- بادئ الموضوع fahad923
- تاريخ البدء
- 812
غير متصل
الله لا يهينك عطني تقرير
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
توقيع : Juve Guard
تأييد
0
شكرا على ردك السريع .. واعتذر عن كتابت موضوعي بالقسم الخاطىء ..
هل من الممكن شرح لي كيفية قرائة التقرير ..؟
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:46:40 ص, on 19/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\fahd\سطح المكتب\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
F2 - REG:system.ini: Shell=Explorer.exe
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: "إضافة إلى حاجب الدعايات" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE (file missing)
--
End of file - 5566 bytes
هل من الممكن شرح لي كيفية قرائة التقرير ..؟
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:46:40 ص, on 19/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Documents and Settings\fahd\سطح المكتب\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
F2 - REG:system.ini: Shell=Explorer.exe
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: "إضافة إلى حاجب الدعايات" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE (file missing)
--
End of file - 5566 bytes
تأييد
0
سيدي رايتر
زيزوومى فعال
غير متصل
k:جرب او لا تجرب
حبيبي اعد تشغيل الجهاز ثم ادخل بالوضع الامن
واذهب الى قرص السي (C)
فتجد هذا الفيروس امامك مباشرة
قم بالضغط عليه بالزر الايمن ثم حذف
ثم قم بتحميل هذه الاداة لازالة بقايا هذا الفايروس
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
تأييد
0
MAAX
عضوشرف
غير متصل
عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة
ثم
حمل الاداة التالية واحفظها على سطح المكتب
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة
تأييد
0
شكرا عزيزي ماكس
وهذ1 التقرير
ComboFix 09-05-18.06 - fahd 05/19/2009 17:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.759.506 [GMT 3:00]
Running from: c:\documents and settings\fahd\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.
2009-05-19 12:32 . 2009-05-19 12:32 -------- d-----w c:\documents and settings\fahd\Application Data\CyberScrub
2009-05-19 12:30 . 2009-05-19 13:01 -------- d-----w c:\program files\Registry Fast
2009-05-19 12:29 . 2009-05-19 12:29 -------- d-----w c:\documents and settings\fahd\Application Data\cleaner
2009-05-19 12:27 . 2009-05-19 12:27 -------- d-----w c:\program files\Abadisoft Group
2009-05-19 01:01 . 2009-05-19 01:01 -------- d-----w c:\documents and settings\fahd\Application Data\AdobeUM
2009-05-19 01:01 . 2009-05-19 01:01 -------- d-----w c:\documents and settings\fahd\Local Settings\Application Data\Adobe
2009-05-19 01:00 . 2009-05-19 01:01 -------- d-----w c:\program files\Common Files\Adobe
2009-05-19 00:46 . 2009-05-19 00:46 -------- d-----w c:\windows\Cache
2009-05-17 09:48 . 2009-05-17 09:48 -------- d-----w c:\documents and settings\fahd\Local Settings\Application Data\Identities
2009-05-17 02:47 . 2009-05-17 02:52 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-17 02:47 . 2009-05-17 02:47 -------- d-----w c:\program files\Nsasoft
2009-05-16 04:20 . 2001-12-21 12:26 286720 ----a-w C:\wpclient.exe
2009-05-16 04:20 . 2001-12-21 12:26 36864 ----a-w C:\wpclifra.dll
2009-05-16 04:19 . 1999-10-14 10:12 31232 ----a-w c:\windows\capi2032.dll
2009-05-16 04:19 . 2001-12-10 12:33 10201 ----a-w c:\windows\system32\WWBPACK.sys
2009-05-16 04:19 . 2001-11-16 12:49 18418 ----a-w c:\windows\system32\wwbpras.sys
2009-05-16 04:19 . 2009-05-16 04:20 -------- d-----w c:\program files\PROSUM
2009-05-16 04:19 . 1997-11-19 12:49 303616 ----a-w c:\windows\IsUninst.exe
2009-05-16 04:19 . 2009-05-16 04:19 -------- d-----w c:\documents and settings\fahd\WINDOWS
2009-05-16 04:01 . 2009-05-16 04:01 -------- d-sh--w c:\documents and settings\fahd\PrivacIE
2009-05-16 04:01 . 2009-05-16 04:01 -------- d-sh--w c:\documents and settings\fahd\IECompatCache
2009-05-16 03:23 . 2009-05-16 03:23 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-16 03:23 . 2009-05-16 03:23 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-16 03:22 . 2009-05-16 03:22 -------- d-sh--w c:\documents and settings\fahd\IETldCache
2009-05-16 01:32 . 2009-05-16 01:32 -------- d-----w c:\windows\ie8updates
2009-05-16 01:32 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-16 01:29 . 2009-05-16 01:32 -------- dc-h--w c:\windows\ie8
2009-05-15 21:58 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-05-14 01:24 . 2009-05-14 01:24 -------- d-----w c:\documents and settings\fahd\Application Data\Any Video Converter
2009-05-14 01:24 . 2009-05-14 01:24 -------- d-----w c:\program files\Any Video Converter
2009-05-14 00:43 . 2009-05-19 00:25 -------- d-----w c:\program files\Hotspot Shield
2009-05-13 13:58 . 2009-05-16 03:22 -------- d-----w c:\windows\system32\ar-sa
2009-05-13 13:58 . 2009-05-13 13:58 -------- d-----w c:\windows\l2schemas
2009-05-13 13:58 . 2009-05-13 13:58 -------- d-----w c:\windows\system32\ar
2009-05-13 13:58 . 2009-05-13 13:58 -------- d-----w c:\windows\system32\bits
2009-05-13 13:53 . 2009-05-13 13:58 -------- d-----w c:\windows\ServicePackFiles
2009-05-13 02:43 . 2009-05-13 02:43 203776 ----a-w c:\windows\system32\clrviddc.dll
2009-05-13 02:37 . 2009-05-13 02:37 47104 ------w c:\windows\AKDeInstall.exe
2009-05-13 02:37 . 2009-05-13 02:37 -------- d-----w c:\program files\mpegable
2009-05-13 02:31 . 2009-05-13 02:31 -------- d-----w c:\program files\Common Files\xing shared
2009-05-13 02:31 . 2009-05-13 02:31 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-13 02:31 . 2009-05-13 02:31 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-13 02:31 . 2009-05-13 02:31 -------- d-----w c:\program files\Common Files\Real
2009-05-13 02:31 . 2009-05-13 02:31 -------- d-----w c:\program files\Real
2009-05-13 00:12 . 2008-04-13 18:51 101120 ----a-w c:\windows\system32\drivers\bthpan.sys
2009-05-13 00:11 . 2008-04-13 18:46 59136 ----a-w c:\windows\system32\drivers\rfcomm.sys
2009-05-13 00:11 . 2008-04-13 18:46 17024 ----a-w c:\windows\system32\drivers\bthenum.sys
2009-05-13 00:11 . 2008-06-14 17:31 271616 ----a-w c:\windows\system32\drivers\bthport.sys
2009-05-13 00:11 . 2008-04-13 18:46 18944 ----a-w c:\windows\system32\drivers\bthusb.sys
2009-05-12 11:20 . 2004-08-03 19:41 180360 ------w c:\windows\system32\drivers\ntmtlfax.sys
2009-05-12 11:20 . 2001-09-19 12:00 403 -c----w c:\windows\system32\dllcache\npdrmv2.zip
2009-05-12 11:20 . 2001-09-19 12:00 22060 -c----w c:\windows\system32\dllcache\npds.zip
2009-05-12 11:20 . 2004-08-03 19:29 452736 ------w c:\windows\system32\drivers\mtxparhm.sys
2009-05-12 11:20 . 2004-08-03 19:41 1309184 ------w c:\windows\system32\drivers\mtlstrm.sys
2009-05-12 11:20 . 2004-08-03 19:41 126686 ------w c:\windows\system32\drivers\mtlmnt5.sys
2009-05-12 11:20 . 2004-08-03 19:41 11868 ------w c:\windows\system32\drivers\mdmxsdk.sys
2009-05-12 11:20 . 2004-08-03 19:41 1041536 ------w c:\windows\system32\drivers\hsfdpsp2.sys
2009-05-12 11:20 . 2004-08-03 19:41 685056 ------w c:\windows\system32\drivers\hsfcxts2.sys
2009-05-12 11:20 . 2004-08-03 19:41 220032 ------w c:\windows\system32\drivers\hsfbs2s2.sys
2009-05-12 10:54 . 2008-06-14 17:31 271616 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-12 10:53 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-12 10:53 . 2009-02-09 11:22 2190592 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-12 10:53 . 2009-03-06 14:20 283136 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-12 10:53 . 2009-02-09 11:21 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-12 10:53 . 2009-02-09 10:51 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-05-12 10:53 . 2009-02-09 10:51 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-12 10:53 . 2009-02-09 10:51 681472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-12 10:53 . 2009-02-09 10:51 723456 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-12 10:53 . 2009-02-09 10:51 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-12 10:53 . 2009-02-09 10:51 693760 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-12 10:53 . 2009-02-09 11:22 2146816 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-12 10:53 . 2009-02-09 11:22 2025472 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-12 10:48 . 2008-05-08 14:02 203136 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-12 10:48 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-12 10:48 . 2008-12-11 10:57 333952 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-12 10:44 . 2008-04-11 19:04 691712 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-12 10:43 . 2008-04-21 21:14 215040 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-12 10:43 . 2008-10-15 16:35 337408 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-11 17:56 . 2009-01-07 15:20 26144 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-11 17:56 . 2009-05-16 01:32 -------- d--h--w c:\windows\$hf_mig$
2009-05-11 17:49 . 2009-05-11 17:49 -------- d-----w c:\documents and settings\fahd\Contacts
2009-05-11 17:47 . 2009-05-15 22:01 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-11 17:20 . 2009-05-11 17:20 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-05-11 17:20 . 2009-05-11 17:20 -------- d-----w c:\program files\Common Files\Macrovision Shared
2009-05-11 17:20 . 2009-05-11 17:20 -------- d-----w c:\program files\Common Files\Intel
2009-05-11 16:38 . 2009-05-11 16:38 -------- d-----w c:\program files\Circle Developement
2009-05-11 16:38 . 2009-05-11 16:38 -------- d-----w c:\program files\Windows Live
2009-05-11 16:38 . 2009-05-18 22:38 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-11 16:34 . 2009-05-11 16:34 -------- d-----w c:\program files\Microsoft.NET
2009-05-11 16:33 . 2009-05-11 16:34 -------- d-----w c:\windows\SHELLNEW
2009-05-11 16:18 . 2007-04-09 19:23 28040 ----a-w c:\windows\system32\mdimon.dll
2009-05-11 16:01 . 2009-05-11 16:01 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-11 16:00 . 2009-05-13 14:13 -------- d-----w c:\program files\MSN Messenger
2009-05-11 15:12 . 2009-05-11 15:12 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-11 14:42 . 2009-05-11 14:42 -------- d--h--w c:\windows\PIF
2009-05-11 14:33 . 2009-05-11 15:15 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-11 14:33 . 2009-05-11 15:15 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-11 14:33 . 2009-05-19 14:36 1838624 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-11 14:33 . 2009-05-19 14:36 426016 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-11 14:33 . 2009-05-11 14:33 -------- d-----w c:\program files\Kaspersky Lab
2009-05-11 14:33 . 2009-05-19 14:37 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-11 14:32 . 2009-05-11 14:32 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-11 14:04 . 2009-05-11 16:37 92992 ----a-w c:\documents and settings\fahd\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-11 13:58 . 2009-02-13 08:31 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-11 13:58 . 2009-05-11 14:31 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-11 13:15 . 2009-05-11 13:15 -------- d-----w c:\documents and settings\fahd\Local Settings\Application Data\ESET
2009-05-11 13:06 . 2009-05-11 13:06 -------- d-s---w c:\documents and settings\fahd\UserData
2009-05-11 12:58 . 2009-05-11 12:58 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-11 12:13 . 2009-05-11 12:13 -------- d-----w c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-05-11 12:12 . 2009-05-11 12:44 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-11 12:06 . 2005-03-22 05:58 159744 ----a-r c:\windows\system32\igfxres.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 14:42 . 2001-09-19 12:00 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-19 14:42 . 2001-09-19 12:00 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-19 14:36 . 2009-05-11 14:33 3584 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-19 14:36 . 2009-05-11 14:33 16492 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-19 00:45 . 2009-05-10 23:42 -------- d-----w c:\program files\Intel
2009-05-11 15:15 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-10 23:58 . 2009-05-10 23:41 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-10 23:57 . 2009-05-10 23:41 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-10 23:53 . 2009-05-10 23:53 -------- d-----w c:\program files\Broadcom
2009-05-10 23:47 . 2009-05-10 23:47 -------- d-----w c:\program files\Synaptics
2009-05-10 23:46 . 2009-05-10 23:46 -------- d-----w c:\program files\Realtek Sound Manager
2009-05-10 23:46 . 2009-05-10 23:46 -------- d-----w c:\program files\AvRack
2009-05-10 23:34 . 2009-05-10 23:34 -------- d-----w c:\program files\microsoft frontpage
2009-05-10 23:28 . 2009-05-10 23:28 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2004-08-03 21:55 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 21:55 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 21:55 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 21:55 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 21:55 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 21:55 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 21:55 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 21:53 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 21:56 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-09-19 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-03 21:55 283136 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-19_14.20.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-09-19 12:00 . 2009-05-19 12:42 40326 c:\windows\system32\perfc009.dat
+ 2001-09-19 12:00 . 2009-05-19 14:42 40326 c:\windows\system32\perfc009.dat
+ 2001-09-19 12:00 . 2009-05-19 14:42 311938 c:\windows\system32\perfh009.dat
- 2001-09-19 12:00 . 2009-05-19 12:42 311938 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-03-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-03-22 126976]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 102491]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 692315]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-11 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-13 198160]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-12-01 77824]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 2009\\avp.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R1 WWBPRAS;RAS Support for WooWeb-PRO;c:\program files\PROSUM\wwbpras.sys [16/05/2009 07:19 ص 18418]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.EXE --> c:\program files\Hotspot Shield\bin\HssTrayService.EXE [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-19 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-19 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-19 c:\windows\Tasks\User_Feed_Synchronization-{20F7E15F-F9EE-46A9-98FA-339E7F30978B}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: "إضافة إلى حاجب الدعايات" - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-19 17:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2025429265-1757981266-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3456)
c:\windows\system32\SynTPFcs.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-05-19 17:47
ComboFix-quarantined-files.txt 2009-05-19 14:47
ComboFix2.txt 2009-05-19 14:24
Pre-Run: 33,173,561,344 bytes free
Post-Run: 33,160,232,960 bytes free
233 --- E O F --- 2009-05-16 08:06
وهذ1 التقرير
ComboFix 09-05-18.06 - fahd 05/19/2009 17:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.759.506 [GMT 3:00]
Running from: c:\documents and settings\fahd\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.
2009-05-19 12:32 . 2009-05-19 12:32 -------- d-----w c:\documents and settings\fahd\Application Data\CyberScrub
2009-05-19 12:30 . 2009-05-19 13:01 -------- d-----w c:\program files\Registry Fast
2009-05-19 12:29 . 2009-05-19 12:29 -------- d-----w c:\documents and settings\fahd\Application Data\cleaner
2009-05-19 12:27 . 2009-05-19 12:27 -------- d-----w c:\program files\Abadisoft Group
2009-05-19 01:01 . 2009-05-19 01:01 -------- d-----w c:\documents and settings\fahd\Application Data\AdobeUM
