مشكلة winfile.jpg مازالت قائمة

[hammadco]

:no::no::no:
:b::b::b:
السلام عليكم ورحمة الله وبركاته

مازالت مشكلة الفيروس المقرف قائمة بجهازي رغم جهود عمالقة زيزوم الاشاوس
في حل المشكلة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

المشكلة حلت من جهة الاخوة ولكن عند البحث ببرنامج البحث ايفا اجد الفيروس
و وكل ما احذفه تعود مرة اخرى

والصورة توضح

ComboFix 09-02-21.01 - hammadco 02/24/2009 19:45:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.2038.1539 [GMT 2:00]
Running from: c:\documents and settings\hammadco\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
c:\program files\Bifrost
c:\program files\Bifrost\server.exe
c:\windows\system32\1.txt
c:\windows\system32\d3d10_1.dll
c:\windows\system32\d3d10_1core.dll
c:\windows\system32\d3d10core.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\kernel32new.dll
c:\windows\system32\msvcrtnew.dll
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
G:\Autorun.inf
H:\Autorun.inf
I:\Autorun.inf
J:\Autorun.inf
K:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 17:54 --------- d-----w c:\documents and settings\hammadco\Application Data\AvaFind Data
2009-02-24 17:53 --------- d-----w c:\program files\Bifrost
2009-02-24 17:53 --------- d-----w c:\documents and settings\hammadco\Application Data\Skype
2009-02-24 17:52 --------- d-----w c:\documents and settings\hammadco\Application Data\DMCache
2009-02-24 17:51 19,235,360 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-24 17:49 730,144 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-02-24 17:49 61,808 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-02-24 17:49 271,880 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-02-24 17:42 32,637 ----a-w c:\windows\system32\winxp.exe
2009-02-24 17:08 --------- d-----w c:\program files\AV VCS 3.0
2009-02-24 17:08 --------- d-----w c:\documents and settings\hammadco\Application Data\skypePM
2009-02-24 17:07 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-02-23 21:41 --------- d-----w c:\program files\Maknoon Islamic Encyclopedia
2009-02-23 15:20 --------- d-----w c:\documents and settings\hammadco\Application Data\Media Player Classic
2009-02-23 14:49 --------- d-----w c:\program files\K-Lite Codec Pack
2009-02-20 21:18 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-20 21:18 --------- d-----w c:\program files\QuickTime
2009-02-20 18:25 --------- d-----w c:\program files\DVB-S PowerInstall
2009-02-20 07:42 74,752 ----a-w c:\windows\ST6UNST.EXE
2009-02-20 07:42 290,816 ------w c:\windows\Setup1.exe
2009-02-20 07:42 --------- d-----w c:\program files\برنامج المستشار الفلكي
2009-02-19 22:10 --------- d-----w c:\documents and settings\hammadco\Application Data\Ancient Quest of Saqqarah__cminion
2009-02-19 22:01 --------- d-----w c:\program files\Ancient Quest of Saqqarah
2009-02-19 22:01 --------- d-----w c:\documents and settings\hammadco\Application Data\StoneLoops!
2009-02-19 22:01 --------- d-----w c:\documents and settings\hammadco\Application Data\Saqqarah
2009-02-19 22:01 --------- d-----w c:\documents and settings\hammadco\Application Data\MagicMatch
2009-02-19 19:28 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-02-19 17:51 --------- d-----w c:\program files\myBabylon_English
2009-02-19 17:39 --------- d-----w c:\program files\PowerISO
2009-02-19 17:38 --------- d-----w c:\documents and settings\hammadco\Application Data\ImTOO Software Studio
2009-02-19 17:35 --------- d-----w c:\program files\ImTOO
2009-02-19 17:27 --------- d-----w c:\program files\Windows Live
2009-02-19 17:27 --------- d-----w c:\program files\MSN Messenger
2009-02-19 17:27 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-19 17:27 --------- d-----w c:\program files\Circle Develoement
2009-02-19 17:23 --------- d-----w c:\program files\Conduit
2009-02-19 17:22 --------- d-----w c:\program files\Common Files\Skype
2009-02-19 17:22 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-02-19 17:22 --------- d-----r c:\program files\Skype
2009-02-19 17:19 728,858 ----a-w c:\program files\Common Files\unins000.exe
2009-02-19 17:19 2,529 ----a-w c:\program files\Common Files\unins000.dat
2009-02-19 17:09 --------- d-----w c:\documents and settings\hammadco\Application Data\uTorrent
2009-02-19 17:00 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-02-19 16:03 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-16 17:22 --------- d-----w c:\program files\Project1
2009-02-15 17:08 44,132 ----a-w c:\windows\system32\xFile.ExE
2009-02-15 13:52 --------- d-----w c:\program files\iMesh Applications
2009-02-15 13:51 --------- d-----w c:\documents and settings\All Users\Application Data\DriverCure
2009-02-15 13:50 --------- d-----w c:\program files\Monster Trucks Nitro Demo
2009-02-15 13:48 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-14 15:08 --------- d-----w c:\program files\LingvoSoft
2009-02-14 15:07 --------- d-----w c:\documents and settings\hammadco\Application Data\Ectaco
2009-02-14 13:42 --------- d-----w c:\documents and settings\hammadco\Application Data\Bifrost
2009-02-14 12:55 9,728 --sha-w c:\program files\Thumbs.db
2009-02-14 12:55 --------- d-----w c:\program files\Windows Media Connect 2
2009-02-14 12:55 --------- d-----w c:\program files\eMule
2009-02-14 12:55 --------- d-----w c:\program files\ACDSee32
2009-02-13 21:38 --------- d-----w c:\documents and settings\hammadco\Application Data\DriverCure
2009-02-13 21:38 --------- d-----w c:\documents and settings\All Users\Application Data\ParetoLogic
2009-02-12 17:43 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-12 17:43 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-02-11 16:27 --------- d-----w c:\program files\PC-TV
2009-02-11 16:10 --------- d-----w c:\program files\ProjektIGI
2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 18:33 --------- d-----w c:\documents and settings\hammadco\Application Data\vlc
2009-02-09 18:32 --------- d-----w c:\program files\VideoLAN
2009-02-09 11:44 --------- d-----w c:\program files\pf-studio
2009-02-09 11:32 --------- d-----w c:\documents and settings\hammadco\Application Data\New Technology Studio
2009-02-09 10:46 --------- d-----w c:\documents and settings\hammadco\Application Data\Offline Explorer
2009-02-09 10:44 --------- d-----w c:\program files\Offline Explorer Pro
2009-02-09 10:14 --------- d-----w c:\program files\OPENSKY
2009-02-05 22:48 --------- d-----w c:\program files\WinPcap
2009-02-05 21:29 --------- d-----w c:\program files\Chinese Symbol Studio
2009-02-05 21:29 --------- d-----w c:\documents and settings\All Users\Application Data\WildTangent
2009-02-05 21:25 --------- d-----w c:\program files\D-Link
2009-02-05 19:48 --------- d-----w c:\program files\Any Audio Converter
2009-02-05 13:36 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-05 13:36 --------- d-----w c:\program files\Java
2009-02-05 13:14 72,687 ----a-w c:\program files\plyar.vbs
2009-02-05 12:32 34,488 ----a-w c:\documents and settings\hammadco\Application Data\GDIPFONTCACHEV1.DAT
2009-02-05 11:15 --------- d-----w c:\program files\Common Files\xing shared
2009-02-05 11:15 --------- d-----w c:\program files\Common Files\Real
2009-02-05 11:14 499,712 ----a-w c:\windows\system32\msvcp71.dll
2009-02-05 11:14 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-02-04 14:16 --------- d-----w c:\program files\Google
2009-02-03 21:34 --------- d-----w c:\documents and settings\hammadco\Application Data\GTunnel
2009-02-02 21:49 --------- d-----w c:\program files\Common Files\Adobe
2009-02-02 21:48 --------- d-----w c:\documents and settings\hammadco\Application Data\InterTrust
2009-02-02 21:46 --------- d-----w c:\program files\Yahoo!
2009-02-02 17:13 --------- d-----w c:\documents and settings\hammadco\Application Data\Orbit
2009-02-02 10:49 --------- d-----w c:\program files\DivX Subtitle Displayer
2009-02-01 14:08 --------- d-----w c:\documents and settings\hammadco\Application Data\GrabPro
2009-01-31 14:51 535,040 ----a-w c:\windows\flashax.exe
2009-01-31 14:51 12,288 ----a-w c:\windows\impborl.dll
2009-01-30 22:19 --------- d-----w c:\documents and settings\hammadco\Application Data\Styler
2009-01-30 22:10 --------- d-----w c:\documents and settings\All Users\Application Data\CA
2009-01-30 16:39 --------- d-----w c:\program files\BT Engine
2009-01-30 14:03 30,208 ----a-w c:\windows\system32\borlndmm.dll
2009-01-30 14:03 --------- d-----w c:\program files\FieryAds
2009-01-30 09:31 --------- d-----w c:\program files\GameTop.com
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}"= "c:\program files\myBabylon_English\tbmyBa.dll" [11/23/2008 11:03 PM 1784856]
[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
09/02/2008 04:04 PM 398768 --a------ c:\program files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
11/23/2008 11:03 PM 1784856 --a------ c:\program files\myBabylon_English\tbmyBa.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}"= "c:\program files\myBabylon_English\tbmyBa.dll" [11/23/2008 11:03 PM 1784856]
