الف الف شكر استاذى الفاضل لاهتماك بمشكلتى
وهذا هو التقرير المطلوب
وجذاك الله عن كل شكر
combofix 08-10-28.01 - hsham 10/29/2008 0:58:55.1 - ntfsx86
microsoft windows xp professional 5.1.2600.2.1256.1.1033.18.658 [gmt 2:00]
running from: C:\documents and settings\hsham\desktop\combofix.exe
* created a new restore point
* resident av is active
warning -this machine does not have the recovery console installed !!
.
((((((((((((((((((((((((( files created from 2008-09-28 to 2008-10-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( find3m report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 23:02 --------- d-----w c:\documents and settings\hsham\application data\dmcache
2008-10-28 22:02 --------- d-----w c:\program files\driver-soft
2008-10-28 17:27 --------- d-----w c:\documents and settings\all users\application data\sandlot games
2008-10-28 17:16 --------- d-----w c:\documents and settings\hsham\application data\super-cow
2008-10-28 12:59 --------- d-----w c:\documents and settings\hsham\application data\idm
2008-10-28 06:47 --------- d-----w c:\program files\eset
2008-10-27 22:25 --------- d-----w c:\program files\microsoft activesync
2008-10-27 22:22 502,368 ----a-w c:\windows\system32\drivers\amon.sys
2008-10-27 22:22 274,432 ----a-w c:\windows\system32\imon.dll
2008-10-27 22:21 --------- d-----w c:\program files\winamp
2008-10-27 22:16 --------- d-----w c:\documents and settings\hsham\application data\media player classic
2008-10-27 22:15 --------- d-----w c:\program files\k-lite codec pack
2008-10-27 21:55 --------- d-----w c:\program files\yahoo!
2008-10-27 21:48 --------- d--h--w c:\program files\installshield installation information
2008-10-27 21:48 --------- d-----w c:\program files\realtek
2008-10-27 21:48 --------- d-----w c:\documents and settings\hsham\application data\installshield
2008-10-27 21:45 --------- d-----w c:\program files\intel
2008-10-27 21:28 --------- d-----w c:\program files\common files\installshield
2008-10-27 21:24 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( reg loading points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*note* empty entries & legit default entries are not shown
regedit4
[hkey_current_user\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 03:07 am 15360]
"yahoo! Pager"="c:\program files\yahoo!\messenger\ypager.exe" [10/27/2008 11:55 pm 3096576]
[hkey_local_machine\software\microsoft\windows\currentversion\run]
"imjpmig8.1"="c:\windows\ime\imjp8_1\imjpmig.exe" [08/04/2004 03:07 am 208952]
"phime2002async"="c:\windows\system32\ime\tintlgnt\tintsetp.exe" [08/04/2004 03:07 am 455168]
"phime2002a"="c:\windows\system32\ime\tintlgnt\tintsetp.exe" [08/04/2004 03:07 am 455168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [11/28/2005 07:55 am 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [11/28/2005 07:52 am 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [11/28/2005 07:55 am 118784]
"winampagent"="c:\program files\winamp\winampa.exe" [12/20/2004 08:41 pm 33792]
"nod32kui"="c:\program files\eset\nod32kui.exe" [10/28/2008 12:22 am 921600]
"rthdcpl"="rthdcpl.exe" [11/14/2006 11:21 am 16270848 c:\windows\rthdcpl.exe]
"skytel"="skytel.exe" [05/16/2006 12:04 pm 2879488 c:\windows\skytel.exe]
[hkey_users\.default\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 03:07 am 15360]
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"enablefirewall"= 0 (0x0)
[hklm\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"=
"c:\\program files\\yahoo!\\messenger\\ypager.exe"=
"c:\\program files\\yahoo!\\messenger\\yserver.exe"=
r2 713xtvcard;saa7130 tv card;c:\windows\system32\drivers\saa713x.sys [09/05/2005 06:00 am 279552]
r2 wdmtvtuner;universal wdm tv tuner;c:\windows\system32\drivers\wdmtuner.sys [09/05/2005 06:00 am 25984]
*newly created service* - procexp90
.
.
------- supplementary scan -------
.
R0 -: Hkcu-main,start page = hxxp://www.google.com.eg/
r0 -: Hklm-main,start page = hxxp://www.yahoo.com
r1 -: Hkcu-internet connection wizard,shellnext = hxxp://www.yahoo.com/
o8 -: Download all links with idm - c:\program files\internet download manager\iegetall.htm
o8 -: Download flv video with idm - c:\program files\internet download manager\iegetvl.htm
o8 -: Download with idm - c:\program files\internet download manager\ieext.htm
o8 -: E&xport to microsoft excel - c:\progra~1\micros~2\office11\excel.exe/3000
o17 -: Hklm\ccs\interface\{9ceca929-e58f-48b6-aa6a-615c9cebf3a7}: Nameserver = 163.121.128.134,212.103.160.108
.
**************************************************************************
catchme 0.3.1367 w2k/xp/vista - rootkit/stealth malware detector by gmer,
rootkit scan 2008-10-29 01:02:46
windows 5.1.2600 service pack 2 ntfs
scanning hidden processes ...
Scanning hidden autostart entries ...
Scanning hidden files ...
Scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 10/29/2008 1:03:12
combofix-quarantined-files.txt 2008-10-28 23:03:10
pre-run: 16,278,429,696 bytes free
post-run: 16,282,963,968 bytes free
91
