عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
وهذا التقرير
ComboFix 08-10-19.04 - amer 10/21/2008 19:33:55.4 -
FAT32x86
Running from: C:\Documents and Settings\amer\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\abbfdda_z.dll
.
((((((((((((((((((((((((( Files Created from 2008-09-21 to 2008-10-21 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-21 16:39 8,224 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-21 16:39 4,184 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-21 16:39 129,056 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-21 16:39 1,108 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-20 16:39 --------- d-----w C:\Program Files\Real Alternative
2008-10-20 16:18 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-10-20 16:00 --------- d-----w C:\Program Files\Uninstall Tool
2008-10-19 20:05 --------- d-----w C:\Documents and Settings\amer\Application Data\Grisoft
2008-10-19 19:46 --------- d-----w C:\Program Files\Ace Utilities
2008-10-17 15:45 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-10-17 12:39 --------- d-----w C:\Program Files\CCleaner
2008-10-16 21:41 --------- d-----w C:\Documents and Settings\amer\Application Data\Ambient Design
2008-10-16 17:25 38,496 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-16 17:25 15,504 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-10-16 12:28 --------- d-----w C:\Program Files\Privacy Shield
2008-10-10 12:40 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-10-10 11:43 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-10-10 11:29 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-10-10 11:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-10 10:24 2,560 ----a-w C:\WINDOWS\system32\drivers\mchInjDrv.sys
2008-10-09 07:47 --------- d-----w C:\Program Files\JlgSolera
2008-10-07 04:53 --------- d-----w C:\Program Files\PerfectClock
2008-10-07 04:53 --------- d-----w C:\Documents and Settings\amer\Application Data\PerfectClock2007
2008-10-07 04:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\PerfectClock2007
2008-10-06 09:16 --------- d-----w C:\Program Files\a-squared Anti-Malware
2008-10-03 18:04 --------- d-----w C:\Program Files\Alwil Software
2008-10-03 04:07 --------- d-----w C:\Documents and Settings\amer\Application Data\LimeWire
2008-10-03 03:50 --------- d-----w C:\Program Files\Java
2008-10-03 03:47 --------- d-----w C:\Program Files\Common Files\Java
2008-10-03 01:13 --------- d-----w C:\Program Files\NOS
2008-10-03 01:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\NOS
2008-09-30 00:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Winferno
2008-09-29 16:49 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2008-09-26 00:24 --------- d-----w C:\Program Files\IEPro
2008-09-26 00:24 --------- d-----w C:\Documents and Settings\amer\Application Data\IEPro
2008-09-25 16:00 --------- d-----w C:\Program Files\UnHackMe
2008-09-24 04:14 --------- d-----w C:\Program Files\NCC Education
2008-09-22 22:03 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151}
2008-09-19 19:26 --------- d-----w C:\Program Files\Microsoft Private Folder 1.0
2008-09-19 14:17 --------- d-----w C:\Program Files\security
2008-09-15 16:25 --------- d-----w C:\Program Files\PC Optimizer Pro
2008-09-15 15:24 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-15 15:24 1,846,272 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-09-14 21:44 --------- d-----w C:\Program Files\Steganos Internet Trace Destructor 7
2008-09-14 21:29 --------- d-----w C:\Program Files\Advanced PC Tweaker
2008-09-14 17:10 --------- d-----w C:\Program Files\YouTube Downloader
2008-09-11 19:10 --------- d-----w C:\Documents and Settings\amer\Application Data\Malwarebytes
2008-09-11 19:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-08 10:41 333,824 ------w C:\WINDOWS\system32\dllcache\srv.sys
2008-09-06 14:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\CA
2008-09-06 13:51 --------- d-----w C:\Program Files\CA
2008-09-06 12:41 --------- d-----w C:\Documents and Settings\amer\Application Data\SUPERAntiSpyware.com
2008-09-05 20:30 266,792 ------w C:\WINDOWS\system32\dllcache\wgaLogon.dll
2008-09-05 20:29 942,632 ------w C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-09-05 17:22 --------- d-----w C:\Program Files\Hotspot Shield
2008-09-01 14:32 --------- d-----w C:\Program Files\MSBuild
2008-09-01 14:29 --------- d-----w C:\Program Files\Reference Assemblies
2008-08-30 12:14 --------- d-----w C:\Documents and Settings\amer\Application Data\CyberScrub
2008-08-30 12:13 --------- d-----w C:\Documents and Settings\amer\Application Data\cleaner
2008-08-30 08:41 --------- d-----w C:\Documents and Settings\amer\Application Data\PCToolsSpamMonitorPlus
2008-08-30 08:41 --------- d-----w C:\Documents and Settings\amer\Application Data\PCToolsFirewallPlus
2008-08-30 08:40 --------- d-----w C:\Program Files\Common Files\PC Tools
2008-08-29 21:37 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-08-29 17:30 --------- d-----w C:\Program Files\Sunbelt Software
