إعمل التالي :ـ
إبدأ ثم تشغيل أكتب
gpedit.msc
ثم تكوين المستخدم ثم قوالب الإدارة ثم النظام سوف تري
turn off autoplay
نشغله
إذا وجدتها على تمكين فضع بلا تكوين ثم موافق ...
إما إذا وجدتها غير ذلك فلا تغيرها
تحياتي
ComboFix 08-10-22.05 - B@SSEM 10/23/2008 17:48:11.1 - [color=red][b]FAT32[/b][/color]x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.409 [GMT 2:00]
Running from: D:\Documents and Settings\B@SSEM\Desktop\ComboFix.exe
[color=RED][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-09-23 to 2008-10-23 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-23 14:17 --------- d-----w D:\Documents and Settings\All Users\Application Data\Acoustica
2008-10-23 14:16 --------- d-----w D:\Program Files\Acoustica Mixcraft 4
2008-10-22 23:02 --------- d-----w D:\Program Files\K-Lite Codec Pack
2008-10-22 22:50 --------- d-----w D:\Program Files\Outlook Messenger
2008-10-22 20:46 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Media Player Classic
2008-10-22 14:49 --------- d-----w D:\Program Files\Common Files\delet
2008-10-22 13:44 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\GeoVid
2008-10-21 21:09 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Bitsoft
2008-10-20 15:54 --------- d-----w D:\Program Files\CCleaner
2008-10-19 21:42 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Nero
2008-10-18 17:10 --------- d-----w D:\Program Files\Sun
2008-10-17 16:09 10,872 ----a-w D:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-10-16 20:34 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Nokia Multimedia Player
2008-10-15 13:15 --------- d-----w D:\Program Files\VMware
2008-10-15 13:11 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Ashampoo
2008-10-14 20:15 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Groove Games
2008-10-14 16:31 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Thinstall
2008-10-14 15:02 --------- d-----w D:\Program Files\Internet Download Manager
2008-10-14 15:02 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\IDM
2008-10-14 14:52 --------- d-----w D:\Program Files\ColorSoft
2008-10-14 13:39 --------- d-----w D:\Program Files\Winamp
2008-10-14 13:39 --------- d-----w D:\Program Files\Registry Optimizer 4.1
2008-10-14 13:39 --------- d-----w D:\Program Files\KMPlayer
2008-10-14 13:38 0 ---ha-w D:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-10-14 13:38 0 ---ha-w D:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-10-14 13:36 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\PC Suite
2008-10-14 13:36 --------- d-----w D:\Documents and Settings\All Users\Application Data\PC Suite
2008-10-14 13:34 --------- d-----w D:\Documents and Settings\B@SSEM\Application Data\Nokia
2008-10-14 13:33 --------- d-----w D:\Program Files\DIFX
2008-10-14 13:33 --------- d-----w D:\Program Files\Common Files\PCSuite
2008-10-14 13:33 --------- d-----w D:\Program Files\Common Files\Nokia
2008-10-14 13:32 --------- d-----w D:\Program Files\PC Connectivity Solution
2008-10-14 13:32 --------- d-----w D:\Program Files\Nokia
2008-10-14 13:30 --------- d-----w D:\Program Files\Windows Live
2008-10-14 13:30 --------- d-----w D:\Documents and Settings\All Users\Application Data\Installations
2008-09-29 15:43 84,936 ----a-w D:\WINDOWS\system32\ElbyVCD.dll
2008-09-24 10:29 29,184 ----a-w D:\WINDOWS\system32\drivers\VClone.sys
2008-09-16 00:14 3,596,288 ----a-w D:\WINDOWS\system32\qt-dx331.dll
2008-09-16 00:12 81,920 ----a-w D:\WINDOWS\system32\dpl100.dll
2008-09-16 00:11 683,520 ----a-w D:\WINDOWS\system32\divx.dll
2008-09-12 14:00 95,888 ----a-w D:\WINDOWS\system32\drivers\VBoxDrv.sys
2008-08-21 19:34 73,216 ----a-w D:\WINDOWS\ST6UNST.EXE
2008-08-21 19:34 172,032 ------w D:\WINDOWS\Setup1.exe
2008-08-21 18:55 94,636 ----a-w D:\WINDOWS\dropcpyr.dll
2008-08-21 18:55 73,728 ----a-w D:\WINDOWS\copyfstq.exe
2008-08-21 18:45 2,560 ----a-w D:\WINDOWS\system32\bitcometres.dll
2008-07-31 08:41 68,616 ----a-w D:\WINDOWS\system32\XAPOFX1_1.dll
2008-07-31 08:41 238,088 ----a-w D:\WINDOWS\system32\xactengine3_2.dll
2008-07-31 08:40 509,448 ----a-w D:\WINDOWS\system32\XAudio2_2.dll
.
