..
عطل برامج الحماية وشغل الأداة
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى
هلا اخوي حملت الاداة وشغلتها وبعد ما انتهى كل شي طلع لي هالتقرير
ComboFix 09-03-06.02 - s 03/07/2009 22:12:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.502.241 [GMT -8:00]
Running from: c:\documents and settings\s\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\IE4 Error Log.txt
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2009-02-08 to 2009-03-08 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-07 05:25 --------- d-----w c:\documents and settings\s\Application Data\ACD Systems
2009-03-04 08:11 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-04 05:00 9,644 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-04 05:00 827,936 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-04 05:00 213,024 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-03-04 05:00 1,808 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-03-04 04:58 282,624 ----a-w c:\windows\system32\igfxtray.exe
2009-03-04 01:25 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-04 01:17 --------- d-----w c:\program files\Microsoft Works
2009-03-04 01:16 --------- d-----w c:\program files\MSBuild
2009-03-03 20:34 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-03-03 20:34 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-03-03 20:34 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-03-03 08:48 --------- d-----w c:\program files\Kaspersky Lab
2009-03-03 08:47 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-02-28 20:06 --------- d-----w c:\program files\MSECache
2009-02-25 20:32 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-25 20:16 --------- d-----w c:\documents and settings\s\Application Data\vlc
2009-02-25 20:15 --------- d-----w c:\documents and settings\s\Application Data\DivX
2009-02-24 03:03 --------- d-----w c:\program files\Golden Al-Wafi Translator
2009-02-24 03:02 73,216 ----a-w c:\windows\ST6UNST.EXE
2009-02-24 03:02 172,032 ------w c:\windows\Setup1.exe
2009-02-24 03:02 155,995 ----a-w c:\windows\java\Packages\AQ7ZTN9F.ZIP
2009-02-24 03:02 --------- d-----w c:\program files\VideoLAN
2009-02-24 03:00 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-02-24 02:59 --------- d-----w c:\program files\CyberLink
2009-02-24 02:58 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-24 02:58 --------- d-----w c:\program files\DivX
2009-02-24 02:57 --------- d-----w c:\program files\MSN Messenger
2009-02-24 02:56 --------- d-----w c:\program files\Common Files\Adobe
2009-02-24 02:54 --------- d-----w c:\program files\Common Files\Macromedia
2009-02-24 02:53 --------- d-----w c:\program files\Macromedia
2009-02-24 02:52 --------- d-----w c:\program files\Common Files\ACD Systems
2009-02-24 02:52 --------- d-----w c:\program files\ACD Systems
2009-02-24 02:52 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-02-24 01:56 --------- d-----w c:\program files\CONEXANT
2009-02-24 01:37 --------- d-----w c:\program files\WIDCOMM
2009-02-24 01:35 --------- d-----w c:\program files\SigmaTel
2009-02-23 22:51 --------- d-----w c:\program files\Mobily Connect Card
2009-02-23 21:53 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1737216]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [05/23/2004 03:00 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [03/03/2009 08:58 PM 282624]
"igfxpers"="c:\windows\system32\igfxpers.exe" [12/13/2005 06:45 AM 118784]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [12/13/2005 06:41 AM 159744]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [05/11/2007 03:06 AM 109680]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM 31016]
"SigmatelSysTrayApp"="stsystra.exe" [03/24/2006 06:30 AM 356352 c:\windows\stsystra.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [05/23/2004 03:00 AM 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-02-23 187392]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 700477]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe"=
"c:\\WINDOWS\\stsystra.exe"=
"c:\\Program Files\\Mobily Connect Card\\Mobily Connect Card.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\WINDOWS\\system32\\netsh.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Program Files\\Common Files\\ACD Systems\\EN\\DevDetect.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Calibration\\Adobe Gamma Loader.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\ComboFix\\NirCmd.cfexe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9252:TCP"= 9252:TCP:WWW
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\hufomn.sys --> c:\windows\system32\drivers\hufomn.sys [?]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
S2 lgxwz;lgxwz;c:\windows\system32\svchost.exe -k netsvcs [2004-05-23 14336]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
lgxwz
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e71f14-0219-11de-99a2-0015c5bd718b}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe Sgt.sys.vbs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e71f15-0219-11de-99a2-0015c5bd718b}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe Sgt.sys.vbs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c84b662-01fc-11de-9213-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c84b665-01fc-11de-9213-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c84b666-01fc-11de-9213-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c84b667-01fc-11de-9213-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{812602ac-0b05-11de-9235-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{812602ad-0b05-11de-9235-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{812602ae-0b05-11de-9235-0019b956a40f}]
\Shell\AutoRun\command - F:\AutoRun.exe
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Device Detector - DevDetect.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-07 22:14:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\ACD Systems\EN\DevDetect.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
.
**************************************************************************
.
Completion time: 03/07/2009 22:16:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-08 06:16:44
Pre-Run: 55,530,160,128 bytes free
Post-Run: 55,520,538,624 bytes free
194