2009-05-19 01:01 . 2009-05-19 01:01 -------- d-----w c:\documents and settings\fahd\Local Settings\Application Data\Adobe
2009-05-19 01:00 . 2009-05-19 01:01 -------- d-----w c:\program files\Common Files\Adobe
2009-05-19 00:46 . 2009-05-19 00:46 -------- d-----w c:\windows\Cache
2009-05-17 09:48 . 2009-05-17 09:48 -------- d-----w c:\documents and settings\fahd\Local Settings\Application Data\Identities
2009-05-17 02:47 . 2009-05-17 02:52 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-17 02:47 . 2009-05-17 02:47 -------- d-----w c:\program files\Nsasoft
2009-05-16 04:20 . 2001-12-21 12:26 286720 ----a-w C:\wpclient.exe
2009-05-16 04:20 . 2001-12-21 12:26 36864 ----a-w C:\wpclifra.dll
2009-05-16 04:19 . 1999-10-14 10:12 31232 ----a-w c:\windows\capi2032.dll
2009-05-16 04:19 . 2001-12-10 12:33 10201 ----a-w c:\windows\system32\WWBPACK.sys
2009-05-16 04:19 . 2001-11-16 12:49 18418 ----a-w c:\windows\system32\wwbpras.sys
2009-05-16 04:19 . 2009-05-16 04:20 -------- d-----w c:\program files\PROSUM
2009-05-16 04:19 . 1997-11-19 12:49 303616 ----a-w c:\windows\IsUninst.exe
2009-05-16 04:19 . 2009-05-16 04:19 -------- d-----w c:\documents and settings\fahd\WINDOWS
2009-05-16 04:01 . 2009-05-16 04:01 -------- d-sh--w c:\documents and settings\fahd\PrivacIE
2009-05-16 04:01 . 2009-05-16 04:01 -------- d-sh--w c:\documents and settings\fahd\IECompatCache
2009-05-16 03:23 . 2009-05-16 03:23 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-16 03:23 . 2009-05-16 03:23 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-16 03:22 . 2009-05-16 03:22 -------- d-sh--w c:\documents and settings\fahd\IETldCache
2009-05-16 01:32 . 2009-05-16 01:32 -------- d-----w c:\windows\ie8updates
2009-05-16 01:32 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-16 01:29 . 2009-05-16 01:32 -------- dc-h--w c:\windows\ie8
2009-05-15 21:58 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-05-14 01:24 . 2009-05-14 01:24 -------- d-----w c:\documents and settings\fahd\Application Data\Any Video Converter
2009-05-14 01:24 . 2009-05-14 01:24 -------- d-----w c:\program files\Any Video Converter
2009-05-14 00:43 . 2009-05-19 00:25 -------- d-----w c:\program files\Hotspot Shield
2009-05-13 13:58 . 2009-05-16 03:22 -------- d-----w c:\windows\system32\ar-sa
2009-05-13 13:58 . 2009-05-13 13:58 -------- d-----w c:\windows\l2schemas
2009-05-13 13:58 . 2009-05-13 13:58 -------- d-----w c:\windows\system32\ar
2009-05-13 13:58 . 2009-05-13 13:58 -------- d-----w c:\windows\system32\bits
2009-05-13 13:53 . 2009-05-13 13:58 -------- d-----w c:\windows\ServicePackFiles
2009-05-13 02:43 . 2009-05-13 02:43 203776 ----a-w c:\windows\system32\clrviddc.dll
2009-05-13 02:37 . 2009-05-13 02:37 47104 ------w c:\windows\AKDeInstall.exe
2009-05-13 02:37 . 2009-05-13 02:37 -------- d-----w c:\program files\mpegable
2009-05-13 02:31 . 2009-05-13 02:31 -------- d-----w c:\program files\Common Files\xing shared
2009-05-13 02:31 . 2009-05-13 02:31 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-13 02:31 . 2009-05-13 02:31 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-13 02:31 . 2009-05-13 02:31 -------- d-----w c:\program files\Common Files\Real
2009-05-13 02:31 . 2009-05-13 02:31 -------- d-----w c:\program files\Real
2009-05-13 00:12 . 2008-04-13 18:51 101120 ----a-w c:\windows\system32\drivers\bthpan.sys
2009-05-13 00:11 . 2008-04-13 18:46 59136 ----a-w c:\windows\system32\drivers\rfcomm.sys
2009-05-13 00:11 . 2008-04-13 18:46 17024 ----a-w c:\windows\system32\drivers\bthenum.sys
2009-05-13 00:11 . 2008-06-14 17:31 271616 ----a-w c:\windows\system32\drivers\bthport.sys
2009-05-13 00:11 . 2008-04-13 18:46 18944 ----a-w c:\windows\system32\drivers\bthusb.sys
2009-05-12 11:20 . 2004-08-03 19:41 180360 ------w c:\windows\system32\drivers\ntmtlfax.sys
2009-05-12 11:20 . 2001-09-19 12:00 403 -c----w c:\windows\system32\dllcache\npdrmv2.zip
2009-05-12 11:20 . 2001-09-19 12:00 22060 -c----w c:\windows\system32\dllcache\npds.zip