------- Sigcheck -------
07/02/2008 06:03 AM 2205568 3507df1b5961bd2fdbf5d82d2c224193 D:\WINDOWS\system32\ntkrnlpa.exe
07/02/2008 05:57 AM 2328704 bb1977710a260ad67e9a3724f3840194 D:\WINDOWS\system32\ntoskrnl.exe
09/25/2007 02:25 PM 1048576 efce18b4903e99737e3d0f28df1cb851 D:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [04/15/2008 03:00 AM 15360]
"RocketDock"="D:\Documents and Settings\B@SSEM\Desktop\RocketDock\RocketDock.exe" [09/02/2007 01:58 PM 495616]
"MsnMsgr"="D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"ccleaner"="D:\Program Files\CCleaner\CCleaner.exe" [09/24/2008 09:42 PM 1279216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="D:\Program Files\ESET\ESET Smart Security\egui.exe" [01/30/2008 12:37 PM 1443072]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [07/20/2005 03:07 PM 7110656]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [04/15/2008 03:00 AM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [08/13/2007 06:39 PM 123904 D:\WINDOWS\system32\advpack.dll]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23192:TCP"= 23192:TCP:BitComet 23192 TCP
"23192:UDP"= 23192:UDP:BitComet 23192 UDP
S1 VBoxDrv;VirtualBox Service;D:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [09/12/2008 04:00 PM 95888]
S1 vcdrom;Virtual CD-ROM Device Driver;D:\Program Files\System\CPL Bonus\Vcdrom.sys [12/19/2001 11:45 AM 8576]
S2 AntiARPClientLoader;AntiARP Client Loader;D:\Program Files\ColorSoft\AntiARP\AntiARPClientLoader.exe [10/17/2007 04:25 PM 40960]
S2 AntiArpNdisProt;AntiARP NDIS Protocol Driver;D:\WINDOWS\system32\DRIVERS\AntiArpNdisProt.sys [10/17/2007 01:33 PM 21120]
S3 PSXGamepadEnabler;Psx Hid to Gamepad Port Enabler;D:\WINDOWS\system32\drivers\psxpad.sys [05/15/2002 12:24 PM 12160]
S3 PsxPortEnumerator;Psx Port Enumerator;D:\WINDOWS\system32\Drivers\psxenum.sys [09/26/2002 03:36 AM 16896]
S3 xAntiArp;xAntiArpSpoof Service;D:\WINDOWS\system32\DRIVERS\xAntiArp.sys [12/06/2007 02:16 PM 375296]
*Newly Created Service* - CATCHME
*Newly Created Service* - VCDROM
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.outlookmessenger.com/om/uninstall.asp
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O8 -: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O17 -: HKLM\CCS\Interface\{A60DF5D1-A5C4-4FDB-A77E-0AC067B65841}: NameServer = 66.11.234.90,66.11.234.91
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-23 17:52:31
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 10/23/2008 17:53:07
ComboFix-quarantined-files.txt 2008-10-23 15:53:06
Pre-Run: 2,853,478,400 bytes free
Post-Run: 2,847,993,856 bytes free
146
لا ما عليك !... أنا فااااااااضي ...