السلام عليكم يااعضاء زيزووووم ويامشرفين.
عشمي فيكم كبير والله
انا عندي فايروس نفس فايروس المذكور في هالموضوع
وسويت الشرح الي قاله طويل العمر
وهذا التقرير الي طلع لي بالاداه الاولى
وهذا التقرير الي طلع لي بالاداه الثانيه
وش السواه يالربع.
للمعلوميه انا برنامج الحمايه حقي Avira anti-virus
وهذا الفايروس طلع لي يمكن 6 مرات وكل مايطلع لي افرمت الجهاز.
لكن اليوم قلت أدور حل عند الوحوش وان شاء الله القى الحل الي يريحني من هالفايروس :f:
عشمي فيكم كبير والله
انا عندي فايروس نفس فايروس المذكور في هالموضوع
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
وسويت الشرح الي قاله طويل العمر
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
وهذا التقرير الي طلع لي بالاداه الاولى
PHP:
ComboFix 08-10-30.13 - Administrator 10/31/2008 2:56:36.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.112 [GMT 7:00]
Running from: C:\Documents and Settings\Administrator\My Documents\ComboFix.exe
* Created a new restore point
[color=RED][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\shost.exe
.
((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-30 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-30 19:13 23,552 ----a-w C:\WINDOWS\system32\wmimgr32.dll
2008-10-30 11:28 --------- d-----w C:\Program Files\Real Alternative
2008-10-30 11:28 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2008-10-29 16:56 155,995 ----a-w C:\WINDOWS\java\Packages\PV7TJDJ5.ZIP
2008-10-29 15:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nokia Multimedia Player
2008-10-28 21:33 --------- d-----w C:\Program Files\TechSmith
2008-10-28 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith
2008-10-28 21:32 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-10-28 08:36 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Resource Tuner
2008-10-28 07:51 --------- d-----w C:\Program Files\Active Ports
2008-10-28 07:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Suite
2008-10-28 07:36 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Nokia
2008-10-28 07:35 --------- d-----w C:\Program Files\Nokia
2008-10-28 07:35 --------- d-----w C:\Program Files\DIFX
2008-10-28 07:35 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-10-28 07:35 --------- d-----w C:\Program Files\Common Files\Nokia
2008-10-28 07:35 --------- d-----w C:\Documents and Settings\Administrator\Application Data\PC Suite
2008-10-28 07:34 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-10-28 07:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-10-27 22:32 --------- d-----w C:\Program Files\FlashFXP
2008-10-27 22:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\FlashFXP
2008-10-27 12:35 --------- d-----w C:\Program Files\Avira
2008-10-27 12:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-10-27 12:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-10-27 10:06 --------- d-----w C:\Program Files\Kaspersky Lab
2008-10-27 09:39 --------- d-----w C:\Program Files\AutoIt3
2008-10-27 07:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-10-27 07:14 --------- d-----w C:\Program Files\BreakPoint Software
2008-10-27 07:12 --------- d-----w C:\Program Files\Resource Tuner
2008-10-27 07:01 --------- d-----w C:\Program Files\No-IP
2008-10-27 04:23 --------- d-----w C:\Program Files\Vista Drive Icon
2008-10-26 16:04 53,248 ----a-w C:\WINDOWS\system32\suppdll.dll
2008-10-26 16:04 35,363 ----a-w C:\WINDOWS\system32\windrvNT.sys
2008-10-26 16:04 --------- d-----w C:\Program Files\Folder Lock
2008-10-26 07:25 --------- d-----w C:\Program Files\The KMPlayer
2008-10-26 07:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-26 07:04 --------- d-----w C:\Program Files\Realtek
2008-10-26 07:04 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-26 05:48 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-10-26 05:45 --------- d-----w C:\Program Files\Windows Live
2008-10-26 05:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Avant Profiles
2008-10-26 05:39 --------- d-----w C:\Program Files\Avant Browser
2008-10-26 05:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\VSRevoGroup
2008-10-26 05:36 --------- d-----w C:\Program Files\VS Revo Group
2008-10-26 00:13 --------- d-----w C:\Program Files\Google
2008-10-25 22:01 --------- d-----w C:\Program Files\Ringz Studio
2008-10-25 22:01 --------- d-----w C:\Program Files\Foxit Reader
2008-10-25 22:01 --------- d-----w C:\Program Files\Common Files\Real
2008-10-25 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-10-25 19:37 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-10-15 16:34 337,408 ------w C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-03 17:41 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-15 12:12 1,846,400 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-08 10:41 333,824 ------w C:\WINDOWS\system32\dllcache\srv.sys
2008-09-05 16:30 241,704 ------w C:\WINDOWS\system32\dllcache\wgaLogon.dll
2008-09-05 16:29 917,032 ------w C:\WINDOWS\system32\dllcache\WgaTray.exe
2008-08-27 08:24 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-08-14 10:11 2,189,184 ------w C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-14 10:09 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 10:09 2,145,280 ------w C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-08-14 10:04 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-08-14 09:33 2,066,048 ------w C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-14 09:33 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-08-14 09:33 2,023,936 ------w C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:26 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.