[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7}"= "c:\program files\myBabylon_English\tbmyBa.dll" [11/23/2008 11:03 PM 1784856]
[HKEY_CLASSES_ROOT\clsid\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 05:59 PM 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5674352]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [02/24/2009 07:42 PM 835584]
"AvaFind"="c:\program files\AvaFind\AvaFind.exe" [06/01/2004 12:48 PM 295936]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [01/29/2009 02:01 PM 23975720]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [04/14/2008 05:59 PM 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [02/28/2008 03:00 PM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [02/28/2008 03:00 PM 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [02/28/2008 03:00 PM 137752]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [02/05/2009 01:14 PM 185872]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [02/05/2009 03:36 PM 136600]
"DSLSTATEXE"="c:\program files\D-Link\DSL-200\dslstat.exe" [08/21/2007 12:10 PM 344064]
"DSLAGENTEXE"="c:\program files\D-Link\DSL-200\dslagent.exe" [08/21/2007 12:10 PM 65536]
"CTFMON"="c:\windows\system32\wscript.exe" [05/08/2008 01:24 PM 155648]
"regdiit"="c:\windows\system32\winxp.exe" [02/24/2009 07:54 PM 32637]
"Sys"="c:\program files\Outlook Express\data\data\Explore.exe" [02/14/2009 10:44 AM 20480]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [11/02/2008 10:38 AM 167936]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [02/08/2008 06:36 PM 227856]
"SkyTel"="SkyTel.EXE" [10/11/2007 11:04 AM 1826816 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [10/16/2007 06:30 PM 16855552 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 05:59 PM 15360]
c:\documents and settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2009-02-02 49254]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-01-27 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
WinManager.lnk - c:\program files\PC-TV\WinManager\WinManager.exe [2009-02-11 53248]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dwwinxp.exe]
"Debugger"=c:\windows\system32\winxp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\MSConfig.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\procexp.exe]
"Debugger"=\winxp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\regedit.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\rstrui.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\taskmgr.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7777:UDP"= 7777:UDP:µTorrent
"7777:TCP"= 7777:TCP:µTorrent
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2009-01-26 13696]
R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [2009-01-31 6852]
R3 DtvAudio;DtvAudio;c:\windows\system32\drivers\DtvAudio.sys [2006-10-11 10330]
R3 DtvVideo;DtvVideo;c:\windows\system32\drivers\DtvVideo.sys [2006-10-11 26730]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-12-13 24592]
S3 GFltDrv;GFltDrv;\??\c:\documents and settings\hammadco\Application Data\GTunnel\GFltDrv.sys --> c:\documents and settings\hammadco\Application Data\GTunnel\GFltDrv.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 VPNET;DTVNet Ethernet Controller;c:\windows\system32\drivers\DTVNet.sys [2008-12-29 19712]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1a19f902-fc3f-11dd-9535-0015e9300101}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{654196b6-ebbe-11dd-af50-806d6172696f}]
\Shell\AutoRun\command - G:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7298b8bb-fda1-11dd-88b1-0015e9300101}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97966f7e-ff58-11dd-88bc-0015e9300101}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e41c125e-fe1f-11dd-88b4-0015e9300101}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Wscript.exe /e:vbs winfile.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3D42BB4A-CD37-7167-92FC-C2F60184BC8A}]
c:\windows\system32\xFile.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}]
c:\program files\Bifrost\server.exe s
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{AE99F3EC-D22F-A3AE-E72D-AFB20BC51006}]
c:\downloads\looooooool sextv- view sex.exe
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-DriverCure - c:\program files\ParetoLogic\DriverCure\DriverCure.exe
HKLM-Run-Explorer.exe - c:\downloads\looooooool sextv- view sex.exe
HKLM-Run-wsaecmt - c:\windows\wsaecmt.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

IE: + Offline &Explorer: Download the link -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

files\Offline Explorer Pro\Add_UrlO.htm
IE: + Offline E&xplorer: Download the current page -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

files\Offline Explorer Pro\Add_AllO.htm
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {2CE7A4EE-4AB7-428E-80AC-E68DE5A62CA4} = 213.244.72.31 212.14.234.36
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-02-24 19:50:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Explorer.exe = c:\downloads\looooooool sextv- view sex.exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-682003330-113007714-2146976231-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A9A7E4E6-BAFD-98A0-7E8A-5FE2DC4542B3}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abmfedipjhepedibhfnfcnklgelejacipk"=hex:69,61,6d,61,68,6f,6d,70,6c,6b,67,62,
69,6d,6a,6c,6e,6c,00,00
"pacigflillinlnflijghakhnmoofcjfm"=hex:6a,61,66,61,65,68,6d,63,62,62,6e,6a,6a,
6c,63,66,65,70,6d,6f,00,f9
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):a6,2e,1f,06,fb,68,2d,13,93,14,10,36,f9,a4,b5,d0,56,9d,f7,26,db,
85,61,e0,e5,dc,7a,2a,26,74,6f,bb,57,9f,00,b2,66,c2,2f,54,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{c7df2a9e-3f34-417e-ac42-10b70bb9cb24}]
@Denied: (Full) (Everyone)
"Model"=dword:00000036
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,de,1a,92,62,91,09,2e,04,df,69,ae,6f,30,fa,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1320)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1376)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
- - - - - - - > 'explorer.exe'(3196)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 02/24/2009 19:57:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-24 17:57:41
Pre-Run: 10,750,803,968 bytes free
Post-Run: 11,073,327,104 bytes free
320 --- E O F --- 2009-02-12 07:14:26

وهذا كمان هيجك

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:45:34 م, on 25/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\D-Link\DSL-200\dslstat.exe
C:\Program Files\D-Link\DSL-200\dslagent.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\wscript.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\AvaFind\AvaFind.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
D:\Program Files\Adobe\Photoshop 7.0 ME\Photoshop.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\hammadco\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - F:\skynet_supersy.2.0_TwinHan\OK\video.rar\Styler\TB\StylerTB.dll (file missing)
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Explorer.exe] C:\downloads\looooooool sextv- view sex.exe
O4 - HKLM\..\Run: [wsaecmt] "C:\WINDOWS\wsaecmt.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\D-Link\DSL-200\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\D-Link\DSL-200\dslagent.exe
O4 - HKLM\..\Run: [CTFMON] C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [regdiit] C:\WINDOWS\system32\winxp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AvaFind] "C:\Program Files\AvaFind\AvaFind.exe" /minimized
O4 - HKCU\..\Run: [DriverCure] C:\Program Files\ParetoLogic\DriverCure\DriverCure.exe -scan
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Super Finder.lnk = C:\Program Files\FSL\SuperFinder\SuperFinder.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinManager.lnk = C:\Program Files\PC-TV\WinManager\WinManager.exe
O8 - Extra context menu item: + Offline &Explorer: Download the link -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\Offline Explorer Pro\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\Offline Explorer Pro\Add_AllO.htm
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2CE7A4EE-4AB7-428E-80AC-E68DE5A62CA4}: NameServer = 213.244.72.31 212.14.234.36
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
--
End of file - 9080 bytes