اتفضل اخي العزيز وفقك الله
ComboFix 09-05-11.01 - Administrator 05/11/2009 23:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.254.97 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\documents and settings\Administrator\Application Data\tazebama
c:\documents and settings\Administrator\Application Data\tazebama\tazebama.log
c:\documents and settings\Administrator\Application Data\tazebama\zPharaoh.dat
c:\windows\system32\klogon.dll
C:\zPharaoh.exe
D:\Autorun.inf
d:\recycler\RECYCLER .exe
d:\recycler\WinrRarSerialInstall.exe
D:\zPharaoh.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-11 to 2009-05-11 )))))))))))))))))))))))))))))))
.
2009-10-02 00:32 . 2009-10-02 00:32 -------- d-s---w c:\documents and settings\Administrator\UserData
2009-10-01 23:59 . 2009-10-01 23:59 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-10-01 23:25 . 2007-08-08 09:13 24448 ----a-w c:\windows\system32\drivers\ewdcsc.sys
2009-10-01 23:25 . 2007-08-08 09:12 101120 ----a-w c:\windows\system32\drivers\ewusbmdm.sys
2009-05-11 20:26 . 2009-05-11 20:28 155451 --sh--r C:\zPharaoh.exe
2009-05-11 20:10 . 2009-05-11 20:28 -------- d-----w c:\documents and settings\Administrator\Application Data\tazebama
2009-05-11 19:12 . 2009-05-11 19:12 -------- d-----w c:\program files\Trend Micro
2009-05-11 18:41 . 2009-05-11 18:41 -------- d-----w c:\documents and settings\SYSTEM
2009-05-11 18:34 . 2009-05-11 18:34 74396 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-11 18:34 . 2009-05-11 18:34 75932 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-11 18:33 . 2009-05-11 18:33 -------- d-----w c:\program files\Kaspersky Anti-Virus 6.0
2009-05-11 18:33 . 2009-05-11 20:04 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-11 18:33 . 2009-05-11 20:11 7200 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-11 18:33 . 2009-05-11 20:27 307232 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-11 15:51 . 2009-05-11 18:30 -------- d--h--w c:\windows\$hf_mig$
2009-05-11 14:25 . 2009-05-11 14:25 -------- d-----w c:\windows\Start Menu
2009-05-11 14:19 . 2009-05-11 14:25 -------- d-----w c:\windows\Favorites
2009-05-09 19:28 . 2009-05-11 20:26 32768 ----a-w c:\documents and settings\tazebama.dll
2009-05-08 21:09 . 2009-05-08 21:09 -------- d--h--w c:\windows\PIF
2009-05-08 12:35 . 2009-05-11 18:14 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-08 11:23 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-05-08 11:22 . 2009-05-08 15:13 -------- d-----w c:\windows\BDOSCAN8
2009-05-08 11:16 . 2008-06-20 10:44 138368 ----a-w c:\windows\system32\drivers\afd.sys
2009-05-08 11:13 . 2004-08-03 21:55 144896 ----a-w c:\windows\system32\schannel.dll
2009-05-08 11:07 . 2004-08-03 21:55 680960 ----a-w c:\windows\system32\advapi32.dll
2009-05-08 11:07 . 2004-08-03 21:55 716288 ----a-w c:\windows\system32\lsasrv.dll
2009-05-08 11:07 . 2004-08-03 21:55 687104 ----a-w c:\windows\system32\ntdll.dll
2009-05-08 11:07 . 2004-08-03 21:56 108032 ----a-w c:\windows\system32\services.exe
2009-05-08 11:07 . 2004-08-03 22:08 2058368 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-05-08 11:07 . 2004-08-03 21:49 2182528 ----a-w c:\windows\system32\ntoskrnl.exe
2009-05-08 11:04 . 2001-09-19 12:00 200064 ----a-w c:\windows\system32\drivers\rmcast.sys
2009-05-08 11:04 . 2004-08-03 20:15 451456 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2009-05-08 11:04 . 2004-08-03 20:14 336256 ----a-w c:\windows\system32\drivers\srv.sys
2009-05-08 11:01 . 2004-08-03 21:46 1835776 ----a-w c:\windows\system32\win32k.sys
2009-05-08 11:01 . 2004-08-03 20:14 359040 ----a-w c:\windows\system32\drivers\tcpip.sys
2009-05-08 11:01 . 2004-08-03 20:07 223616 ----a-w c:\windows\system32\drivers\tcpip6.sys
2009-05-08 10:02 . 2009-05-08 10:47 -------- d-----w c:\windows\LastGood(2)
2009-05-07 23:16 . 2009-05-07 23:16 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-05-07 21:05 . 2008-07-09 07:34 26488 ----a-w c:\windows\system32\spupdsvc.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 20:11 . 2009-05-11 18:33 5600 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-11 20:11 . 2009-05-11 18:33 2744 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-11 20:09 . 2004-08-03 21:56 1186159 ----a-w c:\windows\explorer.exe
