مشكوور اخوي....بس قوول لي خلاص انحلت المشكلة ..
وصح اللي سويتة والا لا..
ComboFix 09-04-21.07 - USER1 04/21/2009 7:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.511.281 [GMT 3:00]
Running from: c:\documents and settings\USER1\My Documents\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\FunWebProducts\Shared\Cache\WebfettiBtn.html
c:\program files\Internet Explorer\msimg32.dll
c:\program files\Microsoft Common
c:\program files\Microsoft Common\svchost.exe
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\
001948A8
c:\program files\MyWebSearch\bar\Cache\
004250AF.bin
c:\program files\MyWebSearch\bar\Cache\
00425310.bin
c:\program files\MyWebSearch\bar\Cache\
00425562.bin
c:\program files\MyWebSearch\bar\Cache\
00425794.bin
c:\program files\MyWebSearch\bar\Cache\
0042B62F.bin
c:\program files\MyWebSearch\bar\Cache\
0042B891.bin
c:\program files\MyWebSearch\bar\Cache\
0042BBEC.bin
c:\program files\MyWebSearch\bar\Cache\
0042BE4D.bin
c:\program files\MyWebSearch\bar\Cache\
0042C300
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\windows\IE4 Error Log.txt
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
c:\windows\system32\twex.exe
.
((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 )))))))))))))))))))))))))))))))
.
2009-04-20 23:06 . 2009-04-20 23:06 252 ----a-w C:\e80837r.exe
2009-04-18 20:43 . 2009-04-18 20:43 -------- d-----w c:\windows\system32\LogFiles
2009-04-05 17:03 . 2009-04-05 17:03 -------- d-----w c:\documents and settings\USER1\Application Data\Media Player Classic
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-21 00:47 . 2004-08-04 12:00 41274 ----a-w c:\windows\system32\perfc001.dat
2009-04-21 00:47 . 2004-08-04 12:00 254598 ----a-w c:\windows\system32\perfh001.dat
2009-04-20 03:52 . 2008-07-22 19:54 -------- d-----w c:\program files\MSN Messenger
2009-04-13 22:34 . 2008-07-22 19:55 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-13 22:18 . 2009-04-13 22:18 -------- d-----w c:\program files\Fun Web Products
2009-04-13 17:32 . 2008-07-22 19:56 -------- d-----w c:\program files\Eset
2009-04-02 23:29 . 2009-04-19 19:41 181592 ----a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1025.dat
2009-04-01 08:25 . 2009-04-01 08:25 -------- d-----w c:\program files\Azkary
2009-03-31 11:35 . 2008-10-11 12:04 244 ---ha-w C:\sqmnoopt04.sqm
2009-03-31 11:35 . 2008-10-11 12:04 232 ---ha-w C:\sqmdata04.sqm
2009-03-17 05:16 . 2008-08-16 22:47 244 ---ha-w C:\sqmnoopt03.sqm
2009-03-17 05:16 . 2008-08-16 22:47 232 ---ha-w C:\sqmdata03.sqm
2009-03-17 02:46 . 2008-07-26 18:17 244 ---ha-w C:\sqmnoopt02.sqm
2009-03-17 02:46 . 2008-07-26 18:17 232 ---ha-w C:\sqmdata02.sqm
2009-03-10 01:15 . 2008-07-26 18:17 268 ---ha-w C:\sqmdata01.sqm
2009-03-10 01:15 . 2008-07-26 18:17 244 ---ha-w C:\sqmnoopt01.sqm
2009-03-07 00:47 . 2008-07-22 19:55 244 ---ha-w C:\sqmnoopt00.sqm
2009-03-07 00:47 . 2008-07-22 19:55 232 ---ha-w C:\sqmdata00.sqm
2009-03-07 00:46 . 2009-03-07 00:46 244 ---ha-w C:\sqmnoopt19.sqm
2009-03-07 00:46 . 2009-03-07 00:46 232 ---ha-w C:\sqmdata19.sqm
2009-03-07 00:44 . 2009-03-07 00:44 244 ---ha-w C:\sqmnoopt18.sqm
2009-03-07 00:44 . 2009-03-07 00:44 232 ---ha-w C:\sqmdata18.sqm
2009-03-07 00:42 . 2009-03-07 00:42 244 ---ha-w C:\sqmnoopt17.sqm
2009-03-07 00:42 . 2009-03-07 00:42 232 ---ha-w C:\sqmdata17.sqm
2009-02-21 17:29 . 2009-02-21 17:29 244 ---ha-w C:\sqmnoopt16.sqm
2009-02-21 17:29 . 2009-02-21 17:29 232 ---ha-w C:\sqmdata16.sqm
2009-02-21 17:24 . 2009-02-21 17:24 244 ---ha-w C:\sqmnoopt15.sqm
2009-02-21 17:24 . 2009-02-21 17:24 232 ---ha-w C:\sqmdata15.sqm
2009-02-07 13:08 . 2009-02-07 13:08 244 ---ha-w C:\sqmnoopt14.sqm
2009-02-07 13:08 . 2009-02-07 13:08 232 ---ha-w C:\sqmdata14.sqm
2009-02-07 13:07 . 2009-02-07 13:07 244 ---ha-w C:\sqmnoopt13.sqm
2009-02-07 13:07 . 2009-02-07 13:07 232 ---ha-w C:\sqmdata13.sqm
2009-02-03 14:33 . 2009-02-03 14:33 244 ---ha-w C:\sqmnoopt12.sqm
2009-02-03 14:33 . 2009-02-03 14:33 232 ---ha-w C:\sqmdata12.sqm
2008-07-22 19:55 . 2008-07-22 18:45 100824 ----a-w c:\documents and settings\USER1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Azkary"="c:\program files\Azkary\Azkary" [X]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-03-16 127037]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-03 344064]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2004-11-10 598016]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-07-22 949376]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-07-22 185896]
"VC9Player"="c:\program files\Virtual CD v9\System\VC9Play.exe" [2007-04-12 202312]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\windows\system32\config\systemprofile\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
userinit.exe [2004-8-4 27648]
c:\windows\system32\config\systemprofile\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
userinit.exe [2004-8-4 27648]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
GlobeTrotter Connect.lnk - c:\program files\Option\GlobeTrotter Connect\GlobeTrotter Connect.exe [2008-7-18 876544]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Boson Software\\Boson NetSim\\Boson_NetSim.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
R3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2008-02-18 106624]
R3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2008-02-08 59648]
R3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2007-03-30 8064]
R3 HH9Help.sys;HH9Help.sys;c:\windows\system32\drivers\HH9Help.sys [2006-09-20 11392]
S1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-07-22 15424]
S1 vdrv9000;vdrv9000;c:\windows\system32\DRIVERS\vdrv9000.sys [2007-01-23 105984]
S2 GtDetectSc;GtDetectSc;c:\program files\Option\GlobeTrotter Connect\GtDetectSc.exe [2007-12-18 196704]
S2 VC9SecS;Virtual CD v9 Management Service;c:\program files\Virtual CD v9\System\VC9SecS.exe [2007-04-12 124488]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d45961a6-ee24-11dd-b0db-0010c6cb79ef}]
\Shell\AutoRun\command - G:\setup.exe AUTORUN=1
.
- - - - ORPHANS REMOVED - - - -
BHO-{00A6FAF1-072E-44cf-8957-5838F569A31D} - c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
BHO-{07B18EA1-A523-4961-B6BB-170DE4475CCA} - c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
Toolbar-{07B18EA9-A523-4961-B6BB-170DE4475CCA} - c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
WebBrowser-{07B18EA9-A523-4961-B6BB-170DE4475CCA} - c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &Search -
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
DPF: Microsoft XML Parser for Java -
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/SmileyCentralInitialSetup1.0.1.1.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-21 07:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(916)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(972)
c:\windows\system32\imon.dll
.
Completion time: 2009-04-21 7:37
ComboFix-quarantined-files.txt 2009-04-21 04:37
Pre-Run: 29,514,702,848 bytes free
Post-Run: 29,664,518,144 bytes free
220