------- Sigcheck -------
06/27/2008 03:16 AM 674816 0f2f01cdf020832eaf0704a3d1481d11 C:\WINDOWS\system32\user32.dll
06/27/2008 03:17 AM 557056 7dd9ce78dd441eea2bbaff6d3eeaad08 C:\WINDOWS\system32\winlogon.exe
06/27/2008 03:07 AM 1377792 bd63be0a3d05056222c86be283256d90 C:\WINDOWS\explorer.exe
06/27/2008 03:07 AM 60928 93e17e63f5a148bebf339a9f5329a469 C:\WINDOWS\system32\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [06/27/2008 03:07 AM 60928]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [11/29/2007 07:25 PM 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvIcon"="C:\Program Files\Vista Drive Icon\DrvIcon.exe" [04/13/2008 07:39 PM 49152]
"RTHDCPL"="RTHDCPL.EXE" [10/15/2005 08:51 AM 14884864 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [06/27/2008 03:07 AM 60928]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [11/07/2007 05:35 PM 1314816]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [08/26/2008 02:24 PM 124928 C:\WINDOWS\system32\advpack.dll]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
SnagIt 9.lnk - C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe [2008-09-22 6825288]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"=
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [07/11/2008 12:23 PM 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [06/12/2008 02:59 PM 258305]
R2 Apache2.2;Apache2.2;C:\AppServ\Apache2.2\bin\httpd.exe [01/18/2008 12:37 AM 24635]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [05/09/2008 01:22 PM 41217]
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-PC Suite Tray - C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
HKCU-Run-Windows Updater - C:\WINDOWS\shost.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ouf32iqh.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.sa/
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 02:58:08
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mysql]
"ImagePath"="C:\AppServ\MySQL\bin\mysqld-nt --defaults-file=C:\AppServ\MySQL\my.ini mysql"
.
Completion time: 10/31/2008 2:58:56
ComboFix-quarantined-files.txt 2008-10-30 19:58:53
Pre-Run: 17,046,736,896 bytes free
Post-Run: 17,042,833,408 bytes free
160 --- E O F --- 2008-10-28 04:42:30
PHP:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:01:13 ص, on 31/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Vista Drive Icon\DrvIcon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 9\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 9\SnagPriv.exe
C:\Program Files\TechSmith\SnagIt 9\snagiteditor.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\AppServ\Apache2.2\bin\httpd.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\AppServ\MySQL\bin\mysqld-nt.exe
C:\Program Files\No-IP\DUC20.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
C:\AppServ\Apache2.2\bin\httpd.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\My Documents\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: SnagIt 9.lnk = C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Apache2.2 - Apache Software Foundation - C:\AppServ\Apache2.2\bin\httpd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5958 bytesللمعلوميه انا برنامج الحمايه حقي Avira anti-virus
وهذا الفايروس طلع لي يمكن 6 مرات وكل مايطلع لي افرمت الجهاز.
لكن اليوم قلت أدور حل عند الوحوش وان شاء الله القى الحل الي يريحني من هالفايروس :f:
