عين الاسد
زيزوومي نشيط
غير متصل
- بادئ الموضوع عين الاسد
- تاريخ البدء
- 1,417
k:
فارس الملاك
زيزوومى محترف
غير متصل
عزيزي اذا ممكن صورة للكاسبر ومكان تواجد الملف
توقيع : فارس الملاك
تأييد
0
فارس الملاك
زيزوومى محترف
غير متصل
عزيزي لاهنت اضغط لك الملف بالونرار ورسله لي على الخاااص
توقيع : فارس الملاك
تأييد
0
فارس الملاك
زيزوومى محترف
غير متصل
(1)
عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
(2)
واعمل تقرير للهايجاك
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم
التعديل الأخير بواسطة المشرف:
توقيع : فارس الملاك
تأييد
0
عين الاسد
زيزوومي نشيط
غير متصل
ComboFix 08-12-12.05 - AHMED 12/13/2008 18:45:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.2046.1541 [GMT 2:00]
Running from: c:\documents and settings\AHMED\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\BASSMOD.dll
c:\windows\system32\ddcYpNgf.dll
c:\windows\system32\ff_vfw.dll
c:\windows\system32\vbsdfe0.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 16:48 --------- d-----w c:\program files\JetAudio
2008-12-13 16:48 --------- d-----w c:\documents and settings\AHMED\Application Data\DMCache
2008-12-13 16:47 5,176 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-13 16:47 278,560 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-13 16:47 13,968 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-13 16:47 1,247,264 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-13 16:20 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-13 16:18 --------- d-----w c:\documents and settings\AHMED\Application Data\Xfire
2008-12-13 15:58 --------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
2008-12-13 15:45 25,784 ----a-w c:\windows\system32\drivers\pxark.sys
2008-12-13 15:45 --------- d-----w c:\program files\PrevxCSI
2008-12-13 14:18 --------- d-----w c:\documents and settings\NetworkService\Application Data\Xfire
2008-12-12 17:44 --------- d-----w c:\program files\Common Files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\program files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\AHMED\Application Data\ACD Systems
2008-12-12 14:39 --------- d-----w c:\program files\Photoplorer
2008-12-12 14:30 --------- d-----w c:\program files\Java
2008-12-12 07:42 --------- d-----w c:\documents and settings\AHMED\Application Data\Red Alert 3
2008-12-10 16:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-10 16:48 --------- d-----w c:\documents and settings\LocalService\Application Data\Xfire
2008-12-10 10:48 --------- d-----w c:\program files\MSN Messenger
2008-12-10 06:06 --------- d-----w c:\program files\Xfire
2008-12-10 05:18 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 14:05 22,328 ----a-w c:\documents and settings\AHMED\Application Data\PnkBstrK.sys
2008-12-08 10:53 --------- d-----w c:\program files\GoldWave
2008-12-07 12:30 --------- d-----w c:\program files\Common Files\snp325
2008-12-07 12:23 --------- d-----w c:\program files\Yahoo!
2008-12-07 12:23 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-07 11:19 --------- d-----w c:\program files\MSBuild
2008-12-07 11:14 --------- d-----w c:\program files\Reference Assemblies
2008-12-07 10:45 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2008-12-07 06:45 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-07 06:45 --------- d-----w c:\documents and settings\AHMED\Application Data\Media Player Classic
2008-12-07 05:54 --------- d-----w c:\documents and settings\AHMED\Application Data\IDM
2008-12-07 05:50 --------- d-----w c:\program files\Common Files\COWON
2008-12-07 05:50 --------- d-----w c:\documents and settings\AHMED\Application Data\COWON
2008-12-07 05:49 --------- d-----w c:\documents and settings\AHMED\Application Data\InstallShield
2008-12-07 05:25 --------- d-----w c:\program files\Real
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\xing shared
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\Real
2008-12-07 05:21 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-07 05:09 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-07 05:09 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools
2008-12-07 05:00 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools Pro
2008-12-07 04:38 --------- d-----w c:\program files\Internet Download Manager
2008-12-06 20:29 161,892 ----a-w c:\windows\system32\drivers\mon_ac_w.bin
2008-12-06 20:29 149,632 ----a-w c:\windows\system32\drivers\gwausb.sys
2008-12-06 16:18 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-06 16:18 --------- d-----w c:\program files\AGEIA Technologies
2008-12-06 16:16 --------- d-----w c:\program files\Realtek
2008-12-06 16:16 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-06 14:17 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-06 11:55 --------- d-----w c:\program files\Conexant
2008-12-06 10:01 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-06 10:01 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-12-06 10:00 --------- d-----w c:\program files\Kaspersky Lab
2008-12-06 09:59 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-06 09:54 --------- d-----w c:\program files\microsoft frontpage
2008-11-11 17:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [12/06/2008 06:31 PM 2745776]
"vamsoft"="c:\windows\system32\vamsoft.exe" [12/13/2008 07:25 AM 108526]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [10/07/2008 01:33 PM 13574144]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [12/07/2008 07:25 AM 180269]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [12/12/2008 04:30 PM 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\AHMED\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2008-11-20 2986320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 07/24/2008 05:02 PM 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]
--------- 12/06/2008 10:29 PM 90112 c:\program files\Conexant\Adsl\dslagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLSTATEXE]
--------- 12/06/2008 10:29 PM 376832 c:\program files\Conexant\Adsl\DslStat.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 07/11/2007 04:09 PM 20480 c:\windows\FixCamera.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 12/06/2008 06:31 PM 2745776 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 10/07/2008 01:33 PM 13574144 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 10/07/2008 01:33 PM 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
--a------ 05/10/2007 01:18 PM 835584 c:\windows\vsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 12/07/2008 07:25 AM 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
--a------ 04/21/2007 09:36 AM 270336 c:\windows\tsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/30/2007 05:43 PM 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 10/07/2008 01:33 PM 1630208 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2008-12-07 10387840]
.
.
------- Supplementary Scan -------
.
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {E047D2CA-6F51-4F01-AF84-7434F37E0EE2} = 213.244.72.31 212.14.234.36
c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com//DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
FF - ProfilePath - c:\documents and settings\AHMED\Application Data\Mozilla\Firefox\Profiles\u0oclr6c.default\
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-13 18:48:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\vbsdfe0.dll 85504 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 12/13/2008 18:50:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-13 16:50:07
Pre-Run: 7,978,336,256 bytes free
Post-Run: 7,961,985,024 bytes free
185
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.2046.1541 [GMT 2:00]
Running from: c:\documents and settings\AHMED\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\BASSMOD.dll
c:\windows\system32\ddcYpNgf.dll
c:\windows\system32\ff_vfw.dll
c:\windows\system32\vbsdfe0.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 16:48 --------- d-----w c:\program files\JetAudio
2008-12-13 16:48 --------- d-----w c:\documents and settings\AHMED\Application Data\DMCache
2008-12-13 16:47 5,176 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-13 16:47 278,560 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-13 16:47 13,968 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-13 16:47 1,247,264 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-13 16:20 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-13 16:18 --------- d-----w c:\documents and settings\AHMED\Application Data\Xfire
2008-12-13 15:58 --------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
2008-12-13 15:45 25,784 ----a-w c:\windows\system32\drivers\pxark.sys
2008-12-13 15:45 --------- d-----w c:\program files\PrevxCSI
2008-12-13 14:18 --------- d-----w c:\documents and settings\NetworkService\Application Data\Xfire
2008-12-12 17:44 --------- d-----w c:\program files\Common Files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\program files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\AHMED\Application Data\ACD Systems
2008-12-12 14:39 --------- d-----w c:\program files\Photoplorer
2008-12-12 14:30 --------- d-----w c:\program files\Java
2008-12-12 07:42 --------- d-----w c:\documents and settings\AHMED\Application Data\Red Alert 3
2008-12-10 16:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-10 16:48 --------- d-----w c:\documents and settings\LocalService\Application Data\Xfire
2008-12-10 10:48 --------- d-----w c:\program files\MSN Messenger
2008-12-10 06:06 --------- d-----w c:\program files\Xfire
2008-12-10 05:18 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 14:05 22,328 ----a-w c:\documents and settings\AHMED\Application Data\PnkBstrK.sys
2008-12-08 10:53 --------- d-----w c:\program files\GoldWave
2008-12-07 12:30 --------- d-----w c:\program files\Common Files\snp325
2008-12-07 12:23 --------- d-----w c:\program files\Yahoo!
