sqmdata04.sqm
2008-08-27 14:54 . 2008-08-27 14:54 244 --ah----- C:\sqmnoopt04.sqm
2008-08-27 14:48 . 2008-08-27 14:48 268 --ah----- C:\sqmdata03.sqm
2008-08-27 14:48 . 2008-08-27 14:48 244 --ah----- C:\sqmnoopt03.sqm
2008-08-27 14:44 . 2008-09-24 12:45 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-27 14:37 . 2008-09-03 10:36 <DIR> d-------- C:\Program Files\AvaFind
2008-08-27 14:37 . 2008-09-23 19:04 <DIR> d-------- C:\Documents and Settings\PC\Application Data\AvaFind Data
2008-08-27 10:38 . 2008-08-27 10:38 268 --ah----- C:\sqmdata02.sqm
2008-08-27 10:38 . 2008-08-27 10:38 244 --ah----- C:\sqmnoopt02.sqm
2008-08-26 20:03 . 2008-08-26 20:03 <DIR> d-------- C:\Documents and Settings\PC\Application Data\Nero
2008-08-26 20:03 . 2008-08-26 20:03 268 --ah----- C:\sqmdata01.sqm
2008-08-26 20:03 . 2008-08-26 20:03 244 --ah----- C:\sqmnoopt01.sqm
2008-08-26 20:02 . 2008-08-26 20:02 <DIR> d-------- C:\Program Files\Nero
2008-08-26 20:02 . 2008-08-26 20:02 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-08-26 20:02 . 2008-08-26 20:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-26 20:02 . 2006-03-17 10:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2008-08-26 20:02 . 2006-03-17 10:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2008-08-26 20:02 . 2006-03-17 10:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2008-08-26 20:02 . 2006-03-17 13:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-08-26 20:02 . 2006-03-17 10:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2008-08-26 19:59 . 2008-08-26 19:59 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-08-26 19:42 . 2008-08-26 19:42 268 --ah----- C:\sqmdata00.sqm
2008-08-26 19:42 . 2008-08-26 19:42 244 --ah----- C:\sqmnoopt00.sqm
2008-08-26 19:25 . 2008-09-03 17:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-08-26 19:06 . 2008-08-26 19:06 <DIR> d-------- C:\Program Files\Yahoo!
2008-08-26 19:06 . 2008-08-26 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-08-26 16:13 . 2007-06-19 15:26 126,976 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-26 16:10 . 2008-08-26 16:10 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-08-26 16:10 . 2007-03-01 11:47 2,732,032 --a------ C:\WINDOWS\system32\Netw2r32.dll
2008-08-26 16:10 . 2007-03-01 11:47 2,209,408 --a------ C:\WINDOWS\system32\drivers\w29n51.sys
2008-08-26 16:10 . 2007-03-01 11:47 557,056 --a------ C:\WINDOWS\system32\Netw2c32.dll
2008-08-26 16:07 . 2007-02-14 13:20 530,861 --a------ C:\WINDOWS\system32\drivers\btaudio.sys
2008-08-26 16:07 . 2007-02-14 13:20 149,123 --a------ C:\WINDOWS\system32\drivers\btwdndis.sys
2008-08-26 16:07 . 2007-02-14 13:21 67,960 --a------ C:\WINDOWS\system32\drivers\btwusb.sys
2008-08-26 16:07 . 2007-02-14 13:20 47,907 --a------ C:\WINDOWS\system32\drivers\btwhid.sys
2008-08-26 16:07 . 2007-02-14 13:20 30,459 --a------ C:\WINDOWS\system32\drivers\btport.sys
2008-08-26 16:07 . 2007-02-14 13:21 30,285 --a------ C:\WINDOWS\system32\drivers\btwmodem.sys
2008-08-26 16:04 . 2008-08-26 16:04 <DIR> d-------- C:\Program Files\WIDCOMM
2008-08-26 16:04 . 2007-02-14 13:20 868,298 --a------ C:\WINDOWS\system32\drivers\btkrnl.sys
2008-08-26 16:04 . 2007-02-14 13:20 106,557 --a------ C:\WINDOWS\system32\btw_ci.dll
2008-08-26 16:02 . 2008-08-26 16:02 <DIR> d-------- C:\WINDOWS\Options
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-23 00:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-03 16:26 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-09-03 11:59 --------- d-----w C:\Program Files\Microsoft Works
2008-09-02 05:37 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-28 04:03 286,720 ------w C:\WINDOWS\Setup1.exe
2008-08-26 16:59 --------- d-----w C:\Program Files\Windows Live
2008-08-26 16:51 73,216 ------w C:\WINDOWS\ST6UNST.EXE
2008-08-26 16:51 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-08-26 16:50 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-08-26 16:50 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-08-26 16:50 --------- d-----w C:\Program Files\Real
2008-08-26 16:50 --------- d-----w C:\Program Files\Common Files\xing shared
2008-08-26 16:50 --------- d-----w C:\Program Files\Common Files\Real
2008-08-26 16:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-26 16:48 --------- d-----w C:\Program Files\CyberLink
2008-08-26 16:43 --------- d-----w C:\Documents and Settings\PC\Application Data\ACD Systems
2008-08-26 16:42 --------- d-----w C:\Program Files\JetAudio
2008-08-26 16:42 --------- d-----w C:\Program Files\Common Files\COWON
2008-08-26 16:42 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-08-26 16:42 --------- d-----w C:\Program Files\ACD Systems
2008-08-26 16:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-08-26 16:26 --------- d-----w C:\Program Files\Common Files\L&H
2008-08-26 16:25 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-26 16:25 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-08-26 14:03 --------- d-----w C:\Program Files\Broadcom
2008-08-26 14:01 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-08-26 14:01 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-26 13:59 --------- d-----w C:\Program Files\Analog Devices
2008-08-26 13:44 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-26 13:39 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ------w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AvaFind"="C:\Program Files\AvaFind\AvaFind.exe" [2004-06-01 295936]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-09-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-03-14 54832]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-09-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
backup=C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
C:\WINDOWS\system32\bcmntray [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Intelinet
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistrySmart
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2009
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-09-03 18:26 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-06 11:09 133104 C:\Documents and Settings\PC\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
--a------ 2007-01-01 23:22 3739648 C:\Program Files\Google\Google Talk\googletalk.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
--a------ 2007-06-19 15:26 84760 C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
--a------ 2007-06-19 15:26 125720 C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
--a------ 2007-06-19 15:26 101144 C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-08-16 15:19 5728112 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
--a------ 2004-09-23 11:41 860160 C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-08-26 18:50 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-10-27 06:51 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
--a------ 2005-11-16 13:12 88209 C:\WINDOWS\AGRSMMSG.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"SVCHOST.EXE"=C:\WINDOWS\system32\drivers\svchost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"lphc1dwj0e3f3"=C:\WINDOWS\system32\lphc1dwj0e3f3.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2007-09-19 20:37 41456]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-11 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-06-12 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-05-09 41217]
S3 IntelinetSecure;IntelinetSecure;C:\Program Files\Intelinet\intelin2.exe [2008-09-17 856064]
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.yahoo.com/
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2008-09-24 13:03:40
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv]
"imagepath"="\systemroot\system32\drivers\TDSSserv.sys"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2008-09-24 13:04:42
ComboFix-quarantined-files.txt 2008-09-24 11:04:36
Pre-Run: 21,143,277,568 bytes free
Post-Run: 21,148,590,080 bytes free
300 --- E O F --- 2008-09-23 22:55:51
k:
