السلام عليكم
اعذروني على اللقافه
انا طلع لي كلام كثير
******** 09-02-01.01 - A 02/02/2009 7:39:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1270.949 [GMT 3:00]
Running from: c:\documents and settings\A\My Documents\Downloads\Programs\********.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\docume~1\A\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\A\LOCALS~1\Temp\tmp2.tmp
c:\recycler\S-8-9-51-100012002-100032325-100015196-9741.com
c:\windows\system32\drivers\gaopdxciyxympp.sys
c:\windows\system32\drivers\gaopdxlkyxevsm.sys
c:\windows\system32\drivers\gaopdxoirkcxdy.sys
c:\windows\system32\drivers\gaopdxrirnswui.sys
c:\windows\system32\gaopdxpcdmtnbo.dll
c:\windows\system32\kakle.dll
D:\Autorun.inf
d:\recycler\S-1-1-85-100005635-100018552-100025188-1439.com
d:\recycler\S-5-4-55-100012249-100008813-100020080-7121.com
d:\recycler\S-8-2-89-100029739-100026312-100025800-6654.com
d:\recycler\S-8-9-51-100012002-100032325-100015196-9741.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_gaopdxserv.sys
((((((((((((((((((((((((( Files Created from 2009-01-02 to 2009-02-02 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-02 04:24 --------- d-----w c:\documents and settings\A\Application Data\DMCache
2009-02-02 04:07 --------- d-----w c:\documents and settings\A\Application Data\IDM
2009-02-01 17:38 --------- d-----w c:\program files\Internet Download Manager
2009-02-01 17:14 --------- d-----w c:\program files\Eidos Interactive
2009-02-01 16:28 16,968 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-02-01 16:28 1,899,552 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-01 14:53 548,896 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-02-01 14:53 4,004 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-02-01 05:20 --------- d-----w c:\program files\JAP
2009-02-01 03:18 --------- d-----w c:\documents and settings\All Users\Application Data\Trymedia
2009-01-31 21:46 --------- d-----w c:\program files\Eazel-FR
2009-01-31 20:36 --------- d-----w c:\program files\Conduit
2009-01-31 20:20 --------- d-----w c:\program files\ma-config.com
2009-01-31 20:19 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-01-31 18:58 --------- d-----w c:\program files\SystemRequirementsLab
2009-01-31 16:24 --------- d-----w c:\program files\Yahoo!
2009-01-31 16:21 --------- d-----w c:\program files\Equis
2009-01-31 13:09 --------- d--h--r c:\documents and settings\A\Application Data\SecuROM
2009-01-31 13:08 108,144 ----a-w c:\windows\system32\CmdLineExt.dll
2008-12-26 17:09 15,781 ----a-w c:\windows\system32\drivers\mdc8021x.sys
2008-12-18 00:50 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-18 00:50 --------- d-----w c:\program files\STOIK
2008-12-13 00:02 --------- d-----w c:\program files\MSXML 4.0
2008-12-12 18:03 294,912 ----a-w c:\windows\HideWin.exe
2008-12-12 18:02 --------- d-----w c:\program files\Realtek
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-03 21:01 --------- d-----w c:\program files\JavaSoft
2008-11-25 09:04 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-11-24 19:11 90,112 ----a-w c:\windows\system32\agsaami.dll
2008-11-24 19:11 610,304 ----a-w c:\windows\system32\agsaamg.dll
2008-11-24 19:11 372,736 ----a-w c:\windows\system32\agsaamc.dll
2008-11-24 19:11 2,535,424 ----a-w c:\windows\system32\agsaamj.dll
2008-11-24 19:11 196,608 ----a-w c:\windows\system32\maag.dll
2008-11-24 19:11 1,986,560 ----a-w c:\windows\system32\akll.dll
2008-11-24 19:11 1,245,184 ----a-w c:\windows\system32\bkll.dll
2008-11-24 19:11 1,212,416 ----a-w c:\windows\system32\ckll.dll
2008-11-24 18:39 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-24 18:39 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-11-24 18:37 90,112 ----a-w c:\windows\system32\ALOAudioFormatSettings3.dll
2008-11-24 18:37 877,568 ----a-w c:\windows\system32\ALOAudioFile2.dll
2008-11-24 18:37 780,288 ----a-w c:\windows\system32\ALOVideoCompress.dll
2008-11-24 18:37 778,240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
2008-11-24 18:37 495,104 ----a-w c:\windows\system32\ALOVideoCoreM.dll
2008-11-24 18:37 403,968 ----a-w c:\windows\system32\ALOWMAFile2.dll
2008-11-24 18:37 382,464 ----a-w c:\windows\system32\ALOAVIFile.dll
2008-11-24 18:37 249,856 ----a-w c:\windows\system32\ALOQuickTimeFile.dll
2008-11-24 18:37 215,552 ----a-w c:\windows\system32\ALOWMVFile.dll
2008-11-24 18:37 2,846,720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
2008-11-24 18:37 188,416 ----a-w c:\windows\system32\ALOVideoFile.dll
.
------- Sigcheck -------
04/14/2008 06:59 PM 295424 58e202572d3251bf2687bf841ea00ce0 c:\windows\SoftwareDistribution\Download\77e1a3fb8567f1a6b8356307f10dd606\termsrv.dll
08/04/2004 01:56 AM 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\system32\termsrv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [07/29/2008 05:18 PM 2610608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [11/25/2008 12:04 PM 136600]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/24/2008 09:39 PM 185896]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [06/25/2006 04:43 PM 53248]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-16 577597]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.3iv2"= c:\progra~1\K-LITE~1\codecs\3IVXVF~1.DLL
"VIDC.VP60"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP61"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP62"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP70"= c:\progra~1\K-LITE~1\codecs\vp7vfw.dll
"VIDC.VP31"= c:\progra~1\K-LITE~1\codecs\vp31vfw.dll
"VIDC.FFDS"= c:\progra~1\K-LITE~1\ffdshow\ff_vfw.dll
"msacm.ac3acm"= c:\progra~1\K-LITE~1\codecs\ac3acm.acm
"msacm.l3fhg"= c:\progra~1\K-LITE~1\codecs\l3codecp.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]
-r------- 06/25/2006 04:43 PM 53248 c:\program files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 12:56 AM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
-ra------ 06/25/2006 04:42 PM 77824 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
-ra------ 06/25/2006 04:42 PM 94208 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 12/05/2006 10:55 PM 54832 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
-ra------ 06/25/2006 04:42 PM 114688 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 11/23/2006 03:10 PM 56928 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rtlupd]
--------- 06/25/2006 04:43 PM 344064 c:\program files\Realtek\InstallShield\RtlUpd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 11/24/2008 09:39 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--------- 01/07/2005 05:07 PM 61952 c:\windows\system32\HdAShCut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\A\\My Documents\\Downloads\\Programs\\PraetoriansSetup\\praetorians.exe"=
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-01-24 216232]
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - (no file)
BHO-{a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - (no file)
Toolbar-{a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - (no file)
MSConfigStartUp-RegCom32 - c:\docume~1\A\LOCALS~1\Temp\Setup.exe
MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2095689
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 127.0.0.1:4001
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-02-02 07:48:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-515967899-789336058-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:fc,56,a5,04,b3,64,23,4f,1e,fc,46,dc,a3,21,2a,37,de,77,b6,e4,30,ed,b1,
af,71,9b,d2,3c,fd,b4,2c,0d,00,e2,50,08,cd,1d,9b,d8,2d,1a,ee,6a,32,a0,96,d5,\
"??"=hex:75,d6,67,c4,ec,66,15,e0,65,d7,70,03,a3,6c,02,9e
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\COMRes.dll
.
Completion time: 02/02/2009 7:52:07
********-quarantined-files.txt 2009-02-02 04:51:46
Pre-Run: 41,702,174,720 bytes free
Post-Run: 42,299,924,480 bytes free
191 --- E O F --- 2009-02-01 22:56:09
ياليت اخوي البرونز تلاقي لي حل
k: