هذا هو تقرير combofix :king:
ComboFix 09-05-18.02 - Free User 05/19/2009 2:01.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.3292.2782 [GMT 3:00]
Running from: c:\documents and settings\Free User\سطح المكتب\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090518-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))
.
2009-05-18 13:12 . 2009-05-12 10:20 173384 ----a-w c:\windows\system32\AVLibrary.dll
2009-05-18 13:12 . 2009-05-18 13:14 -------- dc-h--w c:\documents and settings\Free User\Local Settings\Application Data\~0
2009-05-18 11:55 . 2007-07-11 08:11 888832 ----a-w c:\windows\system32\securenet.dll
2009-05-18 11:45 . 2009-05-18 11:45 4096 ----a-w c:\windows\d3dx.dat
2009-05-17 17:56 . 2009-05-17 18:01 1089536 ----a-w c:\windows\system32\RainySs.scr
2009-05-14 09:17 . 2009-05-14 09:17 -------- d-----w c:\windows\Sun
2009-05-14 09:16 . 2009-05-14 09:16 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-14 09:15 . 2009-05-14 09:15 -------- d-----w c:\program files\Java
2009-05-09 22:04 . 2009-05-09 22:04 -------- d-----w c:\documents and settings\Free User\Local Settings\Application Data\Identities
2009-05-08 22:50 . 2009-05-08 22:50 -------- d-----w c:\program files\MSXML 4.0
2009-05-08 18:18 . 2009-05-08 18:18 -------- d-----w c:\program files\Common Files\EZB Systems
2009-05-08 18:18 . 2009-05-08 18:18 -------- d-----w c:\program files\UltraISO
2009-05-08 14:48 . 2009-05-08 14:48 -------- d-----w c:\program files\uTorrent
2009-05-08 14:48 . 2009-05-18 22:59 -------- d-----w c:\documents and settings\Free User\Application Data\uTorrent
2009-05-08 00:39 . 2009-02-09 11:22 2190592 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-08 00:39 . 2009-02-09 11:22 2146816 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-08 00:39 . 2009-02-09 11:22 2025472 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-08 00:32 . 2008-06-14 17:31 271616 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-08 00:32 . 2008-06-14 17:31 271616 ------w c:\windows\system32\drivers\bthport.sys
2009-05-08 00:19 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-07 12:02 . 2009-05-07 12:02 -------- d-----w c:\program files\VS Revo Group
2009-05-07 07:26 . 2008-07-09 07:34 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-07 07:26 . 2009-05-08 22:52 -------- d--h--w c:\windows\$hf_mig$
2009-05-07 07:25 . 2009-02-20 16:50 63488 -c----w c:\windows\system32\dllcache\icardie.dll
2009-05-07 07:25 . 2009-02-20 16:50 268288 -c----w c:\windows\system32\dllcache\iertutil.dll
2009-05-07 07:25 . 2009-02-20 16:50 52224 -c----w c:\windows\system32\dllcache\msfeedsbs.dll
2009-05-07 07:25 . 2009-02-20 10:20 13824 -c----w c:\windows\system32\dllcache\ieudinit.exe
2009-05-07 07:25 . 2009-02-20 16:50 459264 -c----w c:\windows\system32\dllcache\msfeeds.dll
2009-05-07 07:25 . 2008-07-09 14:25 2455488 -c----w c:\windows\system32\dllcache\ieapfltr.dat
2009-05-07 07:25 . 2009-02-20 16:50 383488 -c----w c:\windows\system32\dllcache\ieapfltr.dll
2009-05-07 07:25 . 2009-02-20 16:50 6066176 -c----w c:\windows\system32\dllcache\ieframe.dll
2009-05-06 17:24 . 2009-05-07 00:41 -------- d-----w c:\documents and settings\Free User\Local Settings\Application Data\Adobe
2009-05-06 17:15 . 2009-05-06 17:15 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 11:58 . 2008-04-15 12:00 60492 ----a-w c:\windows\system32\perfc001.dat
2009-05-18 11:58 . 2008-04-15 12:00 334024 ----a-w c:\windows\system32\perfh001.dat
2009-05-17 18:53 . 2009-05-06 16:09 664 ----a-w c:\windows\system32\d3d9caps.dat
2009-05-15 07:25 . 2009-05-06 15:20 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-05-07 22:52 . 2009-05-06 14:12 -------- d-----w c:\program files\Internet Download Manager
2009-05-06 15:51 . 2009-05-06 15:51 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-06 15:51 . 2009-05-06 15:51 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-06 15:49 . 2009-05-06 15:39 -------- d-----w c:\program files\HP
2009-05-06 15:46 . 2009-05-06 15:38 102148 ----a-w c:\windows\hpgins15.dat
2009-05-06 15:44 . 2009-05-06 15:28 31968 ----a-w c:\documents and settings\Free User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-06 15:44 . 2009-05-06 15:44 132 ----a-w c:\documents and settings\Free User\Local Settings\Application Data\fusioncache.dat
2009-05-06 15:42 . 2009-05-06 15:42 -------- d-----w c:\program files\Common Files\Sonic Shared
2009-05-06 15:42 . 2009-05-06 15:41 -------- d-----w c:\program files\Common Files\HP
2009-05-06 15:40 . 2009-05-06 15:40 -------- d-----w c:\program files\Hewlett-Packard
2009-05-06 15:40 . 2009-05-06 15:40 -------- d-----w c:\program files\Common Files\Hewlett-Packard
2009-05-06 15:20 . 2009-05-06 15:20 172032 ------w c:\windows\Setup1.exe
2009-05-06 15:20 . 2009-05-06 15:20 73216 ----a-w c:\windows\ST6UNST.EXE
2009-05-06 15:18 . 2009-05-06 15:18 -------- d-----w c:\program files\Bonjour
2009-05-06 15:17 . 2009-05-06 15:10 -------- d-----w c:\program files\Common Files\Adobe
2009-05-06 15:10 . 2009-05-06 15:10 -------- d-----w c:\program files\Common Files\Macrovision Shared
2009-05-06 14:48 . 2009-05-06 14:48 -------- d-----w c:\program files\GRETECH
2009-05-06 14:45 . 2009-05-06 14:43 -------- d-----w c:\program files\Shield
2009-05-06 14:26 . 2009-05-06 14:26 -------- d-----w c:\program files\Alwil Software
2009-05-06 14:19 . 2009-05-06 14:19 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-06 14:08 . 2009-05-06 14:08 -------- d-----w c:\program files\Dell
2009-05-06 14:04 . 2009-05-06 14:04 -------- d-----w c:\program files\microsoft frontpage
2009-05-06 14:01 . 2009-05-06 14:01 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-06 12:32 . 2009-05-06 14:19 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 12:32 . 2009-05-06 14:19 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-26 15:35 . 2009-04-29 12:20 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-03-06 14:20 . 2008-04-15 12:00 283136 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:06 . 2008-04-15 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 16:50 . 2008-04-15 12:00 78336 ----a-w c:\windows\system32\ieencode.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"shield"="c:\program files\Shield\shieldtray.exe" [2008-06-25 3231744]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-14 148888]
"MacrokeyManager"="WTMKM.exe" - c:\windows\system32\WTMKM.exe [2007-11-13 1969824]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
R0 Shdbus;Shdbus;c:\windows\system32\drivers\Shdbus.sys [06/05/2009 05:43 م 7360]
R0 Shield;Shield;c:\windows\system32\drivers\Shield.sys [06/05/2009 05:43 م 105408]
R0 Shieldf;Shieldf;c:\windows\system32\drivers\Shieldf.sys [06/05/2009 05:43 م 22976]
R0 Shieldm;Shieldm;c:\windows\system32\drivers\Shieldm.sys [06/05/2009 05:43 م 30528]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [06/05/2009 05:27 م 114768]
R1 cloverm;cloverm;c:\windows\system32\drivers\cloverm.sys [06/05/2009 05:43 م 477568]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [06/05/2009 05:27 م 20560]
R2 ShieldClientService;Shield Client Service;c:\program files\Shield\ShieldClnt.exe [06/05/2009 05:43 م 45056]
R2 WTService;WTService;c:\windows\system32\atwtusb.exe -s --> c:\windows\system32\atwtusb.exe -s [?]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [06/05/2009 05:09 م 144480]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - WS2IFSL
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-19 02:02
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{23bcab4a-7321-4993-b4d1-43d5053c92fb}]
@Denied: (Full) (Everyone)
"Model"=dword:00000089
"Therad"=dword:0000000d
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):8e,9a,39,ce,e2,f6,bd,2c,10,25,21,60,9e,d6,26,8a,2c,2e,53,74,f9,
f5,89,79,fa,4e,6d,12,5e,a2,3f,2c,28,8d,9b,19,b6,50,b1,92,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2960)
c:\program files\Shield\idle.dll
.
Completion time: 2009-05-18 2:02
ComboFix-quarantined-files.txt 2009-05-18 23:02
Pre-Run: 8,721,629,184 bytes free
Post-Run: 8,725,524,480 bytes free
153 --- E O F --- 2009-05-10 00:00
