تفضل اخي ..
ComboFix 09-04-23.A3 - Administrator 04/23/2009 22:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.966.1033.18.446.232 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-05-23 to 2009-4-23 )))))))))))))))))))))))))))))))
.
2009-04-23 19:55 . 2009-04-23 19:55 -------- d-----w c:\documents and settings\Administrator\Application Data\AdobeUM
2009-04-23 19:38 . 2009-04-23 20:18 -------- d-----w c:\windows\system32\CatRoot2
2009-04-23 19:00 . 2009-04-23 19:00 -------- d-----w c:\windows\system32\bits
2009-04-23 18:12 . 2005-08-24 20:56 74752 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
2009-04-23 18:12 . 2009-04-23 18:12 -------- d-----w c:\windows\OPTIONS
2009-04-23 16:55 . 2009-04-23 16:55 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-23 15:14 . 2009-04-23 15:14 26488 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-23 09:42 . 2004-07-01 22:08 7680 -c----w c:\windows\system32\dllcache\bitsprx2.dll
2009-04-23 09:42 . 2004-07-01 22:08 7680 ------w c:\windows\system32\bitsprx2.dll
2009-04-23 09:42 . 2004-07-01 22:08 7168 -c----w c:\windows\system32\dllcache\bitsprx3.dll
2009-04-23 09:42 . 2004-07-01 22:08 7168 ------w c:\windows\system32\bitsprx3.dll
2009-04-23 09:42 . 2004-07-01 22:08 361984 -c--a-w c:\windows\system32\dllcache\qmgr.dll
2009-04-23 09:42 . 2004-07-01 22:08 331776 ----a-w c:\windows\system32\winhttp.dll
2009-04-23 09:42 . 2004-07-01 22:08 17408 -c--a-w c:\windows\system32\dllcache\qmgrprxy.dll
2009-04-23 09:42 . 2004-07-01 22:08 17408 ----a-w c:\windows\system32\qmgrprxy.dll
2009-04-23 09:42 . 2004-06-30 23:59 158720 ------w c:\windows\system32\xpob2res.dll
2009-04-22 20:55 . 2009-04-22 20:55 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-04-22 20:34 . 2009-04-22 20:34 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-22 19:39 . 2009-04-23 20:18 -------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2009-04-22 19:39 . 2009-04-23 17:10 -------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2009-04-22 19:35 . 2008-10-16 12:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-04-22 19:35 . 2008-10-16 12:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-22 19:35 . 2008-10-16 12:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-04-22 19:35 . 2009-04-22 19:35 -------- d-s---w c:\documents and settings\Administrator\UserData
2009-04-22 19:33 . 2009-04-22 19:33 -------- d-s---w c:\windows\system32\Microsoft
2009-04-22 19:33 . 2008-10-16 12:13 202776 ----a-w c:\windows\system32\wuweb.dll
2009-04-22 19:33 . 2008-10-16 12:09 43544 ----a-w c:\windows\system32\wups2.dll
2009-04-22 19:33 . 2008-10-16 12:09 31768 ----a-w c:\windows\system32\wucltui.dll.mui
2009-04-22 19:33 . 2008-10-16 12:08 34328 ----a-w c:\windows\system32\wups.dll
2009-04-22 19:33 . 2008-10-16 12:12 323608 ----a-w c:\windows\system32\wucltui.dll
2009-04-22 19:33 . 2008-10-16 12:12 561688 ----a-w c:\windows\system32\wuapi.dll
2009-04-22 19:33 . 2008-10-16 12:12 213528 ----a-w c:\windows\system32\wuaucpl.cpl
2009-04-22 19:33 . 2008-10-16 12:07 23576 ----a-w c:\windows\system32\wuaucpl.cpl.mui
2009-04-22 19:33 . 2008-10-16 12:07 23576 ----a-w c:\windows\system32\wuapi.dll.mui
2009-04-22 19:33 . 2008-10-16 12:07 18456 ----a-w c:\windows\system32\wuaueng.dll.mui
2009-04-22 19:28 . 2009-04-22 19:28 -------- d-----w c:\documents and settings\All Users\Application Data\Windows Live Toolbar
2009-04-22 19:27 . 2009-04-22 19:56 -------- d-----w c:\documents and settings\Administrator\Contacts
2009-04-22 19:25 . 2009-04-22 19:25 -------- dc----w c:\windows\system32\DRVSTORE
2009-04-22 19:10 . 2009-04-22 19:10 -------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-04-22 06:08 . 2009-04-22 06:08 0 ----a-w c:\windows\nsreg.dat
2009-04-22 06:08 . 2009-04-22 06:08 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-21 19:11 . 2009-04-21 19:11 -------- dc-h--w c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-04-21 18:06 . 2009-04-21 18:13 -------- d-----w c:\documents and settings\Administrator\Application Data\MSN6
2009-04-21 18:06 . 2009-04-21 18:06 -------- d-----w c:\documents and settings\All Users\Application Data\MSN6
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 18:23 . 2009-04-20 20:17 34 ----a-w C:\RtlSetup.log
2009-04-23 18:13 . 2009-04-20 20:20 224 ----a-w C:\LAN.log
2009-04-23 18:12 . 2009-04-20 20:12 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-23 18:09 . 2009-04-20 20:17 87 ----a-w C:\Realtek.log
2009-04-23 17:46 . 2009-04-23 17:46 -------- d-----w c:\program files\Trend Micro
2009-04-23 16:30 . 2009-04-23 16:30 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-23 16:30 . 2009-04-23 16:30 -------- d-----w c:\program files\Windows Live
2009-04-23 16:30 . 2009-04-23 16:29 -------- d-----w c:\program files\MSN Messenger
2009-04-23 16:29 . 2009-04-22 19:26 -------- d-----w c:\program files\Windows Live Toolbar
2009-04-22 20:54 . 2009-04-20 20:23 -------- d-----w c:\program files\Common Files\Adobe
2009-04-22 19:39 . 2009-04-22 19:39 -------- d-----w c:\program files\Internet Download Manager
2009-04-22 19:33 . 2009-04-22 19:33 -------- d-----w c:\program files\Real
2009-04-20 20:24 . 2009-04-20 20:24 185 ----a-w C:\setup.log
2009-04-20 20:17 . 2009-04-20 20:12 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-20 20:16 . 2009-04-20 20:16 183 ----a-w C:\GFX.log
2009-04-20 20:12 . 2009-04-20 20:12 90 ----a-w C:\INF.log
2009-04-20 20:11 . 2009-04-20 20:11 -------- d-----w c:\program files\MSXML 4.0
2009-04-20 20:06 . 2009-04-20 20:06 -------- d-----w c:\program files\microsoft frontpage
2009-04-20 20:05 . 2009-04-20 20:05 80007 ----a-w c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-04-20 20:03 . 2009-04-20 20:03 21640 ----a-w c:\windows\system32\emptyregdb.dat
2005-03-03 07:10 . 2009-04-20 20:24 16896 ----a-w c:\program files\Common Files\so_icon_lib.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\System32\ctfmon.exe" [2001-08-23 13312]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-23 2745776]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
R3 ATICDSDr;ATICDSDr; [x]
--- Other Services/Drivers In Memory ---
*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - Ati HotKey Poller
*Deregistered* - ATI Smart
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - Messenger
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - RasAuto
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - uploadmgr
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WmdmPmSp
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
.
------- Supplementary Scan -------
.
IE: Add to Windows &Live Favorites -
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\hizkmqdh.default\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-23 22:21
Windows 5.1.2600 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\æHõwæ*]
"DisplayName"="?\11\
09"
"DeviceDesc"="?\11\
09"
"ProviderName"="???\11?#H\11??"
"MFG"="???"
"ReinstallString"=".10.1000.5"
"DeviceInstanceIds"=multi:"f:\\software\\drivers\\chipset_inf\\sbdrv\\sbdrv\\smbus\\smbusati.inf\
00"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(632)
c:\windows\system32\ODBC32.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(688)
c:\windows\system32\dssenh.dll
- - - - - - - > 'explorer.exe'(320)
c:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2009-04-23 22:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-23 20:21
Pre-Run: 17,372,540,928 bytes free
Post-Run: 17,586,606,080 bytes free
WinXP_EN_PRO_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
241 --- E O F --- 2009-04-23 19:00
