مو من الحراره طلعه 50 يقلون طبعيه وتصير 45
الان اول ماشغل جهاز اشوف عمليات احصله 41
وهذا توني ماشغلت ماسنجر وباقي برامج
المهم سويت كشف اول برنامج وهذا هو تقرير
ComboFix 08-11-06.01 - khalid 11/07/2008 18:11:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.1484 [GMT 3:00]
Running from: c:\downloads\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-10-07 to 2008-11-07 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-07 15:15 --------- d-----w c:\documents and settings\khalid\Application Data\Orbit
2008-11-03 16:44 --------- d-----w c:\documents and settings\khalid\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-03 16:43 --------- d-----w c:\program files\Common Files\Adobe AIR
2008-11-03 16:43 --------- d-----w c:\program files\Common Files\Adobe
2008-11-03 16:39 --------- d-----w c:\program files\Golden Al-Wafi Translator
2008-11-03 16:38 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-11-03 16:38 172,032 ------w c:\windows\Setup1.exe
2008-10-31 12:30 --------- d-----w c:\program files\LeapFTP
2008-10-28 11:10 --------- d-----w c:\program files\Orbitdownloader
2008-10-26 20:15 --------- d-----w c:\documents and settings\khalid\Application Data\GrabPro
2008-10-09 01:02 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-10-08 10:29 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2008-10-08 09:55 --------- d-----w c:\program files\Common Files\Macrovision Shared
2008-10-07 20:15 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-07 19:48 --------- d-----w c:\program files\MSXML 4.0
2008-10-07 19:45 --------- d-----w c:\program files\Microsoft Works
2008-10-07 19:41 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-07 11:05 --------- d-----w c:\program files\Common Files\Ahead
2008-10-07 11:05 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2008-10-07 11:03 --------- d-----w c:\program files\Nero
2008-10-07 11:03 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-10-07 10:44 --------- d-----w c:\program files\Microsoft.NET
2008-10-07 10:42 --------- d-----w c:\documents and settings\khalid\Application Data\Apple Computer
2008-10-07 10:40 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-10-07 10:24 --------- d-----w c:\program files\Windows Live
2008-10-07 10:06 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-10-07 10:02 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-10-07 10:00 --------- d-----w c:\program files\QuickTime
2008-10-07 10:00 --------- d-----w c:\program files\iTunes
2008-10-07 10:00 --------- d-----w c:\program files\iPod
2008-10-07 10:00 --------- d-----w c:\program files\Common Files\Apple
2008-10-07 10:00 --------- d-----w c:\program files\Bonjour
2008-10-07 10:00 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-10-07 10:00 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-07 09:59 --------- d-----w c:\program files\Apple Software Update
2008-10-07 09:59 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2008-10-07 09:57 --------- d-----w c:\program files\Real
2008-10-07 09:57 --------- d-----w c:\program files\Common Files\xing shared
2008-10-07 09:57 --------- d-----w c:\program files\Common Files\Real
2008-10-07 09:55 --------- d-----w c:\documents and settings\khalid\Application Data\ATI
2008-10-07 09:55 --------- d-----w c:\documents and settings\All Users\Application Data\ATI
2008-10-07 09:52 --------- d-----w c:\program files\ATI Technologies
2008-10-07 09:51 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-07 09:50 --------- d-----w c:\program files\Common Files\ATI Technologies
2008-10-07 09:45 --------- d-----w c:\program files\Common Files\InstallShield
2008-10-07 09:43 --------- d-----w c:\program files\Realtek
2008-10-07 09:42 16,608 ----a-w c:\windows\gdrv.sys
2008-10-07 09:39 315,392 ----a-w c:\windows\HideWin.exe
2008-10-07 09:39 --------- d-----w c:\program files\AMD
2008-10-07 09:39 --------- d-----w c:\documents and settings\khalid\Application Data\InstallShield
2008-10-07 09:37 --------- d-----w c:\program files\ESET
2008-10-07 09:37 --------- d-----w c:\documents and settings\khalid\Application Data\ESET
2008-10-07 09:37 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2008-10-05 13:51 --------- d-----w c:\program files\microsoft frontpage
2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m–|\ü" [X]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [08/18/2008 01:23 PM 1447168]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [11/10/2006 12:35 PM 90112]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [10/07/2008 12:57 PM 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [09/06/2008 03:09 PM 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [09/08/2008 11:02 PM 289576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 02:57 PM 153136]
"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [11/26/2007 02:54 PM 1629480]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [11/26/2007 02:54 PM 1057064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [06/12/2008 02:38 AM 34672]
"RTHDCPL"="RTHDCPL.EXE" [12/20/2007 11:47 AM 16860672 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 06:59 PM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2008-10-26 1707208]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LeapFTP\\LeapFTP.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
.
s of the 'Scheduled Tasks' folder
2008-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [07/30/2008 12:34 PM]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.1tesh.com/vb/online.php
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
O8 -: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
O8 -: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
O8 -: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-07 18:15:02
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Orbitdownloader\orbitnet.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\ESET\ESET Smart Security\ekrn.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 11/07/2008 18:17:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-07 15:17:09
Pre-Run: 94,035,488,768 bytes free
Post-Run: 94,750,674,944 bytes free
149 --- E O F --- 2008-11-01 10:30:34
______________________________________-
وهذا هو تقرير برنامج ثاني
Logfile of HijackThis v1.99.1
Scan saved at 06:20:35 م, on 07/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\downloads\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [GEST] m–|\ü
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
