الحمدلله تخلصت منها على ما اظن
هذا تحليل لأداة كومبو
ComboFix 08-11-12.01 - دآم المنصورية 11/18/2008 15:24:19.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.268 [GMT 3:00]
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
c:\windows\TEMP\logishrd\LVPrcInj01.dll
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\musz1s.dll
c:\windows\system32\musz2s.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll . . . . failed to delete
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_aliimz
((((((((((((((((((((((((( Files Created from 2008-10-18 to 2008-11-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-18 12:33 35,643,424 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-18 12:33 --------- d-----w c:\documents and settings\دآم المنصورية\Application Data\Skype
2008-11-18 12:28 420,368 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-18 12:23 --------- d-----w c:\documents and settings\دآم المنصورية\Application Data\skypePM
2008-11-18 07:55 --------- d-----w c:\documents and settings\دآم المنصورية\Application Data\DMCache
2008-11-18 07:43 --------- d-----w c:\program files\YouTube Downloader
2008-11-17 22:54 --------- d-----w c:\documents and settings\دآم المنصورية\Application Data\Avira
2008-11-17 10:02 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-17 09:22 --------- d-----w c:\program files\Conquer 2.0
2008-11-15 11:13 --------- d-----w c:\program files\Western Digital
2008-11-15 11:13 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-14 08:57 --------- d-----w c:\program files\Unlocker
2008-11-14 08:57 --------- d-----w c:\documents and settings\دآم المنصورية\Application Data\Desktopicon
2008-11-14 04:33 --------- d-----w c:\program files\Avira
2008-11-14 04:33 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-11-13 20:16 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-11-13 17:17 --------- d-----w c:\program files\Logitech
2008-10-31 16:35 330 ----a-w c:\windows\system32\drivers\1.txt
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-09-17 04:13 103,306 ----a-w c:\windows\ynner.exe
2008-09-13 15:11 6,997 ----a-w c:\windows\tmfnc.exe
2004-08-03 18:55 38,784 --sha-w c:\windows\system32\LeakCheck.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [08/11/2008 05:46 PM 21741864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [02/07/2005 05:04 AM 94037]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [07/10/2007 07:55 AM 180269]
"NSLauncher"="c:\program files\Nokia\Nokia Software Launcher\NSLauncher.exe" [11/28/2006 01:12 AM 2658304]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM 132496]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [08/14/2008 05:11 PM 565008]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [08/14/2008 05:15 PM 2407184]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [06/12/2008 02:28 PM 266497]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [05/02/2008 07:15 AM 15872]
"SiSPower"="SiSPower.dll" [03/09/2006 03:04 AM 49152 c:\windows\system32\SiSPower.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
c:\documents and settings\§™ê ںéêë­ي©ï،\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Logitech . Product Registration.lnk - c:\program files\Logitech\QuickCam\eReg.exe [2008-02-13 493832]
MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-03-24 4571136]
c:\documents and settings\§™ê ںéêë­ي©ï،\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Logitech . Product Registration.lnk - c:\program files\Logitech\QuickCam\eReg.exe [2008-02-13 493832]
MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-03-24 4571136]
c:\documents and settings\§™ê ںéêë­ي©ï،\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Logitech . Product Registration.lnk - c:\program files\Logitech\QuickCam\eReg.exe [2008-02-13 493832]
MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-03-24 4571136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.vp31"= vp31vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
"c:\\WINDOWS\\System32\\rtcshare.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 is-DL887drv;is-DL887drv;c:\windows\system32\drivers\82267378.sys [03/05/2008 11:41 AM 148496]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [07/11/2008 12:23 PM 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [06/12/2008 02:59 PM 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [05/09/2008 01:22 PM 41217]
R3 LVRS;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs.sys [07/26/2008 06:25 PM 627864]
S4 is-DL887;is-DL887;c:\documents and settings\All Users\سطح المكتب\Kaspersky Lab Tool\is-DL887\is-DL887.exe [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ded1152-d987-11dc-a20a-000e2e9007ba}]
\Shell\AutoRun\command - 3wcxx91.cmd
\Shell\explore\Command - 3wcxx91.cmd
\Shell\open\Command - 3wcxx91.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f330dabc-43cc-11dd-a2bd-000e2e9007ba}]
\Shell\AutoRun\command - F:\mrsne.bat
\Shell\explore\Command - F:\mrsne.bat
\Shell\open\Command - F:\mrsne.bat
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6612664F-2D9D-7D60-365F-C52C02442AB8}]
c:\docume~1\دآمالم~1\LOCALS~1\Temp\Rar$EX00.016\ca dawla.2.exe
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\دآم المنصورية\Application Data\Mozilla\Firefox\Profiles\gmt6ae12.default\
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-18 15:31:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: c:\windows\explorer.exe
-> c:\program files\Unlocker\UnlockerHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Premium\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Premium\avguard.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\sistray.exe
c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wpabaln.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
.
**************************************************************************
.
Completion time: 11/18/2008 15:43:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-18 12:43:24
Pre-Run: 132,087,808 bytes free
Post-Run: 1,781,166,080 bytes free
149 --- E O F --- 2008-11-16 03:12:29
افيدوني فيه يا اخوان
تحياتي
