الخطوة الأولى تم تنفيذها وهذا التقرير الخاص بها
ComboFix 09-04-01.01 - الفارس 04/02/2009 9:58:13.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.958.723 [GMT 3:00]
Running from: c:\documents and settings\الفارس\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-03-02 to 2009-04-02 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-01 23:02 --------- d-----w c:\documents and settings\الفارس\Application Data\Skype
2009-04-01 23:02 --------- d-----w c:\documents and settings\الفارس\Application Data\Skype
2009-04-01 23:02 --------- d-----w c:\documents and settings\الفارس\Application Data\Skype
2009-04-01 22:22 --------- d-----w c:\documents and settings\الفارس\Application Data\skypePM
2009-04-01 22:22 --------- d-----w c:\documents and settings\الفارس\Application Data\skypePM
2009-04-01 22:22 --------- d-----w c:\documents and settings\الفارس\Application Data\skypePM
2009-04-01 22:09 --------- d-----w c:\documents and settings\All Users\Application Data\NortonInstaller
2009-03-31 21:42 --------- d-----w c:\program files\Google
2009-03-31 20:28 155,995 ----a-w c:\windows\java\Packages\FTND7FRX.ZIP
2009-03-31 19:42 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-03-31 19:36 --------- d-----w c:\program files\Yahoo!
2009-03-31 18:35 --------- d-----w c:\program files\Common Files\Skype
2009-03-31 18:35 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-03-31 18:35 --------- d-----r c:\program files\Skype
2009-03-31 13:28 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-31 13:28 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-31 13:28 --------- d-----w c:\documents and settings\الفارس\Application Data\Malwarebytes
2009-03-31 13:28 --------- d-----w c:\documents and settings\الفارس\Application Data\Malwarebytes
2009-03-31 13:28 --------- d-----w c:\documents and settings\الفارس\Application Data\Malwarebytes
2009-03-31 13:19 --------- d-----w c:\program files\S3
2009-03-31 13:19 --------- d-----w c:\program files\Driver
2009-03-31 13:18 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-31 13:18 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-31 13:10 --------- d-----w c:\program files\microsoft frontpage
2009-03-26 13:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 13:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
.
------- Sigcheck -------
08/04/2004 03:55 AM 654848 1e1cef80a11bdab92b2a83f885d214d5 c:\windows\NiwradSoft Shell Pack\Backup\wininet.dll
08/04/2004 03:55 AM 764928 885595b2ffe0b7f3506c8b00085959d0 c:\windows\system32\wininet.dll
08/04/2004 03:55 AM 764928 885595b2ffe0b7f3506c8b00085959d0 c:\windows\system32\dllcache\wininet.dll
08/04/2004 04:08 AM 2016768 0cbe3942657196cb871738e5d4a9da79 c:\windows\NiwradSoft Shell Pack\Backup\ntkrnlpa.exe
08/04/2004 04:08 AM 2178048 be7cf81f8ba4540526b087ceb75133ac c:\windows\system32\ntkrnlpa.exe
08/04/2004 03:48 AM 2149888 10ac039a4734d143a84763aebacbcd89 c:\windows\NiwradSoft Shell Pack\Backup\ntoskrnl.exe
08/04/2004 03:48 AM 2311168 db3869f92322bf223e69da1033f58fbe c:\windows\system32\ntoskrnl.exe
08/04/2004 03:56 AM 1538048 0869aabec6c4bd0a7fa28581d57bcb23 c:\windows\explorer.exe
08/04/2004 03:56 AM 1029632 18e34243216f744fcfebaa0851881b7e c:\windows\NiwradSoft Shell Pack\Backup\explorer.exe
08/04/2004 03:56 AM 1538048 0869aabec6c4bd0a7fa28581d57bcb23 c:\windows\system32\dllcache\explorer.exe
08/04/2004 03:56 AM 110592 db229dfb518b42754a510c5e101fa70f c:\windows\NiwradSoft Shell Pack\Backup\wuauclt.exe
08/04/2004 03:56 AM 115712 78d1c9c1378ecb5d443e098ea08226e8 c:\windows\system32\wuauclt.exe
08/04/2004 03:56 AM 115712 78d1c9c1378ecb5d443e098ea08226e8 c:\windows\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [11/30/2006 09:49 PM 4662776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [09/21/2006 04:36 PM 53248 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [02/06/2007 07:30 AM 176128 c:\windows\system32\VTTrayp.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2009-03-31 13696]
S2 gupdate1c9b2495717edb4;خدمة تحديث Google (gupdate1c9b2495717edb4);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-01 133104]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4c69f0a-1e3b-11de-a4ab-00e04d49c821}]
\Shell\AutOpLaY\commanD - F:\ydquff.pif
\Shell\AutoRun\command - F:\ydquff.pif
\Shell\ExPlORE\COMmAnd - F:\ydquff.pif
\Shell\oPeN\cOmmanD - F:\ydquff.pif
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f154bf59-1e1f-11de-a4a9-00e04d49c821}]
\sHell\AutOPLAy\command - F:\pbhmw.pif
\sHell\AutoRun\command - F:\pbhmw.pif
\sHell\exploRe\cOmmaND - F:\pbhmw.pif
\sHell\opEn\CoMmanD - F:\pbhmw.pif
.
Contents of the 'Scheduled Tasks' folder
2009-04-02 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [04/01/2009 12:39 AM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-02 10:00:16
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\SETUPAPI.dll
- - - - - - - > 'lsass.exe'(700)
c:\windows\system32\setupapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 04/02/2009 10:01:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-02 07:01:18
Pre-Run: 37,505,105,920 bytes free
Post-Run: 38,097,977,344 bytes free
123
الخطوة الثانية تم تنفيذها وهذا التقرير الهايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04:08 ص, on 02/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
D:\برامج\ادوات حذف الفيروسات\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: خدمة تحديث Google (gupdate1c9b2495717edb4) (gupdate1c9b2495717edb4) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
--
End of file - 2490 bytes
