بس اخي انا الكاسبر اللي كان بجهازي صارت في مشاكل خيالية وكل التحديثات طارت منه
ونزلته عالفاضي
بينما النود كان زي الحلاوة بس مشكلة ملف EKRN.EXE الخاص فيه هو المشكلة
وهاي التقرير اللي طلبتوا اخواني
ComboFix 08-09-25.06 - AHMED 09/26/2008 16:16:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1722 [GMT 2:00]
Running from: C:\Documents and Settings\AHMED\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\WINDOWS\system32\ckvo1.dll
D:\Autorun.inf
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-08-26 to 2008-09-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-26 13:52 --------- d-----w C:\Documents and Settings\AHMED\Application Data\DMCache
2008-09-26 13:39 --------- d-----w C:\Program Files\Trend Micro
2008-09-26 13:33 --------- d-----w C:\Documents and Settings\AHMED\Application Data\Xfire
2008-09-26 12:35 137,480 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-09-26 12:34 183,120 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-09-26 12:27 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-26 12:27 --------- d-----w C:\Program Files\MSN Messenger
2008-09-26 12:17 --------- d-----w C:\Documents and Settings\AHMED\Application Data\COWON
2008-09-26 12:14 --------- d-----w C:\Documents and Settings\AHMED\Application Data\IDM
2008-09-26 12:07 --------- d-----w C:\Program Files\Windows Live
2008-09-26 12:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-26 11:57 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-26 11:57 --------- d-----w C:\Program Files\Circle Developement
2008-09-26 09:14 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-09-26 09:03 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-09-26 09:01 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-26 08:46 --------- d-----w C:\Program Files\Internet Download Manager
2008-09-26 08:25 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-09-26 08:22 --------- d-----w C:\Program Files\Xfire
2008-09-26 08:22 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Xfire
2008-09-26 08:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-26 08:09 22,328 ----a-w C:\Documents and Settings\AHMED\Application Data\PnkBstrK.sys
2008-09-26 07:49 --------- d-----w C:\Documents and Settings\AHMED\Application Data\ESET
2008-09-26 07:47 --------- d-----w C:\Program Files\ESET
2008-09-26 07:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-09-26 06:35 --------- d-----w C:\Documents and Settings\AHMED\Application Data\CyberScrub
2008-09-26 06:35 --------- d-----w C:\Documents and Settings\AHMED\Application Data\cleaner
2008-09-26 06:31 --------- d-----w C:\Program Files\AGEIA Technologies
2008-09-26 06:26 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-26 06:22 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-26 06:22 --------- d-----w C:\Program Files\JetAudio
2008-09-26 06:22 --------- d-----w C:\Program Files\Common Files\COWON
2008-09-26 06:22 --------- d-----w C:\Documents and Settings\AHMED\Application Data\InstallShield
2008-09-26 06:21 --------- d-----w C:\Program Files\DivX
2008-09-26 06:20 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-09-26 06:20 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-09-26 06:20 --------- d-----w C:\Program Files\Real
2008-09-26 06:20 --------- d-----w C:\Program Files\Common Files\xing shared
2008-09-26 06:20 --------- d-----w C:\Program Files\Common Files\Real
2008-09-26 06:13 --------- d-----w C:\Program Files\Realtek
2008-09-26 05:59 --------- d-----w C:\Program Files\Conexant
2008-09-26 05:58 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-26 05:53 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-18 00:40 42,320 ----a-w C:\WINDOWS\system32\xfcodec.dll
2008-09-16 00:14 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-09-16 00:14 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-09-16 00:12 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-09-16 00:12 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-09-16 00:12 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-09-16 00:12 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-09-16 00:12 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-09-16 00:12 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-09-16 00:12 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-09-16 00:12 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-09-16 00:12 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-09-16 00:12 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-09-16 00:11 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-09-16 00:11 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-09-16 00:11 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-09-16 00:11 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-09-16 00:11 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-09-16 00:11 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-09-16 00:11 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-09-04 07:31 288,024 ----a-w C:\WINDOWS\system32\PhysXCplUI.exe
2008-08-29 06:57 70,936 ----a-w C:\WINDOWS\system32\PhysXLoader.dll
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM 8523776]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"VIDC.XFR1"= xfcodec.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 06/12/2008 02:38 AM 34672 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 12:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]
--------- 09/25/2008 03:00 PM 90112 C:\Program Files\Conexant\Adsl\dslagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLSTATEXE]
--------- 09/25/2008 03:00 PM 376832 C:\Program Files\Conexant\Adsl\DslStat.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 09/26/2008 08:18 AM 2577840 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 12/05/2007 01:41 AM 8523776 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 12/05/2007 01:41 AM 81920 C:\WINDOWS\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 09/26/2008 08:20 AM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 12/05/2007 01:41 AM 1626112 C:\WINDOWS\system32\nwiz.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"F:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
R3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS [08/31/2007 06:02 PM 41728]
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-egui - C:\Program Files\ESET\ESET Smart Security\egui.exe
MSConfigStartUp-Vistadrv - C:\Program Files\VIPhd\vsdrv.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\AHMED\Application Data\Mozilla\Firefox\Profiles\ynykaej5.default\
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-26 16:16:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 09/26/2008 16:17:23
ComboFix-quarantined-files.txt 2008-09-26 14:17:22
Pre-Run: 13,610,954,752 bytes free
Post-Run: 13,604,036,608 bytes free
160