2008-12-07 12:23 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-07 11:19 --------- d-----w c:\program files\MSBuild
2008-12-07 11:14 --------- d-----w c:\program files\Reference Assemblies
2008-12-07 10:45 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2008-12-07 06:45 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-07 06:45 --------- d-----w c:\documents and settings\AHMED\Application Data\Media Player Classic
2008-12-07 05:54 --------- d-----w c:\documents and settings\AHMED\Application Data\IDM
2008-12-07 05:50 --------- d-----w c:\program files\Common Files\COWON
2008-12-07 05:50 --------- d-----w c:\documents and settings\AHMED\Application Data\COWON
2008-12-07 05:49 --------- d-----w c:\documents and settings\AHMED\Application Data\InstallShield
2008-12-07 05:25 --------- d-----w c:\program files\Real
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\xing shared
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\Real
2008-12-07 05:21 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-07 05:09 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-07 05:09 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools
2008-12-07 05:00 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools Pro
2008-12-07 04:38 --------- d-----w c:\program files\Internet Download Manager
2008-12-06 20:29 161,892 ----a-w c:\windows\system32\drivers\mon_ac_w.bin
2008-12-06 20:29 149,632 ----a-w c:\windows\system32\drivers\gwausb.sys
2008-12-06 16:18 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-06 16:18 --------- d-----w c:\program files\AGEIA Technologies
2008-12-06 16:16 --------- d-----w c:\program files\Realtek
2008-12-06 16:16 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-06 14:17 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-06 11:55 --------- d-----w c:\program files\Conexant
2008-12-06 10:01 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-06 10:01 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-12-06 10:00 --------- d-----w c:\program files\Kaspersky Lab
2008-12-06 09:59 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-06 09:54 --------- d-----w c:\program files\microsoft frontpage
2008-11-11 17:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [12/06/2008 06:31 PM 2745776]
"vamsoft"="c:\windows\system32\vamsoft.exe" [12/13/2008 07:25 AM 108526]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [10/07/2008 01:33 PM 13574144]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [12/07/2008 07:25 AM 180269]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [12/12/2008 04:30 PM 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\AHMED\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2008-11-20 2986320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 07/24/2008 05:02 PM 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]
--------- 12/06/2008 10:29 PM 90112 c:\program files\Conexant\Adsl\dslagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLSTATEXE]
--------- 12/06/2008 10:29 PM 376832 c:\program files\Conexant\Adsl\DslStat.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 07/11/2007 04:09 PM 20480 c:\windows\FixCamera.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 12/06/2008 06:31 PM 2745776 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 10/07/2008 01:33 PM 13574144 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 10/07/2008 01:33 PM 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
--a------ 05/10/2007 01:18 PM 835584 c:\windows\vsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 12/07/2008 07:25 AM 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
--a------ 04/21/2007 09:36 AM 270336 c:\windows\tsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/30/2007 05:43 PM 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 10/07/2008 01:33 PM 1630208 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2008-12-07 10387840]
.
.
------- Supplementary Scan -------
.
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {E047D2CA-6F51-4F01-AF84-7434F37E0EE2} = 213.244.72.31 212.14.234.36
c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com//DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
FF - ProfilePath - c:\documents and settings\AHMED\Application Data\Mozilla\Firefox\Profiles\u0oclr6c.default\
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2008-12-13 18:48:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\vbsdfe0.dll 85504 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 12/13/2008 18:50:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-13 16:50:07
Pre-Run: 7,978,336,256 bytes free
Post-Run: 7,961,985,024 bytes free
185
توقيع : عين الاسد
تأييد
0
عين الاسد
زيزوومي نشيط
غير متصل
وهذا تقرير الهايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:52:18 م, on 13/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\AHMED\سطح المكتب\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{E047D2CA-6F51-4F01-AF84-7434F37E0EE2}: NameServer = 213.244.72.31 212.14.234.36
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 4460 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:52:18 م, on 13/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\AHMED\سطح المكتب\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O17 - HKLM\System\CCS\Services\Tcpip\..\{E047D2CA-6F51-4F01-AF84-7434F37E0EE2}: NameServer = 213.244.72.31 212.14.234.36
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 4460 bytes
توقيع : عين الاسد
تأييد
0
عين الاسد
زيزوومي نشيط
غير متصل
هيو يا اخي هيو انا نسخته بالمشاركة السابقة
ComboFix 08-12-12.05 - AHMED 12/13/2008 18:45:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.2046.1541 [GMT 2:00]
Running from: c:\documents and settings\AHMED\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\BASSMOD.dll
c:\windows\system32\ddcYpNgf.dll
c:\windows\system32\ff_vfw.dll