2008-08-29 17:30 --------- d-----w C:\Documents and Settings\amer\Application Data\Sunbelt
2008-08-29 17:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sunbelt
2008-08-29 17:20 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{069BCE30-6EC3-40CD-8DBA-EFECA88F79CC}
2008-08-28 09:00 --------- d-----w C:\Program Files\Spyware Doctor
2008-08-28 09:00 --------- d-----w C:\Documents and Settings\amer\Application Data\PC Tools
2008-08-20 05:10 664,576 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-20 05:10 664,576 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2008-08-20 05:10 617,472 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2008-08-20 05:10 3,088,896 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-20 05:10 1,499,136 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2008-08-19 22:47 15,600 ----a-w C:\WINDOWS\gdrv.sys
2008-08-14 13:20 2,190,720 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 13:20 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:20 2,146,816 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 13:20 2,067,584 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 13:20 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 13:20 2,025,472 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-08-14 10:04 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-07-29 17:21 218,376 ----a-w C:\WINDOWS\system32\klogon.dll
2008-07-25 08:35 102,464 ----a-w C:\WINDOWS\HarfDeleteFont.exe
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2006-06-27 02:40 571,184 --sha-r C:\WINDOWS\system32\legitcheckcontrol.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AFProg"="C:\Program Files\AnchorFree\bin\ctrl\AFController.exe" [11/20/2006 11:19 AM 81920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\azzam.exe" [04/04/2008 03:22 PM 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"DisableLockWorkstation"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuPinnedList"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChange"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 10:16 PM 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AFProg]
--a------ 11/20/2006 11:19 AM 81920 C:\Program Files\AnchorFree\bin\ctrl\AFController.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 04/14/2008 06:59 PM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
-ra------ 05/11/2007 10:47 AM 790528 C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 04/14/2008 06:59 PM 1695232 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 04/11/2008 09:10 PM 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Paltalk Messenger\\PALTALK.EXE"=
"C:\\WINDOWS\\system32\\wjview.exe"=
"C:\\Program Files\\SnapStream Media\\Beyond TV\\BTVLibraryService.exe"=
"C:\\Program Files\\SnapStream Media\\Beyond TV\\BTVGuideDataLoader.exe"=
"C:\\Program Files\\SnapStream Media\\Beyond TV\\BTVSettingsService.exe"=
"C:\\Program Files\\SnapStream Media\\Beyond TV\\BTVTaskManagerService.exe"=
R0 WINSEC;WINSEC;C:\WINDOWS\system32\drivers\WINSEC.SYS []
R2 setup_7.0.0.180_21.04.2008_09-43;setup_7.0.0.180_21.04.2008_09-43;C:\WINDOWS\system32\DRIVERS\setup_7.0.0.180_21.04.2008_09-43.syS []
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [04/17/2007 06:58 AM]
R3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [08/29/2008 10:00 AM]
R3 SBRE;SBRE;C:\WINDOWS\system32\drivers\SBREdrv.sys []
R4 winser;winser;C:\WINDOWS\system32\winsersec.exe []
S0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
S0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [03/26/2007 10:26 AM]
S0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [03/29/2007 06:36 AM]
S0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [03/26/2007 10:26 AM]
S1 mchInjDrv;madCodeHook DLL injection driver;C:\WINDOWS\system32\Drivers\mchInjDrv.sys [10/10/2008 01:24 PM]
S2 Prvflder;Prvflder;C:\WINDOWS\system32\DRIVERS\prvflder.sys [04/21/2006 08:22 AM]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM]
S3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [01/24/2008 12:25 AM]
.
s of the 'Scheduled Tasks' folder
2008-10-06 C:\WINDOWS\Tasks\One-Click Tweak.job
- C:\Program Files\Advanced PC Tweaker\OneClick.exe []
2008-09-29 C:\WINDOWS\Tasks\rpc.job
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe []
2008-10-21 C:\WINDOWS\Tasks\PCConfidential.job
- C:\Program Files\Winferno\PC Confidential\PCConfidential.exe []
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\amer\Application Data\Mozilla\Firefox\Profiles\pze0em4g.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-10-21 19:41:36
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2009\AVP.EXE
C:\PROGRAM FILES\HOTSPOT SHIELD\BIN\OPENVPNAS.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
.
**************************************************************************
.
Completion time: 10/21/2008 19:43:54 - machine was rebooted [amer]
ComboFix-quarantined-files.txt 2008-10-21 16:43:48
Pre-Run: 12,816,465,920 bytes free
Post-Run: 12,814,876,672 bytes free
218 --- E O F --- 2008-10-15 13:29:43
k:
