صدى الحرمان
زيزوومي جديد
- إنضم
- 9 أغسطس 2008
- المشاركات
- 62
- مستوى التفاعل
- 0
- النقاط
- 80
غير متصل
أخواني الاعزاء
كما عودتنمي أني إلجا إلى الله في البداية ثم إليكم
جهاز صار مجنون جداااا
مش عارف أيش الي يحصل
مش عارف كيف أشرح
لكن هذا تقرير الكمبوبكوس
ComboFix 08-09-20.05 - أسرع نت 10/10/2008 15:38:51.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.129 [GMT 3:00]
Running from: E:\مكافحاتت\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2008-09-10 to 2008-10-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 12:22 7,288 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-10 12:22 589,856 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-10 12:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-09 23:13 8,587,296 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-09 23:13 72,360 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-09 22:33 --------- d-----w C:\Program Files\RamCleaner
2008-10-09 20:44 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-08 23:34 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\cleaner
2008-10-08 23:24 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\DMCache
2008-10-08 17:23 --------- d-----w C:\Program Files\Common Files\Real
2008-10-06 08:56 --------- d-----w C:\Program Files\DivX Subtitle Displayer
2008-10-05 16:23 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\uTorrent
2008-10-05 11:41 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\Ahead
2008-10-05 10:47 --------- d-----w C:\Program Files\Nero
2008-10-05 10:47 --------- d-----w C:\Program Files\Common Files\Ahead
2008-10-05 04:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-10-05 04:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-10-04 19:31 --------- d-----w C:\Documents and Settings\Default User\Application Data\DMCache
2008-10-04 02:29 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-10-04 01:34 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-10-04 01:34 --------- d-----w C:\Program Files\Kaspersky Lab
2008-10-03 18:19 --------- d-----w C:\Program Files\VersalSoft
2008-10-03 18:19 --------- d-----w C:\Program Files\Universal
2008-10-03 16:26 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-10-03 15:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-03 13:52 --------- d-----w C:\Program Files\Rising
2008-10-03 13:26 1,060,864 ----a-w C:\WINDOWS\system32\mfc71.dll
2008-10-02 23:53 --------- d-----w C:\Program Files\Doblon
2008-10-02 21:59 --------- d-----w C:\Program Files\WinPcap
2008-10-02 21:59 --------- d-----w C:\Program Files\stopcut
2008-10-02 19:05 --------- d-----w C:\Program Files\Total Video Converter
2008-10-02 15:09 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\CyberScrub
2008-10-02 07:33 --------- d-----w C:\Program Files\AviSynth 2.5
2008-10-02 07:32 --------- d-----w C:\Program Files\ALO SOFT
2008-10-01 18:15 --------- d-----w C:\Program Files\URUSoft
2008-09-30 17:29 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\vlc
2008-09-30 17:28 --------- d-----w C:\Program Files\VideoLAN
2008-09-26 02:36 --------- d-----w C:\Program Files\uTorrent
2008-09-26 00:22 --------- d-----w C:\Program Files\BitComet
2008-09-25 21:35 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\HP
2008-09-25 20:29 --------- d-----w C:\Documents and Settings\user80\Application Data\Ulead Systems
2008-09-25 20:27 --------- d-----w C:\Program Files\HP
2008-09-25 20:27 --------- d-----w C:\Program Files\Hewlett-Packard
2008-09-25 20:26 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-09-25 20:13 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\Ulead Systems
2008-09-25 19:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-25 19:19 --------- d-----w C:\Program Files\SmartSound Software
2008-09-25 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-09-25 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-09-25 19:18 --------- d-----w C:\Program Files\Windows Media Components
2008-09-25 19:18 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-25 19:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-09-25 19:17 --------- d-----w C:\Program Files\Ulead Systems
2008-09-25 19:17 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-09-25 18:41 --------- d-----w C:\Program Files\Allok RM RMVB to AVI MPEG DVD Converter
2008-09-25 13:57 --------- d-----w C:\Documents and Settings\user80\Application Data\Media Player Classic
2008-09-25 00:05 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\Media Player Classic
2008-09-24 20:28 --------- d-----w C:\Program Files\Ringz Studio
2008-09-24 20:26 --------- d-----w C:\Program Files\Yahoo!
2008-09-24 20:26 --------- d-----w C:\Program Files\MSN Messenger
2008-09-24 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-09-24 20:24 155,995 ----a-w C:\WINDOWS\java\Packages\P7B7TBXB.ZIP
2008-09-24 20:23 --------- d-----w C:\Program Files\Real
2008-09-24 20:21 --------- d-----w C:\Program Files\HowbaniSoft
2008-09-24 20:17 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-24 20:17 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-09-24 20:17 --------- d-----w C:\Program Files\Common Files\L&H
2008-09-24 20:16 --------- d-----w C:\Program Files\Microsoft Works
2008-09-24 19:45 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-29 17:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [06/07/2007 02:08 PM 4670968]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
"RamCleaner"="C:\Program Files\RamCleaner\ramcore.exe" [10/13/2007 07:26 PM 71680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/25/2005 07:11 PM 155648]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [02/07/2005 05:04 AM 94037]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
C:\Documents and Settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-25 113664]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.vp31"= vp31vfw.dll
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^أسرع نت.SERVER^قائمة ابدأ^البرامج^بدء التشغيل^StopCut home.lnk]
path=C:\Documents and Settings\أسرع نت.SERVER\قائمة ابدأ\البرامج\بدء التشغيل\StopCut home.lnk
backup=C:\WINDOWS\pss\StopCut home.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^أسرع نت.SERVER^قائمة ابدأ^البرامج^بدء التشغيل^StopCut.lnk]
path=C:\Documents and Settings\أسرع نت.SERVER\قائمة ابدأ\البرامج\بدء التشغيل\StopCut.lnk
backup=C:\WINDOWS\pss\StopCut.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^أسرع نت.SERVER^قائمة ابدأ^البرامج^بدء التشغيل^uTorrent.lnk]
path=C:\Documents and Settings\أسرع نت.SERVER\قائمة ابدأ\البرامج\بدء التشغيل\uTorrent.lnk
backup=C:\WINDOWS\pss\uTorrent.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 12:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 02/19/2006 02:41 AM 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
--a------ 02/07/2005 05:04 AM 94037 C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
--------- 03/07/2006 12:52 AM 36864 C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 06/07/2007 02:08 PM 4670968 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 05/04/2005 05:43 AM 69632 C:\WINDOWS\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 10/15/2005 04:51 AM 14864384 C:\WINDOWS\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\HowbaniSoft\\HowbaniSoft Internet Cafe System\\CafeSysSvr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24277:TCP"= 24277:TCP:BitComet 24277 TCP
"24277:UDP"= 24277:UDP:BitComet 24277 UDP
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM 32784]
R2 StopCutPortProtection;StopCut Port Protection Controller;C:\WINDOWS\system32\DRIVERS\Stop_NdisProt.sys [04/18/2007 07:16 PM 21120]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e745b0b-92a4-11dd-a2dd-0016767f1bc1}]
\Shell\AutoRun\command - H:\vva0hc0p.cmd
\Shell\explore\Command - H:\vva0hc0p.cmd
\Shell\open\Command - H:\vva0hc0p.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2feb804d-8d92-11dd-a2b2-0016767f1bc1}]
\shell\explore\Command - boot.exe
\shell\open\Command - boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{334b4c1e-8d9d-11dd-a2b4-0016767f1bc1}]
\Shell\AutoRun\command - DAT.exe
\Shell\explore\Command - DAT.exe
\Shell\open\Command - DAT.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{334b4c36-8d9d-11dd-a2b4-0016767f1bc1}]
\Shell\AutoRun\command - DAT.exe
\Shell\explore\Command - DAT.exe
\Shell\open\Command - DAT.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{904e3872-8fb9-11dd-a2bb-0016767f1bc1}]
\Shell\AutoRun\command - H:\vva0hc0p.cmd
\Shell\explore\Command - H:\vva0hc0p.cmd
\Shell\open\Command - H:\vva0hc0p.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b15d428-8de7-11dd-a2b5-0016767f1bc1}]
\shell\explore\Command - H:\boot.exe
\shell\open\Command - H:\boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9eea2c9-8bb4-11dd-a2ad-0016767f1bc1}]
\shell\explore\Command - I:\boot.exe
\shell\open\Command - I:\boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d38ed2e6-943e-11dd-a2e2-0016767f1bc1}]
\Shell\AutoRun\command - H:\ffojc.com
\Shell\explore\Command - H:\ffojc.com
\Shell\open\Command - H:\ffojc.com
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-SystemBackup - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
MSConfigStartUp-AVP - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
MSConfigStartUp-combofix - C:\WINDOWS\system32\CF15752.exe
MSConfigStartUp-IDMan - E:\الحديثة\pro\Internet Download Manager\IDMan.exe
MSConfigStartUp-nod32kui - C:\Program Files\Eset\nod32kui.exe
MSConfigStartUp-TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-10-10 15:39:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 10/10/2008 15:42:26
ComboFix-quarantined-files.txt 2008-10-10 12:42:22
Pre-Run: 3,289,993,216 bytes free
Post-Run: 3,399,639,040 bytes free
258
تسلم إلف سلامة
كما عودتنمي أني إلجا إلى الله في البداية ثم إليكم
جهاز صار مجنون جداااا
مش عارف أيش الي يحصل
مش عارف كيف أشرح
لكن هذا تقرير الكمبوبكوس
ComboFix 08-09-20.05 - أسرع نت 10/10/2008 15:38:51.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.129 [GMT 3:00]
Running from: E:\مكافحاتت\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2008-09-10 to 2008-10-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 12:22 7,288 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-10 12:22 589,856 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-10 12:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-09 23:13 8,587,296 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-09 23:13 72,360 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-09 22:33 --------- d-----w C:\Program Files\RamCleaner
2008-10-09 20:44 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-08 23:34 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\cleaner
2008-10-08 23:24 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\DMCache
2008-10-08 17:23 --------- d-----w C:\Program Files\Common Files\Real
2008-10-06 08:56 --------- d-----w C:\Program Files\DivX Subtitle Displayer
2008-10-05 16:23 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\uTorrent
2008-10-05 11:41 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\Ahead
2008-10-05 10:47 --------- d-----w C:\Program Files\Nero
2008-10-05 10:47 --------- d-----w C:\Program Files\Common Files\Ahead
2008-10-05 04:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-10-05 04:37 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-10-04 19:31 --------- d-----w C:\Documents and Settings\Default User\Application Data\DMCache
2008-10-04 02:29 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-10-04 01:34 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-10-04 01:34 --------- d-----w C:\Program Files\Kaspersky Lab
2008-10-03 18:19 --------- d-----w C:\Program Files\VersalSoft
2008-10-03 18:19 --------- d-----w C:\Program Files\Universal
2008-10-03 16:26 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-10-03 15:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-03 13:52 --------- d-----w C:\Program Files\Rising
2008-10-03 13:26 1,060,864 ----a-w C:\WINDOWS\system32\mfc71.dll
2008-10-02 23:53 --------- d-----w C:\Program Files\Doblon
2008-10-02 21:59 --------- d-----w C:\Program Files\WinPcap
2008-10-02 21:59 --------- d-----w C:\Program Files\stopcut
2008-10-02 19:05 --------- d-----w C:\Program Files\Total Video Converter
2008-10-02 15:09 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\CyberScrub
2008-10-02 07:33 --------- d-----w C:\Program Files\AviSynth 2.5
2008-10-02 07:32 --------- d-----w C:\Program Files\ALO SOFT
2008-10-01 18:15 --------- d-----w C:\Program Files\URUSoft
2008-09-30 17:29 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\vlc
2008-09-30 17:28 --------- d-----w C:\Program Files\VideoLAN
2008-09-26 02:36 --------- d-----w C:\Program Files\uTorrent
2008-09-26 00:22 --------- d-----w C:\Program Files\BitComet
2008-09-25 21:35 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\HP
2008-09-25 20:29 --------- d-----w C:\Documents and Settings\user80\Application Data\Ulead Systems
2008-09-25 20:27 --------- d-----w C:\Program Files\HP
2008-09-25 20:27 --------- d-----w C:\Program Files\Hewlett-Packard
2008-09-25 20:26 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-09-25 20:13 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\Ulead Systems
2008-09-25 19:19 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-25 19:19 --------- d-----w C:\Program Files\SmartSound Software
2008-09-25 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-09-25 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-09-25 19:18 --------- d-----w C:\Program Files\Windows Media Components
2008-09-25 19:18 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-25 19:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-09-25 19:17 --------- d-----w C:\Program Files\Ulead Systems
2008-09-25 19:17 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-09-25 18:41 --------- d-----w C:\Program Files\Allok RM RMVB to AVI MPEG DVD Converter
2008-09-25 13:57 --------- d-----w C:\Documents and Settings\user80\Application Data\Media Player Classic
2008-09-25 00:05 --------- d-----w C:\Documents and Settings\أسرع نت.SERVER\Application Data\Media Player Classic
2008-09-24 20:28 --------- d-----w C:\Program Files\Ringz Studio
2008-09-24 20:26 --------- d-----w C:\Program Files\Yahoo!
2008-09-24 20:26 --------- d-----w C:\Program Files\MSN Messenger
2008-09-24 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-09-24 20:24 155,995 ----a-w C:\WINDOWS\java\Packages\P7B7TBXB.ZIP
2008-09-24 20:23 --------- d-----w C:\Program Files\Real
2008-09-24 20:21 --------- d-----w C:\Program Files\HowbaniSoft
2008-09-24 20:17 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-24 20:17 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-09-24 20:17 --------- d-----w C:\Program Files\Common Files\L&H
2008-09-24 20:16 --------- d-----w C:\Program Files\Microsoft Works
2008-09-24 19:45 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-29 17:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [06/07/2007 02:08 PM 4670968]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
"RamCleaner"="C:\Program Files\RamCleaner\ramcore.exe" [10/13/2007 07:26 PM 71680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/25/2005 07:11 PM 155648]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [02/07/2005 05:04 AM 94037]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
C:\Documents and Settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-25 113664]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.vp31"= vp31vfw.dll
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^أسرع نت.SERVER^قائمة ابدأ^البرامج^بدء التشغيل^StopCut home.lnk]
path=C:\Documents and Settings\أسرع نت.SERVER\قائمة ابدأ\البرامج\بدء التشغيل\StopCut home.lnk
backup=C:\WINDOWS\pss\StopCut home.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^أسرع نت.SERVER^قائمة ابدأ^البرامج^بدء التشغيل^StopCut.lnk]
path=C:\Documents and Settings\أسرع نت.SERVER\قائمة ابدأ\البرامج\بدء التشغيل\StopCut.lnk
backup=C:\WINDOWS\pss\StopCut.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^أسرع نت.SERVER^قائمة ابدأ^البرامج^بدء التشغيل^uTorrent.lnk]
path=C:\Documents and Settings\أسرع نت.SERVER\قائمة ابدأ\البرامج\بدء التشغيل\uTorrent.lnk
backup=C:\WINDOWS\pss\uTorrent.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 12:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 02/19/2006 02:41 AM 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
--a------ 02/07/2005 05:04 AM 94037 C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload]
--------- 03/07/2006 12:52 AM 36864 C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 06/07/2007 02:08 PM 4670968 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 05/04/2005 05:43 AM 69632 C:\WINDOWS\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 10/15/2005 04:51 AM 14864384 C:\WINDOWS\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\HowbaniSoft\\HowbaniSoft Internet Cafe System\\CafeSysSvr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24277:TCP"= 24277:TCP:BitComet 24277 TCP
"24277:UDP"= 24277:UDP:BitComet 24277 UDP
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM 32784]
R2 StopCutPortProtection;StopCut Port Protection Controller;C:\WINDOWS\system32\DRIVERS\Stop_NdisProt.sys [04/18/2007 07:16 PM 21120]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e745b0b-92a4-11dd-a2dd-0016767f1bc1}]
\Shell\AutoRun\command - H:\vva0hc0p.cmd
\Shell\explore\Command - H:\vva0hc0p.cmd
\Shell\open\Command - H:\vva0hc0p.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2feb804d-8d92-11dd-a2b2-0016767f1bc1}]
\shell\explore\Command - boot.exe
\shell\open\Command - boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{334b4c1e-8d9d-11dd-a2b4-0016767f1bc1}]
\Shell\AutoRun\command - DAT.exe
\Shell\explore\Command - DAT.exe
\Shell\open\Command - DAT.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{334b4c36-8d9d-11dd-a2b4-0016767f1bc1}]
\Shell\AutoRun\command - DAT.exe
\Shell\explore\Command - DAT.exe
\Shell\open\Command - DAT.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{904e3872-8fb9-11dd-a2bb-0016767f1bc1}]
\Shell\AutoRun\command - H:\vva0hc0p.cmd
\Shell\explore\Command - H:\vva0hc0p.cmd
\Shell\open\Command - H:\vva0hc0p.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b15d428-8de7-11dd-a2b5-0016767f1bc1}]
\shell\explore\Command - H:\boot.exe
\shell\open\Command - H:\boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9eea2c9-8bb4-11dd-a2ad-0016767f1bc1}]
\shell\explore\Command - I:\boot.exe
\shell\open\Command - I:\boot.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d38ed2e6-943e-11dd-a2e2-0016767f1bc1}]
\Shell\AutoRun\command - H:\ffojc.com
\Shell\explore\Command - H:\ffojc.com
\Shell\open\Command - H:\ffojc.com
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-SystemBackup - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
HKLM-RunServices-raVe - (no file)
HKLM-RunServices-Driver32 - (no file)
MSConfigStartUp-AVP - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
MSConfigStartUp-combofix - C:\WINDOWS\system32\CF15752.exe
MSConfigStartUp-IDMan - E:\الحديثة\pro\Internet Download Manager\IDMan.exe
MSConfigStartUp-nod32kui - C:\Program Files\Eset\nod32kui.exe
MSConfigStartUp-TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
O8 -: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2008-10-10 15:39:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 10/10/2008 15:42:26
ComboFix-quarantined-files.txt 2008-10-10 12:42:22
Pre-Run: 3,289,993,216 bytes free
Post-Run: 3,399,639,040 bytes free
258
تسلم إلف سلامة