c:\windows\system32\vbsdfe0.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 16:48 --------- d-----w c:\program files\JetAudio
2008-12-13 16:48 --------- d-----w c:\documents and settings\AHMED\Application Data\DMCache
2008-12-13 16:47 5,176 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-13 16:47 278,560 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-13 16:47 13,968 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-13 16:47 1,247,264 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-13 16:20 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-13 16:18 --------- d-----w c:\documents and settings\AHMED\Application Data\Xfire
2008-12-13 15:58 --------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
2008-12-13 15:45 25,784 ----a-w c:\windows\system32\drivers\pxark.sys
2008-12-13 15:45 --------- d-----w c:\program files\PrevxCSI
2008-12-13 14:18 --------- d-----w c:\documents and settings\NetworkService\Application Data\Xfire
2008-12-12 17:44 --------- d-----w c:\program files\Common Files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\program files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\AHMED\Application Data\ACD Systems
2008-12-12 14:39 --------- d-----w c:\program files\Photoplorer
2008-12-12 14:30 --------- d-----w c:\program files\Java
2008-12-12 07:42 --------- d-----w c:\documents and settings\AHMED\Application Data\Red Alert 3
2008-12-10 16:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-10 16:48 --------- d-----w c:\documents and settings\LocalService\Application Data\Xfire
2008-12-10 10:48 --------- d-----w c:\program files\MSN Messenger
2008-12-10 06:06 --------- d-----w c:\program files\Xfire
2008-12-10 05:18 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 14:05 22,328 ----a-w c:\documents and settings\AHMED\Application Data\PnkBstrK.sys
2008-12-08 10:53 --------- d-----w c:\program files\GoldWave
2008-12-07 12:30 --------- d-----w c:\program files\Common Files\snp325
2008-12-07 12:23 --------- d-----w c:\program files\Yahoo!
2008-12-07 12:23 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-07 11:19 --------- d-----w c:\program files\MSBuild
2008-12-07 11:14 --------- d-----w c:\program files\Reference Assemblies
2008-12-07 10:45 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2008-12-07 06:45 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-07 06:45 --------- d-----w c:\documents and settings\AHMED\Application Data\Media Player Classic
2008-12-07 05:54 --------- d-----w c:\documents and settings\AHMED\Application Data\IDM
2008-12-07 05:50 --------- d-----w c:\program files\Common Files\COWON
2008-12-07 05:50 --------- d-----w c:\documents and settings\AHMED\Application Data\COWON
2008-12-07 05:49 --------- d-----w c:\documents and settings\AHMED\Application Data\InstallShield
2008-12-07 05:25 --------- d-----w c:\program files\Real
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\xing shared
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\Real
2008-12-07 05:21 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-07 05:09 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-07 05:09 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools
2008-12-07 05:00 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools Pro
2008-12-07 04:38 --------- d-----w c:\program files\Internet Download Manager
2008-12-06 20:29 161,892 ----a-w c:\windows\system32\drivers\mon_ac_w.bin
2008-12-06 20:29 149,632 ----a-w c:\windows\system32\drivers\gwausb.sys
2008-12-06 16:18 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-06 16:18 --------- d-----w c:\program files\AGEIA Technologies
2008-12-06 16:16 --------- d-----w c:\program files\Realtek
2008-12-06 16:16 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-06 14:17 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-06 11:55 --------- d-----w c:\program files\Conexant
2008-12-06 10:01 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-06 10:01 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-12-06 10:00 --------- d-----w c:\program files\Kaspersky Lab
2008-12-06 09:59 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-06 09:54 --------- d-----w c:\program files\microsoft frontpage
2008-11-11 17:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [12/06/2008 06:31 PM 2745776]
"vamsoft"="c:\windows\system32\vamsoft.exe" [12/13/2008 07:25 AM 108526]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [10/07/2008 01:33 PM 13574144]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [12/07/2008 07:25 AM 180269]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [12/12/2008 04:30 PM 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\AHMED\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2008-11-20 2986320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 07/24/2008 05:02 PM 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]
--------- 12/06/2008 10:29 PM 90112 c:\program files\Conexant\Adsl\dslagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLSTATEXE]
--------- 12/06/2008 10:29 PM 376832 c:\program files\Conexant\Adsl\DslStat.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 07/11/2007 04:09 PM 20480 c:\windows\FixCamera.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 12/06/2008 06:31 PM 2745776 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 10/07/2008 01:33 PM 13574144 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 10/07/2008 01:33 PM 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
--a------ 05/10/2007 01:18 PM 835584 c:\windows\vsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 12/07/2008 07:25 AM 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
--a------ 04/21/2007 09:36 AM 270336 c:\windows\tsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/30/2007 05:43 PM 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 10/07/2008 01:33 PM 1630208 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2008-12-07 10387840]
.
