اخويا حملتها ووسويت زي ماقلت وبدات الااده الفحص وعاد التشغيل وشتغلت وبدات تفحص بالدوز وبعدين جتني رسايل كثيره من تقول تم تعطيل سجل النظام يمكن ست مرات احط موافق عليها لين ماخلص وجاني التقرير هذا
للComboFix
ComboFix 09-05-07.01 - خالد khalid 05/07/2009 19:52.2 - NTFSx86 DSREPAIR
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.238.139 [GMT 3:00]
Running from: C:\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated)
AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*
FW: McAfee Personal Firewall *enabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Images.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\crypts.dll
c:\windows\system32\digiwet.dll
c:\windows\system32\dz1.txt
c:\windows\system32\mssrv32.exe
c:\windows\system32\p1.txt
c:\windows\system32\r24.txt
c:\windows\system32\sdd.txt
.
---- Previous Run -------
.
c:\documents and settings\خالد khalid\Application Data\addons.dat
c:\documents and settings\خالد khalid\Application Data\wiaserva.log
c:\documents and settings\LocalService\Application Data\twain_32
c:\documents and settings\LocalService\Application Data\twain_32\user.ds
c:\program files\Bifrost
c:\program files\Microsoft Common
c:\program files\Microsoft Common\svchost.exe
c:\recycler\S-1-6-21-2434476501-1644491937-600003330-1213
c:\recycler\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini
c:\windows\IE4 Error Log.txt
c:\windows\system32\twain_32
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
c:\windows\wiaserviv.log
c:\windows\youtubex.dll
D:\resycled
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ASC3360PR
-------\Legacy_ACPI32
-------\Legacy_MSUPDATE
-------\Service_acpi32
-------\Service_msupdate
((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.
2009-05-07 16:49 . 2009-05-07 16:49 3018705 ----a-r C:\ComboFix.exe
2009-05-07 16:29 . 2009-05-07 16:29 401720 ----a-w C:\HiJackThis.exe
2009-05-07 16:05 . 2009-05-07 16:05 -------- d-----w c:\program files\EsetOnlineScanner
2009-05-07 16:00 . 2009-05-07 16:00 74299 ----a-w C:\اقوى اداة لاازالة فيروس Autorun.zip
2009-05-07 15:58 . 2009-05-07 15:58 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-07 15:37 . 2009-05-07 15:37 217 ----a-w C:\disablerollback.zip
2009-05-06 03:27 . 2009-05-06 03:27 394267 ----a-w C:\UltraSurf 9.2.zip
2009-05-05 22:18 . 2009-05-05 22:18 -------- d-----w c:\documents and settings\All Users\Application Data\SWiSHMax2WorkFolder
2009-04-29 21:05 . 2009-04-30 01:04 -------- d-----w C:\عليان
2009-04-27 03:21 . 2009-04-27 03:21 -------- d-----w c:\documents and settings\خالد khalid\Local Settings\Application Data\Identities
2009-04-27 01:04 . 2009-04-27 01:04 -------- d-----w c:\documents and settings\خالد khalid\Application Data\Thinstall
2009-04-23 00:01 . 2009-04-23 00:01 -------- d-----w c:\program files\ColorSoft
2009-04-18 23:15 . 2009-04-18 23:40 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-18 23:15 . 2009-04-18 23:40 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-18 23:10 . 2009-04-30 14:42 557088 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-18 23:10 . 2009-04-18 23:10 -------- d-----w c:\program files\Kaspersky Lab
2009-04-18 23:10 . 2009-05-01 23:48 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-18 22:29 . 2009-04-18 22:29 -------- d-----w c:\windows\Sun
