عملت كل اللي طلبته وهذا التقرير اللي ظهر لي
ComboFix 09-03-25.03 - Good 03/26/2009 16:18:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1270.890 [GMT 3:00]
Running from: c:\documents and settings\Good\سطح المكتب\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1.exe
c:\docume~1\Good\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\Good\Application Data\addon.dat
C:\k.exe
c:\windows\IE4 Error Log.txt
c:\windows\service.exe
c:\windows\sys32.exe
c:\windows\system\13.exe
c:\windows\system32\bhjbhigb.dll
c:\windows\system32\ddcBRHWO.dll
c:\windows\system32\eswnngce.ini
c:\windows\system32\hgGaxutQ.dll
c:\windows\system32\khfDuRkK.dll
c:\windows\system32\KkRuDfhk.ini
c:\windows\system32\KkRuDfhk.ini2
c:\windows\winudpmgr.exe
.
((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 13:25 9,236,512 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-26 13:25 104,960 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-26 11:43 61,440 ----a-w c:\windows\system32\bfufwdwq.exe
2009-03-25 19:50 --------- d-----w c:\program files\SpywareRemover2009
2009-03-25 14:56 --------- d-----w c:\program files\VirusRemover2009
2009-03-25 12:21 163,840 ----a-w C:\execs.exe
2009-03-25 12:12 135,171 ----a-w C:\exec.exe
2009-03-25 11:53 --------- d-----w c:\documents and settings\Good\Application Data\Logs
2009-03-25 11:47 --------- d-----w c:\documents and settings\All Users\Application Data\SpywareRemover2009
2009-03-14 07:29 --------- d-----w c:\documents and settings\Good\Application Data\Media Player Classic
2009-03-14 07:24 77,830 --sh--r c:\windows\winsvc32.exe
2009-03-14 07:24 77,830 ----a-w C:\win32tmp.exe
2009-03-13 13:55 41,990 ----a-w C:\win.exe
2009-03-08 12:22 --------- d-----w c:\documents and settings\Good\Application Data\vlc
2009-03-08 12:11 163,909 ----a-w c:\windows\ftp.exe
2009-03-08 12:10 41,990 --sh--r c:\windows\sysinfomgr.exe
2009-03-07 22:20 --------- d-----w c:\program files\FormatFactory
2009-02-27 22:57 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-28 10:23 42,311 -csha-w c:\windows\LaVozR\logg.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [10/14/2004 09:11 AM 1388544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [02/08/2005 07:38 PM 159744]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [12/03/2004 01:24 PM 290816]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [05/04/2005 10:59 AM 794624]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [12/21/2007 08:21 AM 1443072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [09/27/2008 01:17 PM 185896]
"AGRSMMSG"="AGRSMMSG.exe" [04/13/2005 01:12 PM 88209 c:\windows\AGRSMMSG.exe]
"System Information Manager"="sysinfomgr.exe" [03/08/2009 03:10 PM 41990 c:\windows\sysinfomgr.exe]
"winsvc32"="winsvc32.exe" [03/14/2009 10:24 AM 77830 c:\windows\winsvc32.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-05-31 577597]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 12:56 AM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
-ra--c--- 02/08/2005 01:32 PM 126976 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
-ra--c--- 02/08/2005 01:36 PM 155648 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
-----c--- 04/13/2006 11:09 AM 49152 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
-----c--- 12/07/2005 10:57 PM 30208 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 09/27/2008 01:17 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800]
R1 is-70JRHdrv;is-70JRHdrv;c:\windows\system32\drivers\
01532963.sys [2009-03-26 00:10:05 148496]
R1 is-80SJBdrv;is-80SJBdrv;c:\windows\system32\drivers\78792618.sys [2009-03-25 148496]
R1 is-H6P0Pdrv;is-H6P0Pdrv;c:\windows\system32\drivers\33749348.sys [2009-03-25 148496]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{79D56B59-2CDB-EF27-DD6C-48815D9AC8BB}]
c:\windows\LaVozR\LaVozR s
.
- - - - ORPHANS REMOVED - - - -
BHO-{B12B0C90-0624-4050-B884-7E95075D3F84} - c:\windows\system32\khfDuRkK.dll
HKLM-Run-e8863444 - c:\windows\system32\ecgnnwse.dll
HKLM-Run-msngr.exe - sys32.exe
MSConfigStartUp-Device Detector - DevDetect.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com.sa/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-03-26 16:30:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\HPQ\shared\hpqwmi.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 03/26/2009 16:35:43 - machine was rebooted [Good]
ComboFix-quarantined-files.txt 2009-03-26 13:35:07
Pre-Run: 29,236,473,856 bytes free
Post-Run: 29,226,631,168 bytes free
148