.
------- Supplementary Scan -------
.
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {E047D2CA-6F51-4F01-AF84-7434F37E0EE2} = 213.244.72.31 212.14.234.36
c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com//DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
FF - ProfilePath - c:\documents and settings\AHMED\Application Data\Mozilla\Firefox\Profiles\u0oclr6c.default\
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-12-13 18:48:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\vbsdfe0.dll 85504 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 12/13/2008 18:50:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-13 16:50:07
Pre-Run: 7,978,336,256 bytes free
Post-Run: 7,961,985,024 bytes free
185
ComboFix 08-12-12.05 - AHMED 12/13/2008 18:45:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.2046.1541 [GMT 2:00]
Running from: c:\documents and settings\AHMED\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\BASSMOD.dll
c:\windows\system32\ddcYpNgf.dll
c:\windows\system32\ff_vfw.dll
c:\windows\system32\vbsdfe0.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-13 16:48 --------- d-----w c:\program files\JetAudio
2008-12-13 16:48 --------- d-----w c:\documents and settings\AHMED\Application Data\DMCache
2008-12-13 16:47 5,176 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-12-13 16:47 278,560 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-12-13 16:47 13,968 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-13 16:47 1,247,264 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-13 16:20 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-12-13 16:18 --------- d-----w c:\documents and settings\AHMED\Application Data\Xfire
2008-12-13 15:58 --------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
2008-12-13 15:45 25,784 ----a-w c:\windows\system32\drivers\pxark.sys
2008-12-13 15:45 --------- d-----w c:\program files\PrevxCSI
2008-12-13 14:18 --------- d-----w c:\documents and settings\NetworkService\Application Data\Xfire
2008-12-12 17:44 --------- d-----w c:\program files\Common Files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\program files\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-12-12 17:44 --------- d-----w c:\documents and settings\AHMED\Application Data\ACD Systems
2008-12-12 14:39 --------- d-----w c:\program files\Photoplorer
2008-12-12 14:30 --------- d-----w c:\program files\Java
2008-12-12 07:42 --------- d-----w c:\documents and settings\AHMED\Application Data\Red Alert 3
2008-12-10 16:50 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-10 16:48 --------- d-----w c:\documents and settings\LocalService\Application Data\Xfire
2008-12-10 10:48 --------- d-----w c:\program files\MSN Messenger
2008-12-10 06:06 --------- d-----w c:\program files\Xfire
2008-12-10 05:18 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-09 14:05 22,328 ----a-w c:\documents and settings\AHMED\Application Data\PnkBstrK.sys
2008-12-08 10:53 --------- d-----w c:\program files\GoldWave
2008-12-07 12:30 --------- d-----w c:\program files\Common Files\snp325
2008-12-07 12:23 --------- d-----w c:\program files\Yahoo!