2009-04-18 11:19 . 2009-04-23 05:56 423454752 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-18 11:18 . 2008-07-08 11:54 148496 ----a-w c:\windows\system32\drivers\98747588.sys
2009-04-18 11:17 . 2009-04-18 11:14 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-17 23:14 . 2009-04-17 23:14 0 ----a-w c:\windows\nsreg.dat
2009-04-17 23:13 . 2009-04-17 23:13 -------- d-----w c:\documents and settings\خالد khalid\Local Settings\Application Data\Mozilla
2009-04-17 22:30 . 2009-04-17 22:30 -------- d-----w c:\documents and settings\خالد khalid\Local Settings\Application Data\ESET
2009-04-17 22:13 . 2009-04-17 22:13 -------- d-----w c:\program files\Enigma Software Group
2009-04-17 20:18 . 2009-05-01 23:53 -------- d-----w c:\documents and settings\خالد khalid\Local Settings\Application Data\Google
2009-04-17 20:01 . 2002-02-18 07:22 139536 ----a-w c:\windows\system32\javaee.dll
2009-04-17 16:52 . 2009-04-17 16:52 -------- d-----w c:\documents and settings\خالد khalid\Application Data\INAC
2009-04-17 16:52 . 2009-04-17 16:52 -------- d-----w c:\documents and settings\All Users\Application Data\INAC
2009-04-17 16:22 . 2009-04-17 16:22 78440 ----a-w c:\documents and settings\خالد khalid\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 16:11 . 2009-04-17 19:02 67645 ----a-w c:\windows\system32\drivers\pshook11.sys
2009-04-17 16:11 . 2009-04-18 00:26 -------- d-----w c:\program files\INAC
2009-04-17 15:03 . 2009-04-17 15:10 -------- d-----w c:\documents and settings\خالد khalid\Application Data\MYweb4net
2009-04-17 14:58 . 2009-04-17 16:51 -------- d-----w c:\program files\MYweb4net
2009-04-17 14:10 . 2009-04-17 14:10 -------- d-----w c:\windows\PaltalkScene
2009-04-17 14:10 . 2009-04-17 14:13 -------- d-----w c:\program files\Paltalk Messenger
2009-04-16 12:54 . 2009-04-16 12:54 -------- d-----w c:\documents and settings\خالد khalid\Application Data\Ipswitch
2009-04-16 12:48 . 2009-04-16 12:48 -------- d-----w c:\documents and settings\All Users\Application Data\Ipswitch
2009-04-16 11:46 . 2009-04-16 14:22 -------- d-----w c:\documents and settings\خالد khalid\Tracing
2009-04-16 11:46 . 2009-04-16 14:22 -------- d-----w c:\documents and settings\خالد khalid\Tracing
2009-04-16 11:40 . 2009-04-17 10:09 -------- d-----w c:\windows\SxsCaPendDel
2009-04-16 11:13 . 2009-04-16 11:13 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-16 04:18 . 2009-04-17 14:10 -------- d-----w c:\documents and settings\خالد khalid\Application Data\Paltalk
2009-04-16 03:57 . 2009-04-16 16:18 -------- d-----w c:\program files\security
2009-04-15 19:21 . 2009-04-15 19:21 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-04-15 16:44 . 2009-04-27 16:38 -------- d-----w C:\اضافات لمنصور
2009-04-14 21:48 . 2009-04-14 21:48 53248 ----a-w C:\u94.zip
2009-04-13 21:50 . 2002-10-25 02:17 65536 ----a-w c:\windows\system32\Crypserv.exe
2009-04-13 21:50 . 1999-06-18 21:49 165888 ----a-w c:\windows\Ckconfig.exe
2009-04-13 21:50 . 1995-07-04 18:33 11776 ----a-w c:\windows\Ckrfresh.exe
2009-04-13 21:50 . 1996-05-03 15:36 18432 ----a-w c:\windows\Setup_ck.dll
2009-04-13 21:50 . 1996-05-03 17:21 27648 ----a-r c:\windows\Setup_ck.exe
