أخي الفاضل LINEZERO جزاك الله خيرا .. أنا عاجز عن شكرك ..
استخدمت الآدة combofix وبعدها تم فتح البارتشن بطيقة عادية .. فعلى ما يبدو أن المشكلة تم حلها ، ولكني لم أتبع الخطوة الثانية الخاصة بآدة استعادة افتراضيات الريجستري .. فهل هي ضرورية الآن ؟
وهذا هو التقرير :
ComboFix 08-09-28.01 - Nael Ziedan 09/29/2008 20:12:50.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.242 [GMT 2:00]
Running from: C:\Documents and Settings\Nael Ziedan\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Nael Ziedan\s\nael
ziedan@cmt.us.playstation[1].txt
C:\temp.temp
C:\WINDOWS\system32\dao350.dll
E:\Autorun.inf
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-29 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-29 17:03 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-09-29 17:03 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-09-29 17:03 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-09-29 17:03 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-09-22 15:26 --------- d-----w C:\Program Files\Infosoft
2008-09-18 18:23 --------- d-----w C:\Program Files\Common Files\EasyInfo
2008-08-10 04:59 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-07-30 12:18 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-07-17 15:15 45,056 ----a-w C:\WINDOWS\NCUNINST.EXE
2008-03-09 16:15 75,920 ----a-w C:\Documents and Settings\Nael Ziedan\Application Data\GDIPFONTCACHEV1.DAT
.
------- Sigcheck -------
10/10/2006 12:00 PM 671744 c98acbd1ab8323b66dfa96f4763c67e2 C:\WINDOWS\system32\wininet.dll
10/10/2006 12:00 PM 359936 780fe678dde99b809e8336fb74d587a1 C:\WINDOWS\system32\drivers\tcpip.sys
10/10/2006 12:00 PM 1182720 320d5b5f235810a265339c483ab76b15 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [10/10/2006 12:00 PM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRTCLK"="C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe" [12/30/2003 05:44 PM 24576]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [07/12/2004 04:50 PM 4112384]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [07/12/2004 04:50 PM 81920]
"SoundMan"="SOUNDMAN.EXE" [11/15/2004 06:20 PM 77824 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [07/12/2004 04:50 PM 843776 C:\WINDOWS\system32\nwiz.exe]
"PCTVOICE"="pctspk.exe" [12/16/2004 03:34 AM 180224 C:\WINDOWS\system32\pctspk.exe]
"PV92TRAY"="PV92Tray.exe" [12/16/2004 03:34 AM 323584 C:\WINDOWS\system32\PV92Tray.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [10/10/2006 12:00 PM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [10/10/2006 02:00 PM 44544]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-02 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.3iv2"= C:\PROGRA~1\K-LITE~1\codecs\3IVXVF~1.DLL
"VIDC.VP60"= C:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP61"= C:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP62"= C:\PROGRA~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP70"= C:\PROGRA~1\K-LITE~1\codecs\vp7vfw.dll
"VIDC.VP31"= C:\PROGRA~1\K-LITE~1\codecs\vp31vfw.dll
"VIDC.FFDS"= C:\PROGRA~1\K-LITE~1\ffdshow\ff_vfw.dll
"msacm.ac3acm"= C:\PROGRA~1\K-LITE~1\codecs\ac3acm.acm
"msacm.l3fhg"= C:\PROGRA~1\K-LITE~1\codecs\l3codecp.acm
"vidc.DIV3"= DIVXc32.dll
"vidc.DIV4"= DIVXc32f.dll
"msacm.divxa32"= DivXa32.acm
"msacm.l3codec"= l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Downloads\\3006-cs2d\\CounterStrike2D.exe"=
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e392ffab-7e03-11db-bb5a-806d6172696f}]
\shell\explore\command - GQ.PIF
\shell\open\Command - GQ.PIF
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e392ffac-7e03-11db-bb5a-806d6172696f}]
\shell\explore\command - GQ.PIF
\shell\open\Command - GQ.PIF
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e392ffad-7e03-11db-bb5a-806d6172696f}]
\shell\explore\command - GQ.PIF
\shell\open\Command - GQ.PIF
*Newly Created Service* - PROCEXP90
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Settings,ProxyServer = 80.241.46.170:8080
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 -: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 -: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-29 20:18:49
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 09/29/2008 20:20:17
ComboFix-quarantined-files.txt 2008-09-29 18:20:06
Pre-Run: 4,383,064,064 bytes free
Post-Run: 4,828,110,848 bytes free
123
k: