السلام عليكم ورحمة الله وبركاته
اولا المعذره على وضع سؤالي في غير محله واشكركم على سعة بالكم وتجاوبكم السريع
وهاذ التقرير
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:40:05 ص, on 04/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Abadisoft Group\Broom 6.0\sheller.exe
G:\لازالة الفيروسات\HiJackThis.exe
G:\لازالة الفيروسات\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - G:\لازالة الفيروسات\ahmdatef_portable_antivirus\Files\AVIRA\AviraAntiVir7\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - G:\لازالة الفيروسات\ahmdatef_portable_antivirus\Files\AVIRA\AviraAntiVir7\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - (no file)
O23 - Service: avgio - H+BEDV Datentechnik GmbH - G:\لازالة الفيروسات\ahmdatef_portable_antivirus\Files\AVIRA\AviraAntiVir7\avgio.sys
O23 - Service: avgntflt - AVIRA GmbH - G:\لازالة الفيروسات\ahmdatef_portable_antivirus\Files\AVIRA\AviraAntiVir7\avgntflt.sys
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
--
End of file - 1902 bytes
وهاذا تقرير احد ادوات الفيروسات يوجد به اسم الفيروس
ComboFix 09-05-02.4 - العمليات 05/04/2009 11:11.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.223.66 [GMT 3:00]
Running from: h:\لازالة الفيروسات\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Readme.txt
c:\windows\system32\nmdfgds0.dll
.
((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.
2009-05-04 08:08 . 2009-05-04 08:08 -------- d-----w c:\documents and settings\tazebama.dl_
2009-05-04 06:18 . 2004-01-10 22:17 45568 ----a-w c:\windows\system32\YM11AUTH.DLL
2009-05-02 09:01 . 2009-05-04 08:07 -------- d--h--r c:\documents and settings\العمليات\Recent
2009-05-02 09:01 . 2009-05-04 08:07 -------- d--h--r c:\documents and settings\العمليات\Recent
2009-05-02 08:51 . 2009-05-02 08:51 -------- d-----w c:\documents and settings\العمليات\Application Data\cleaner1
2009-05-02 08:40 . 2009-05-02 08:40 0 ----a-w c:\windows\system32\WinWare.sys
2009-05-02 08:22 . 2009-05-02 08:22 160 ----a-w c:\windows\thanks.vbs
2009-05-02 08:22 . 2009-05-02 08:22 -------- d-----w c:\program files\alfattak
2009-04-28 07:54 . 2009-05-03 07:27 -------- d-----w c:\program files\Unlocker
2009-04-28 07:03 . 2009-04-28 07:03 -------- d-----w c:\program files\ESET
2009-04-12 05:44 . 2009-05-04 08:11 -------- d-----w c:\windows\system32\CatRoot2
2009-04-12 05:33 . 2009-04-12 05:41 -------- d-----w c:\program files\GVR
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 08:11 . 2008-07-14 05:56 6 -c-ha-w c:\windows\Tasks\SA.DAT
2009-05-04 03:04 . 2008-01-21 09:01 540 -c--a-w c:\windows\Tasks\RegCure Program Check.job
2009-05-03 07:26 . 2009-04-04 03:59 -------- d-----w c:\program files\Trojan Remover
2009-04-12 05:45 . 2001-09-19 12:00 67 -csha-w c:\windows\Fonts\desktop.ini
2009-03-01 08:22 . 2008-01-17 08:35 63 -c--a-w c:\windows\AlfaStart.CMD
2009-02-06 11:24 . 2009-02-06 11:24 93336 ----a-w c:\windows\system32\drivers\epfwtdir.sys
2009-02-06 11:23 . 2009-02-06 11:23 106208 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-02-06 11:19 . 2009-02-06 11:19 113448 ----a-w c:\windows\system32\drivers\eamon.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
c:\documents and settings\ںéمêéïں¢\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
USB Disk Security-Ar.lnk - c:\documents and settings\ںéمêéïں¢\«ل¥ ںéêè¢ \¦ں­ ںéهںï©ي«ں¢\USB Disk Security-Ar\USB Disk Security-Ar.exe [2008-1-20 774144]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^العمليات^قائمة ابدأ^البرامج^بدء التشغيل^المفكرة اليومية.lnk]
backup=c:\windows\pss\المفكرة اليومية.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Runonce
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\cmd.exe"=
R2 cdralw;NVIDIA Compatible Windows Miniport Driver; [x]
R3 abp470n5;abp470n5; [x]
R3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB; [x]
R3 SWNC8U12;Sierra Wireless MUX NDIS Driver (UMTS12);c:\windows\system32\DRIVERS\swnc8u12.sys [2007-09-21 164480]
R3 SWUMX12;Sierra Wireless USB MUX Driver (UMTS12);c:\windows\system32\DRIVERS\swumx12.sys [2007-09-21 140672]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2009-02-06 93336]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
S3 swivsp;AC8xx Virtual Serial Port;c:\windows\system32\DRIVERS\swivspnt.sys [2007-03-26 20352]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23ca614c-bf4d-11dc-beca-00e04cb2af4d}]
\Shell\autoplaY\commAnd - ndjq.exe
\Shell\AutoRun\command - ndjq.exe
\Shell\eXPlOrE\commanD - ndjq.exe
\Shell\opEn\command - ndjq.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72a26926-12a5-11de-bf0b-00e04cb2af4d}]
\Shell\AutoRun\command - H:\cv22.cmd
\Shell\open\Command - H:\cv22.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e998d184-638f-11dd-be1d-00e04cb2af4d}]
\Shell\AutoRun\command - H:\cv22.cmd
\Shell\open\Command - H:\cv22.cmd
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-TrojanScanner - c:\program files\Trojan Remover\Trjscan.exe
HKLM-Run-SystemInit - (no file)
HKLM-Run-Karen - (no file)
HKLM-Run-raVe - (no file)
HKLM-Run-SystemBackup - (no file)
HKLM-Run-Win32BaseServiceMOD - (no file)
HKLM-Run-startIE - (no file)
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = <local>
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
vbefile\shell\edit\command=%SystemRoot%\System32\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-04 11:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-04 11:14
ComboFix-quarantined-files.txt 2009-05-04 08:14
Pre-Run: 6,458,904,576 bytes free
Post-Run: 6,462,324,736 bytes free
153
واعتذر لطول التقرير ولكم تحياتي