2008-12-07 12:23 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-07 11:19 --------- d-----w c:\program files\MSBuild
2008-12-07 11:14 --------- d-----w c:\program files\Reference Assemblies
2008-12-07 10:45 --------- d-----w c:\program files\Microsoft Games for Windows - LIVE
2008-12-07 06:45 --------- d-----w c:\program files\K-Lite Codec Pack
2008-12-07 06:45 --------- d-----w c:\documents and settings\AHMED\Application Data\Media Player Classic
2008-12-07 05:54 --------- d-----w c:\documents and settings\AHMED\Application Data\IDM
2008-12-07 05:50 --------- d-----w c:\program files\Common Files\COWON
2008-12-07 05:50 --------- d-----w c:\documents and settings\AHMED\Application Data\COWON
2008-12-07 05:49 --------- d-----w c:\documents and settings\AHMED\Application Data\InstallShield
2008-12-07 05:25 --------- d-----w c:\program files\Real
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\xing shared
2008-12-07 05:25 --------- d-----w c:\program files\Common Files\Real
2008-12-07 05:21 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-07 05:09 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-07 05:09 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools
2008-12-07 05:00 --------- d-----w c:\documents and settings\AHMED\Application Data\DAEMON Tools Pro
2008-12-07 04:38 --------- d-----w c:\program files\Internet Download Manager
2008-12-06 20:29 161,892 ----a-w c:\windows\system32\drivers\mon_ac_w.bin
2008-12-06 20:29 149,632 ----a-w c:\windows\system32\drivers\gwausb.sys
2008-12-06 16:18 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-06 16:18 --------- d-----w c:\program files\AGEIA Technologies
2008-12-06 16:16 --------- d-----w c:\program files\Realtek
2008-12-06 16:16 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-06 14:17 --------- d-----w c:\program files\SystemRequirementsLab
2008-12-06 11:55 --------- d-----w c:\program files\Conexant
2008-12-06 10:01 96,976 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-06 10:01 87,855 ----a-w c:\windows\system32\drivers\klick.dat
2008-12-06 10:00 --------- d-----w c:\program files\Kaspersky Lab
2008-12-06 09:59 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-06 09:54 --------- d-----w c:\program files\microsoft frontpage
2008-11-11 17:58 25,601 ----a-w c:\windows\system32\drivers\klopp.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [12/06/2008 06:31 PM 2745776]
"vamsoft"="c:\windows\system32\vamsoft.exe" [12/13/2008 07:25 AM 108526]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [10/07/2008 01:33 PM 13574144]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [12/07/2008 07:25 AM 180269]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [12/12/2008 04:30 PM 136600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\AHMED\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2008-11-20 2986320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"VIDC.ACDV"= ACDV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 07/24/2008 05:02 PM 490952 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]
--------- 12/06/2008 10:29 PM 90112 c:\program files\Conexant\Adsl\dslagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLSTATEXE]
--------- 12/06/2008 10:29 PM 376832 c:\program files\Conexant\Adsl\DslStat.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FixCamera]
--a------ 07/11/2007 04:09 PM 20480 c:\windows\FixCamera.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 12/06/2008 06:31 PM 2745776 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 10/07/2008 01:33 PM 13574144 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 10/07/2008 01:33 PM 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp325]
--a------ 05/10/2007 01:18 PM 835584 c:\windows\vsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 12/07/2008 07:25 AM 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsnp325]
--a------ 04/21/2007 09:36 AM 270336 c:\windows\tsnp325.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 08/30/2007 05:43 PM 4670704 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 10/07/2008 01:33 PM 1630208 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\DRIVERS\snp325.sys [2008-12-07 10387840]
.
.
------- Supplementary Scan -------
.
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {E047D2CA-6F51-4F01-AF84-7434F37E0EE2} = 213.244.72.31 212.14.234.36
c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com//DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
FF - ProfilePath - c:\documents and settings\AHMED\Application Data\Mozilla\Firefox\Profiles\u0oclr6c.default\
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2008-12-13 18:48:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\vbsdfe0.dll 85504 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 12/13/2008 18:50:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-13 16:50:07
Pre-Run: 7,978,336,256 bytes free
Post-Run: 7,961,985,024 bytes free
185
توقيع : عين الاسد
تأييد
0
فارس الملاك
زيزوومى محترف
غير متصل
عزيزي تم حذفه بنجااح
احذف هذه القيم من الهايجاك
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O17 - HKLM\System\CCS\Services\Tcpip\..\{E047D2CA-6F51-4F01-AF84-7434F37E0EE2}: NameServer =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
الان اعمل اعادة تشغيل لجهازك وشووف الوضع
توقيع : فارس الملاك
تأييد
0
فارس الملاك
زيزوومى محترف
غير متصل
عزيزي الكومبو تسوي فحص وتنظيف تلقائي
الحين اعمل اعادة تشغيل وعطنا النتيجة
توقيع : فارس الملاك
تأييد
0
فارس الملاك
زيزوومى محترف
غير متصل
عزيزي احذف الملف يدوي
c:\windows\system32\vbsdfe0.dll
واذا ماضبط
ادخل على الوضع الامن وشغل اداة الكومبو
توقيع : فارس الملاك
تأييد
0