2009-04-13 21:44 . 2009-04-24 17:11 -------- d-----w c:\program files\Kelk 2000
2009-04-13 21:41 . 2009-04-14 21:55 -------- d-----w C:\تحميلات
2009-04-09 19:16 . 2009-04-09 19:42 -------- d-----w c:\program files\Online TV Player 4
2009-04-09 18:18 . 2009-04-09 18:18 -------- d-----w c:\documents and settings\خالد khalid\Application Data\FDRLab
2009-04-09 16:10 . 2009-04-09 16:10 -------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-30 14:42 . 2009-04-18 23:10 2984 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-27 14:42 . 2009-03-19 12:47 -------- d-----w c:\program files\SWiSH Max2
2009-04-26 04:06 . 2009-03-15 06:07 -------- d-----w c:\program files\Google
2009-04-23 21:35 . 2009-03-23 04:06 -------- d-----w c:\program files\SWiSHmax
2009-04-22 18:00 . 2009-04-18 11:19 4881092 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-21 05:19 . 2009-03-10 07:10 -------- d-----w c:\program files\Microsoft ActiveSync
2009-04-18 23:41 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-04-18 01:29 . 2009-03-11 11:23 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-18 01:29 . 2009-03-10 14:18 -------- d-----w c:\program files\MSN Messenger
2009-04-18 00:46 . 2009-04-06 02:50 -------- d-----w c:\program files\SiteMap Generator
2009-04-17 20:01 . 2009-04-17 20:01 2678 ----a-w c:\windows\java\Packages\Data\I1RT3P7R.DAT
2009-04-17 20:01 . 2009-04-17 20:01 2678 ----a-w c:\windows\java\Packages\Data\7XJDFZP3.DAT
2009-04-17 20:01 . 2009-04-17 20:01 2678 ----a-w c:\windows\java\Packages\Data\PFBFBFJZ.DAT
2009-04-17 20:01 . 2009-04-17 20:01 2678 ----a-w c:\windows\java\Packages\Data\IEUT3PFB.DAT
2009-04-17 20:01 . 2009-04-17 20:01 2678 ----a-w c:\windows\java\Packages\Data\ESK3FZFR.DAT
2009-04-17 19:28 . 2001-09-19 11:00 58784 ----a-w c:\windows\system32\perfc001.dat
2009-04-17 19:28 . 2001-09-19 11:00 328494 ----a-w c:\windows\system32\perfh001.dat
2009-04-16 16:05 . 2009-03-11 11:23 -------- d-----w c:\program files\Windows Live
2009-04-08 16:37 . 2009-04-02 06:54 -------- d-----w c:\program files\MassSender
2009-04-06 22:48 . 2009-04-06 22:48 -------- d-----w c:\program files\Invisible Detector
2009-04-06 22:22 . 2009-04-06 22:22 499712 ----a-w C:\u94.exe
2009-04-06 02:11 . 2009-04-06 02:11 -------- d-----w c:\program files\Micro-Sys Software
2009-04-02 20:14 . 2009-04-02 20:14 -------- d-----w c:\program files\Common Files\xing shared
2009-04-02 20:14 . 2009-03-10 06:17 -------- d-----w c:\program files\Common Files\Real
2009-03-30 21:45 . 2009-03-30 21:44 -------- d-----w c:\program files\Replay Converter 3
2009-03-30 21:42 . 2009-03-30 21:42 21319232 ----a-w C:\RCSetup.exe
2009-03-30 21:40 . 2009-03-30 21:40 -------- d-----w c:\program files\Magicbit
2009-03-30 21:36 . 2009-03-30 21:36 -------- d-----w c:\program files\Common Files\SWF Studio
2009-03-30 21:35 . 2009-03-30 21:35 -------- d-----w c:\program files\Riva
2009-03-30 05:56 . 2009-03-30 05:45 -------- d-----w c:\program files\YoutubeGet
2009-03-30 05:23 . 2009-03-29 05:52 -------- d-----w c:\program files\Total Video Converter
2009-03-30 05:21 . 2009-03-30 05:21 5353452 ----a-w C:\Total_Video_Converter_v3[1].10.zip
2009-03-27 16:34 . 2009-03-27 16:32 -------- d-----w c:\program files\Propel Accelerator
2009-03-24 17:13 . 2009-03-24 17:13 -------- d-----w c:\program files\aMSN
2009-03-20 23:49 . 2009-03-20 23:49 -------- d-----w c:\program files\مشغل الفلاش العربي
2009-03-19 20:21 . 2009-03-19 20:21 17128 ----a-w c:\windows\tt_1237494097.exe
2009-03-19 12:51 . 2009-03-19 12:51 -------- d-----w c:\program files\Common Files\SWiSHzone.com
2009-03-19 12:43 . 2009-03-19 12:43 2 ---h--w c:\windows\t55ft2951f44.dat
2009-03-19 05:28 . 2009-03-17 20:08 -------- d-----w c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility
2009-03-18 23:15 . 2009-03-18 23:15 -------- d-----w c:\program files\Ipswitch
2009-03-18 23:15 . 2009-03-10 05:57 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-18 04:21 . 2009-03-17 20:07 21035 ----a-w c:\windows\system32\drivers\AegisP.sys
2009-03-17 20:07 . 2009-03-17 20:07 -------- d-----w c:\program files\Atheros
2009-03-17 01:29 . 2009-03-17 01:29 -------- d-----w c:\program files\Microsoft Works
2009-03-16 03:06 . 2009-03-13 17:27 -------- d-----w c:\program files\McAfee
2009-03-16 02:48 . 2009-03-11 11:23 -------- d-----w c:\program files\Circle Developement
2009-03-15 13:48 . 2009-03-12 04:39 -------- d-----w c:\program files\Orbitdownloader
2009-03-15 07:18 . 2009-03-15 07:18 2232 ----a-w c:\windows\java\Packages\Data\V357DBN1.DAT
2009-03-15 07:18 . 2009-03-15 07:18 155995 ----a-w c:\windows\java\Packages\BLFRNFFV.ZIP
2009-03-13 20:15 . 2009-03-10 06:31 -------- d-----w c:\program files\K-Lite Codec Pack
2009-03-13 19:30 . 2009-03-10 05:57 184320 ----a-w c:\windows\system32\hkcmd.exe
2009-03-13 19:30 . 2009-03-10 05:57 229376 ----a-w c:\windows\system32\igfxtray.exe
2009-03-13 15:24 . 2009-03-13 15:21 -------- d-----w c:\program files\Common Files\Adobe
2009-03-13 10:32 . 2009-03-10 05:22 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-10 07:09 . 2009-03-10 07:09 -------- d-----w c:\program files\winbond
2009-03-10 06:50 . 2009-03-10 06:50 -------- d-----w c:\program files\Microsoft.NET
2009-03-10 06:19 . 2009-03-10 06:17 -------- d-----w c:\program files\Real
2009-03-10 05:57 . 2009-03-10 05:57 -------- d-----w c:\program files\Common Files\InstallShield
2009-03-10 05:31 . 2009-03-10 05:31 -------- d-----w c:\program files\Alwil Software
2009-03-10 05:23 . 2009-03-10 05:23 -------- d-----w c:\program files\microsoft frontpage
2009-03-10 05:22 . 2001-09-19 11:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-03-10 05:19 . 2009-03-10 05:19 22144 ----a-w c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe [2009-3-17 737280]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"RestrictRun"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalTalk.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^خالد khalid^قائمة ابدأ^البرامج^بدء التشغيل^is-GIE86.lnk]
path=c:\documents and settings\خالد khalid\قائمة ابدأ\البرامج\بدء التشغيل\is-GIE86.lnk
backup=c:\windows\pss\is-GIE86.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^خالد khalid^قائمة ابدأ^البرامج^بدء التشغيل^WWU.lnk]
path=c:\documents and settings\خالد khalid\قائمة ابدأ\البرامج\بدء التشغيل\WWU.lnk
backup=c:\windows\pss\WWU.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\DOCUME~1\\KHALID~1\\LOCALS~1\\Temp\\spruh.exe"=
"c:\\DOCUME~1\\KHALID~1\\LOCALS~1\\Temp\\winojewjl.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 0315291236965362mcinstcleanup;0315291236965362mcinstcleanup; [x]
R2 amd64si;amd64si;c:\windows\system32\drivers\amd64si.sys [x]
R2 ati64si;ati64si;c:\windows\system32\drivers\ati64si.sys [x]
R2 fips32cup;fips32cup;c:\windows\system32\drivers\fips32cup.sys [x]
R2 gupdate1c9ac6c1739d950;خدمة تحديث Google (gupdate1c9ac6c1739d950);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-24 133104]
R2 i386si;i386si;c:\windows\system32\drivers\i386si.sys [x]
R2 ksi32sk;ksi32sk;c:\windows\system32\drivers\ksi32sk.sys [x]
R2 netsik;netsik;c:\windows\system32\drivers\netsik.sys [x]
R2 nicsk32;nicsk32;c:\windows\system32\drivers\nicsk32.sys [x]
R2 port135sik;port135sik;c:\windows\system32\drivers\port135sik.sys [x]
R2 securentm;securentm;c:\windows\system32\drivers\securentm.sys [x]
R2 systemntmi;systemntmi;c:\windows\system32\drivers\systemntmi.sys [x]
R2 Vihyajyoq;Vihyajyoq;c:\windows\System32\svchost.exe [2004-08-03 14336]
R3 SjyPkt;SjyPkt;c:\windows\System32\Drivers\SjyPkt.sys [2002-10-02 13532]
R3 W35UND;W89C35 802.11bg WLAN USB Adapter Driver;c:\windows\system32\DRIVERS\W35UND.SYS [2006-07-21 111232]
R3 xAntiArp;xAntiArpSpoof Service;c:\windows\system32\DRIVERS\xAntiArp.sys [x]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-04-18 33808]
S1 is-GIE86drv;is-GIE86drv;c:\windows\system32\DRIVERS\98747588.sys [2008-07-08 148496]
S1 wbsecdrv;wbsecdrv Protocol Driver;c:\windows\system32\DRIVERS\wbsecdrv.sys [2006-02-15 17952]
S2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [2008-01-17 24635]
S2 wbsecsvc;wbsecsvc;c:\windows\system32\wbsecsvc.exe [2006-07-14 274432]
S3 abp470n5;abp470n5;c:\windows\system32\drivers\kkhtnn.sys [x]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-11 194304]
--- Other Services/Drivers In Memory ---
*Deregistered* - abp470n5
*Deregistered* - ACS
*Deregistered* - AegisP
*Deregistered* - AFD
*Deregistered* - Apache2.2
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Compbatt
*Deregistered* - Crypkey License
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - gupdate1c9ac6c1739d950
*Deregistered* - gusvc
*Deregistered* - helpsvc
*Deregistered* - HTTP
*Deregistered* - HTTPFilter
*Deregistered* - ImapiService
*Deregistered* - IpFilterDriver
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - irda
*Deregistered* - Irmon
*Deregistered* - is-GIE86drv
*Deregistered* - kl1
*Deregistered* - klbg
*Deregistered* - klim5
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - MySQL
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - NetworkX
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PCIIde
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasirda
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VgaSave
*Deregistered* - Vihyajyoq
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - wbsecdrv
*Deregistered* - wbsecsvc
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Vihyajyoq
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{538a536a-0d7e-11de-869f-000ae450b7a0}]
\shElL\AUTOplay\cOmMAnd - tvvs.pif
\shElL\AutoRun\command - tvvs.pif
\shElL\explOre\CommAnd - tvvs.pif
\shElL\oPeN\commaNd - tvvs.pif
.
Contents of the 'Scheduled Tasks' folder
2009-05-06 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-24 10:33]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-07 20:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1606980848-1563985344-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]
@Class="Shell"
"a"="msnmsgr.exe"
"MRUList"="a"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4233ADD3-CD31-D295-804BA870321FDEF4}\{F4A8E5F3-7E68-2DD0-FA9D328203A7D1A7}\{07380252-9142-5EC5-94F639FC4AE64832}*]
"1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44,
fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74099617-91C0-6CB0-475BC8650FC6C929}\{C2CB2410-92BB-FC4E-376913EB15620FA4}\{B6CDFCFD-0A38-7380-A1288DE48E078F85}*]
"1D1OWFM6WKF6TLM3S2BGKKUUDG1"=hex:01,00,01,00,00,00,00,00,71,4a,e0,45,b7,4f,44,
fb,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{9D7D745F-2DA2-E26E-67E2A61C92B5C873}\{869A1319-CB5B-72EF-32E86935B8210920}\{0F637A1B-C125-DB37-203685E7DE12B741}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,28,56,85,
90,85,0f,ae,fb,7b,50,52,ff,71,85,ca,0f,6b,66,6c,55,3b,97,e1,d8,e7,4e,77,51,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A73A7B6D-D5C7-2D01-6A3ED58A203D5FEA}\{958FE6C0-B367-4AD6-C310294BFC5DB709}\{E2E9EAF6-387C-4947-07B2C800F4ACC9F3}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,28,56,85,
90,85,0f,ae,fb,7b,50,52,ff,71,85,ca,0f,6b,66,6c,55,3b,97,e1,d8,e7,4e,77,51,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{CE901474-3557-00BE-0B74D16C6C9B8223}\{8B1B0984-A0E2-36AE-AE0ABC7DD3EE1D9C}\{C1D3D6EB-516B-0CD4-D732D0B608CDF1EA}*]
"SE4K5INHHR1EDZYY15BVZC6TKG1"=hex:01,00,01,00,00,00,00,00,7e,c3,c3,8e,86,b4,21,
5e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{D96284CB-92E6-3E1E-196BB0273B005327}\{BCF0CDFC-4A0B-26E5-259182A4D665E8F2}\{6E248836-421D-F84C-CF6B8AC08EBF0D43}*]
"SE4K5INHHR1EDZYY15BVZC6TKG1"=hex:01,00,01,00,00,00,00,00,7e,c3,c3,8e,86,b4,21,
5e,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(996)
c:\windows\system32\athgina.dll
c:\windows\system32\athcfg11.dll
c:\windows\system32\athcfg11Res.dll
- - - - - - - > 'explorer.exe'(5584)
c:\windows\system32\msi.dll
c:\windows\system32\browselc.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\acs.exe
c:\windows\system32\Crypserv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\appserv\MySQL\bin\mysqld-nt.exe
c:\windows\system32\igfxtray.exe
c:\program files\Common Files\Real\Update_OB\realsched.exe
c:\program files\MSN Messenger\msnmsgr.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\docume~1\KHALID~1\LOCALS~1\temp\spruh.exe
c:\docume~1\KHALID~1\LOCALS~1\temp\winojewjl.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\windows\system32\mspaint.exe
c:\program files\Google\Update\Download\{8743E501-8D47-48C1-823C-5317CED449DD}\chrome_updater.exe
c:\windows\temp\CR_3.tmp\setup.exe
.
**************************************************************************
.
Completion time: 2009-05-07 20:15 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 17:14
Pre-Run: 8,449,626,112 bytes free
Post-Run: 8,356,077,568 bytes free
472
-------------------
ووبعدين قمت وشغلت ادات HiJackThis وسويت تقرير مره تاني زي ماقلت وجاء هذا التقرير
لداة HiJackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:17:22 م, on 07/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\AppServ\Apache2.2\bin\httpd.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\AppServ\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\wbsecsvc.exe
C:\AppServ\Apache2.2\bin\httpd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\DOCUME~1\KHALID~1\LOCALS~1\Temp\spruh.exe
C:\DOCUME~1\KHALID~1\LOCALS~1\Temp\winojewjl.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (file missing)
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [winlogon] C:\Documents and Settings\LocalService\svchost.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: REALTEK RTL8187 Wireless LAN Utility.lnk = C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: إحصائيات حماية حركة زيارة الويب - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) -
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: 0315291236965362mcinstcleanup - - (no file)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apache - Unknown owner - C:\AppServ\Apache\Apache.exe (file missing)
O23 - Service: Apache2.2 - Apache Software Foundation - C:\AppServ\Apache2.2\bin\httpd.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: خدمة تحديث Google (gupdate1c9ac6c1739d950) (gupdate1c9ac6c1739d950) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MySQL - Unknown owner - C:\AppServ\mysql\bin\mysqld-nt.exe
O23 - Service: wbsecsvc - Winbond - C:\WINDOWS\system32\wbsecsvc.exe
--
End of file - 7408 bytes
انتظر ردك اخويا
