الله يعطيك العافية أخي زيزوم
هذا التقرير :
ComboFix 08-03-13.4 - mesh 03/23/2008 15:39:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.465 [GMT 3:00]
Running from: C:\Documents and Settings\mesh\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-23 to 2008-03-23 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-23 12:44 605,728 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-03-23 12:34 --------- d-----w C:\Documents and Settings\mesh\Application Data\DMCache
2008-03-23 12:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-23 12:32 98,276 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-23 12:32 6,861,600 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-23 12:32 59,756 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-03-23 12:19 --------- d-----w C:\Documents and Settings\mesh\Application Data\CyberScrub
2008-03-23 12:18 --------- d-----w C:\Documents and Settings\mesh\Application Data\cleaner
2008-03-21 08:30 --------- d-----w C:\Documents and Settings\mesh\Application Data\LimeWire
2008-03-20 22:24 --------- d-----w C:\Program Files\Iron Speed
2008-03-20 15:30 307,968 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe
2008-03-20 15:30 --------- d-----w C:\Documents and Settings\mesh\Application Data\TuneUp Software
2008-03-20 15:29 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-03-20 15:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-03-20 15:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-19 21:43 --------- d-----w C:\Program Files\KnightMare MSX Games Launcher
2008-03-19 21:39 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-03-19 21:39 286,720 ------w C:\WINDOWS\Setup1.exe
2008-03-19 10:10 --------- d-----w C:\Program Files\RegCure
2008-03-17 13:37 --------- d-----w C:\Program Files\security
2008-03-17 13:13 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-16 21:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-03-16 11:43 27,262,976 ----a-w C:\VIRTPART.DAT
2008-03-15 21:22 --------- d-----w C:\Documents and Settings\mesh\Application Data\IDM
2008-03-14 14:54 --------- d-----w C:\Program Files\Symantec
2008-03-14 14:45 --------- d-----w C:\Program Files\Real
2008-03-14 14:45 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-14 14:44 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-03-14 14:44 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-03-14 14:44 --------- d-----w C:\Program Files\Common Files\Real
2008-03-14 11:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-14 11:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\UDL
2008-03-14 11:01 --------- d-----w C:\Program Files\epson
2008-03-14 10:57 --------- d-----w C:\Program Files\Internet Download Manager
2008-03-14 10:56 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-13 16:21 --------- d-----w C:\Program Files\The KMPlayer
2008-03-13 14:30 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-13 14:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-11 20:31 --------- d-----w C:\Program Files\Web Publish
2008-03-11 20:18 --------- d-----w C:\Program Files\ReflexiveArcade
2008-03-11 20:18 --------- d-----w C:\Program Files\DDD Pool
2008-03-10 12:06 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-03-10 12:06 --------- d-----w C:\Documents and Settings\mesh\Application Data\Media Player Classic
2008-03-09 17:09 --------- d-----w C:\Documents and Settings\mesh\Application Data\Netscape
2008-03-09 17:08 --------- d-----w C:\Program Files\Photodex
2008-03-09 17:06 --------- d-----w C:\Documents and Settings\mesh\Application Data\Photodex
2008-03-09 12:30 --------- d-----w C:\Documents and Settings\mesh\Application Data\GRETECH
2008-03-08 17:20 --------- d-----w C:\Program Files\LimeWire
2008-03-08 17:04 --------- d-----w C:\Program Files\Java
2008-03-08 16:46 --------- d-----w C:\Program Files\Common Files\Java
2008-03-08 16:44 --------- d-----w C:\Program Files\Windows Live
2008-03-08 16:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-08 16:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-03-08 16:19 --------- d-----w C:\Program Files\iColorFolder
2008-03-08 06:47 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-03-08 06:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-03-08 06:00 --------- d-----w C:\Program Files\Nero
2008-03-08 06:00 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-08 05:51 --------- d-----w C:\Program Files\GRETECH
2008-03-08 05:50 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-08 04:46 --------- d-----w C:\Program Files\Microsoft.NET
2008-03-08 04:44 --------- d-----w C:\Program Files\Microsoft Works
2008-03-08 01:46 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-03-08 01:46 --------- d-----w C:\Program Files\Kaspersky Lab
2008-03-08 01:43 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-08 01:40 --------- d-----w C:\Program Files\Panasonic
2008-03-08 01:39 --------- d-----w C:\Program Files\Common Files\Panasonic
2008-03-08 01:33 --------- d-----w C:\Program Files\InterVideo
2008-03-08 01:32 --------- d-----w C:\Program Files\Common Files\aolshare
2008-03-08 01:31 --------- d-----w C:\Program Files\Quicken
2008-03-08 01:25 --------- d-----w C:\Documents and Settings\mesh\Application Data\URSoft
2008-02-27 10:15 28,416 ----a-w C:\WINDOWS\system32\uxtuneup.dll
2008-01-08 12:13 202,160 ----a-w C:\WINDOWS\system32\idmmbc.dll
.