2009-05-11 19:09 . 2009-01-06 08:35 256367 ----a-w c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2009-05-11 19:09 . 2009-01-06 08:35 900463 ----a-w c:\windows\pchealth\helpctr\binaries\HelpSvc.exe
2009-05-11 19:04 . 2001-09-19 12:00 3531167 ----a-w c:\windows\Help\Tours\mmTour\tour.exe
2009-05-11 18:59 . 2004-08-03 21:56 440687 ----a-w c:\windows\winhlp32.exe
2009-05-11 18:59 . 2001-09-19 12:00 182127 ----a-w c:\windows\twunk_32.exe
2009-05-11 18:59 . 2004-08-03 21:56 303471 ----a-w c:\windows\regedit.exe
2009-05-11 18:59 . 2009-01-06 11:21 225647 ----a-w c:\windows\NOTEPAD.EXE
2009-05-11 18:59 . 2004-08-03 21:56 167279 ----a-w c:\windows\hh.exe
2009-05-11 18:59 . 2009-01-06 09:15 214895 ----a-w c:\windows\agrsmdel.exe
2009-05-11 16:30 . 2001-09-19 12:00 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-11 16:30 . 2001-09-19 12:00 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-11 14:58 . 2009-01-06 08:35 314735 ----a-w c:\windows\pchealth\helpctr\binaries\msconfig.exe
2009-05-11 14:58 . 2009-01-06 08:35 925039 ----a-w c:\windows\pchealth\helpctr\binaries\helpctr.exe
2009-05-11 14:28 . 2009-01-06 09:28 -------- d-----w c:\program files\Real
2009-05-08 20:44 . 2009-01-06 09:27 -------- d-----w c:\program files\JetAudio
2009-05-08 19:43 . 2004-08-03 21:56 372079 ----a-w c:\windows\system32\osk.exe
2009-05-08 19:43 . 2004-08-03 21:56 225647 ----a-w c:\windows\system32\notepad.exe
2009-05-08 19:43 . 2004-08-03 21:56 299375 ----a-w c:\windows\system32\mobsync.exe
2009-05-08 19:43 . 2004-08-03 21:56 229231 ----a-w c:\windows\system32\magnify.exe
2009-05-08 19:43 . 2004-08-03 21:56 545135 ----a-w c:\windows\system32\cmd.exe
2009-05-08 18:19 . 2007-11-19 11:24 2683327 ----a-w c:\windows\Install_B4Playing.exe
2009-05-08 12:14 . 2009-01-06 09:25 -------- d-----w c:\program files\RealPlayer v 11 0 0 372 Plus
2009-05-08 12:09 . 2009-01-06 09:28 -------- d-----w c:\program files\Google
2009-05-08 12:08 . 2009-01-06 09:25 -------- d-----w c:\program files\DivX
2009-05-08 12:05 . 2009-01-06 17:24 -------- d-----w c:\program files\ALJAWAL 3.5G HSDPA DATA CARD
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-01-06 171448]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2009-05-11 1824111]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-01-23 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-01-23 114688]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-01-06 185896]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2002-12-20 87751]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"StartMenuLogoff"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ALJAWAL 3.5G HSDPA DATA CARD\\ALJAWAL 3.5G HSDPA DATA CARD.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
R3 {5C8B2B65-A385-11d5-A78B-00104B672758};AIM 3.0 Part 01 Codec Driver CH-7017-B;c:\windows\system32\drivers\a310.sys [06/01/2009 11:59 ص 33335]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30869368-dc16-11dd-8061-0000e2a085d7}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8101509f-9a6b-11de-8064-0000e2a085d7}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a458c4e0-a466-11de-806a-0000e2a085d7}]
\Shell\AutoRun\command - G:\zPharaoh.exe
\Shell\explore\command - G:\zPharaoh.exe
\Shell\open\command - G:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae14678f-dc1c-11dd-8062-0000e2a085d7}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae146842-dc1c-11dd-8062-0000e2a085d7}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b66d52c3-aee0-11de-806e-0000e2a085d7}]
\Shell\AutoRun\command - F:\AutoRun.exe
.
.
------- Supplementary Scan -------
.
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-11 23:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2384)
c:\documents and settings\tazebama.dll
c:\program files\Kaspersky Anti-Virus 6.0\scrchpg.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Kaspersky Anti-Virus 6.0\avp.exe
c:\documents and settings\tazebama.dl_
.
**************************************************************************
.
Completion time: 2009-05-11 23:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-11 20:32
Pre-Run: 17,846,616,064 bytes free
Post-Run: 17,877,639,168 bytes free
180 --- E O F --- 2009-05-11 17:24