------- Sigcheck -------
10/11/2007 02:47 AM 825344 0e5d918f87efa7d2424d66b499c7eb04 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
12/07/2007 05:01 AM 825344 b5b411bb229ae6ead7652a32ed47bfb9 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
08/04/2004 12:56 AM 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll
08/04/2004 12:56 AM 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\ie7\wininet.dll
11/07/2006 09:03 PM 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
10/11/2007 02:56 AM 824832 30c1e0f34ad2972c72a01db5c74ab065 C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
12/01/2007 12:26 AM 666112 e7f441cde6e418bb68fc700872c004a0 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
08/04/2004 12:56 AM 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\SoftwareDistribution\Download\c84908a2767c0fbfe0feb1d5a38cafb0\backup\wininet.dll
08/04/2004 12:56 AM 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\SoftwareDistribution\Download\d0fd1afe00cf6b5daf092ece0318bc6f\backup\wininet.dll
12/07/2007 05:21 AM 824832 806d274c9a6c3aaea5eae8e4af841e04 C:\WINDOWS\system32\wininet.dll
12/07/2007 05:21 AM 824832 806d274c9a6c3aaea5eae8e4af841e04 C:\WINDOWS\system32\dllcache\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [12/01/2007 12:26 AM 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [03/14/2008 01:51 PM 2577840]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [12/01/2007 12:26 AM 50176]
"00THotkey"="C:\WINDOWS\System32\
00THotkey.exe" [01/17/2003 08:41 PM 253952]
"000StTHK"="000StTHK.exe" [06/24/2001 06:28 AM 24576 C:\WINDOWS\system32\
000StTHK.exe]
"NvCplDaemon"="NvQTwk" []
"nwiz"="nwiz.exe" [08/16/2002 12:14 AM 438272 C:\WINDOWS\system32\nwiz.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [03/12/2003 09:59 PM 114688]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03/12/2003 09:56 PM 630784]
"TouchED"="C:\Program Files\TOSHIBA\TouchED\TouchED.Exe" [01/22/2003 04:00 AM 126976]
"Tpwrtray"="TPWRTRAY.EXE" [12/10/2002 08:49 PM 237568 C:\WINDOWS\system32\TPWRTRAY.EXE]
"TFNF5"="TFNF5.exe" [12/10/2002 07:26 PM 73728 C:\WINDOWS\system32\TFNF5.exe]
"TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [09/10/2002 01:07 AM 49152]
"NDSTray.exe"="C:\Program Files\Toshiba\ConfigFree\NDSTray.exe" [01/18/2003 06:26 AM 458752]
"TFncKy"="TFncKy.exe" []
"TDispVol"="TDispVol.exe" [02/26/2003 09:54 AM 73728 C:\WINDOWS\system32\TDispVol.exe]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [10/17/2002 11:21 PM 159744]
"TSysSMon"="c:\toshiba\sysstability\tsyssmon.exe" [02/26/2003 03:03 AM 49152]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [12/18/2007 11:43 AM 227856]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM 144784]
"SDaemon"="C:\WINDOWS\sdaemon.exe" [04/19/2005 12:57 AM 111104]
"SWd"="C:\WINDOWS\winwd.exe" [ ]
"ezShieldProtector for Px"="C:\WINDOWS\system32\ezSP_Px.exe" [08/20/2002 09:29 PM 40960]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/14/2008 05:44 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [12/01/2007 12:26 AM 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2003-05-19 22:57:27 151552]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"RestrictRun"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"RestrictRun"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3700 Series]
--a------ 02/08/2005 03:00 AM 98304 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostStartTrayApp]
--a------ 08/14/2002 03:21 PM 94208 C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh]
--a------ 11/25/2002 08:23 PM 172032 C:\Program Files\ltmoh\Ltmoh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 12/01/2007 12:26 AM 1695232 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 03/14/2008 05:44 PM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"ezShieldProtector for Px"=C:\WINDOWS\System32\ezSP_Px.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;C:\WINDOWS\system32\DRIVERS\TVALDX.SYS [08/18/2001 12:27 AM]
R0 TVALG;Toshiba Value Added Logical and General Purpose Device Driver;C:\WINDOWS\system32\DRIVERS\TVALG.SYS [09/14/2001 05:53 AM]
R0 WINSEC;WINSEC;C:\WINDOWS\system32\drivers\WINSEC.SYS [04/19/2005 12:57 AM]
R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [08/14/2002 03:11 PM]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [12/01/2007 12:26 AM]
R2 winser;winser;C:\WINDOWS\system32\winsersec.exe [04/14/2005 01:37 AM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/14/2007 12:28 AM]
R3 tsdhd;TOSHIBA SD Card Host Controller Driver;C:\WINDOWS\system32\DRIVERS\tsdhd.sys [02/11/2003 03:27 AM]
R3 wlags48b;Wireless LAN PCCard Driver;C:\WINDOWS\system32\DRIVERS\wlags48b.sys [06/29/2002 02:29 AM]
S3 BayTvKit;TOSHIBA Style Bay TV Tuner KiT Device;C:\WINDOWS\system32\DRIVERS\BayTvKit.sys [05/17/2003 01:40 AM]
S3 pciSd;pciSd;C:\WINDOWS\system32\DRIVERS\tossdpci.sys [02/12/2003 08:03 PM]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [03/20/2008 06:30 PM]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
*******s of the 'Scheduled Tasks' folder
"2008-03-23 12:33:34 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-03-23 12:33:34 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-03-19 09:40:48 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-03-23 15:44:22
Windows 5.1.2600 Service Pack 3, v.3264 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3264]
-> C:\WINDOWS\WSEC32HK.dll
-> C:\WINDOWS\system32\TDispVol.dll
.
Completion time: 03/23/2008 15:45:39
.
2008-03-13 21:08:42 --- E O F ---