2009-05-12 11:20 . 2004-08-03 19:29 452736 ------w c:\windows\system32\drivers\mtxparhm.sys
2009-05-12 11:20 . 2004-08-03 19:41 1309184 ------w c:\windows\system32\drivers\mtlstrm.sys
2009-05-12 11:20 . 2004-08-03 19:41 126686 ------w c:\windows\system32\drivers\mtlmnt5.sys
2009-05-12 11:20 . 2004-08-03 19:41 11868 ------w c:\windows\system32\drivers\mdmxsdk.sys
2009-05-12 11:20 . 2004-08-03 19:41 1041536 ------w c:\windows\system32\drivers\hsfdpsp2.sys
2009-05-12 11:20 . 2004-08-03 19:41 685056 ------w c:\windows\system32\drivers\hsfcxts2.sys
2009-05-12 11:20 . 2004-08-03 19:41 220032 ------w c:\windows\system32\drivers\hsfbs2s2.sys
2009-05-12 10:54 . 2008-06-14 17:31 271616 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-12 10:53 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-12 10:53 . 2009-02-09 11:22 2190592 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-12 10:53 . 2009-03-06 14:20 283136 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-12 10:53 . 2009-02-09 11:21 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-12 10:53 . 2009-02-09 10:51 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-05-12 10:53 . 2009-02-09 10:51 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-12 10:53 . 2009-02-09 10:51 681472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-05-12 10:53 . 2009-02-09 10:51 723456 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-12 10:53 . 2009-02-09 10:51 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-12 10:53 . 2009-02-09 10:51 693760 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-05-12 10:53 . 2009-02-09 11:22 2146816 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-12 10:53 . 2009-02-09 11:22 2025472 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-12 10:48 . 2008-05-08 14:02 203136 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-12 10:48 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-12 10:48 . 2008-12-11 10:57 333952 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-12 10:44 . 2008-04-11 19:04 691712 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-12 10:43 . 2008-04-21 21:14 215040 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-12 10:43 . 2008-10-15 16:35 337408 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-11 17:56 . 2009-01-07 15:20 26144 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-11 17:56 . 2009-05-16 01:32 -------- d--h--w c:\windows\$hf_mig$
2009-05-11 17:49 . 2009-05-11 17:49 -------- d-----w c:\documents and settings\fahd\Contacts
2009-05-11 17:47 . 2009-05-15 22:01 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-11 17:20 . 2009-05-11 17:20 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-05-11 17:20 . 2009-05-11 17:20 -------- d-----w c:\program files\Common Files\Macrovision Shared
2009-05-11 17:20 . 2009-05-11 17:20 -------- d-----w c:\program files\Common Files\Intel
2009-05-11 16:38 . 2009-05-11 16:38 -------- d-----w c:\program files\Circle Developement
2009-05-11 16:38 . 2009-05-11 16:38 -------- d-----w c:\program files\Windows Live
2009-05-11 16:38 . 2009-05-18 22:38 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-11 16:34 . 2009-05-11 16:34 -------- d-----w c:\program files\Microsoft.NET
2009-05-11 16:33 . 2009-05-11 16:34 -------- d-----w c:\windows\SHELLNEW
2009-05-11 16:18 . 2007-04-09 19:23 28040 ----a-w c:\windows\system32\mdimon.dll
2009-05-11 16:01 . 2009-05-11 16:01 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-11 16:00 . 2009-05-13 14:13 -------- d-----w c:\program files\MSN Messenger
2009-05-11 15:12 . 2009-05-11 15:12 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-11 14:42 . 2009-05-11 14:42 -------- d--h--w c:\windows\PIF
2009-05-11 14:33 . 2009-05-11 15:15 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-11 14:33 . 2009-05-11 15:15 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-11 14:33 . 2009-05-19 14:36 1838624 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-11 14:33 . 2009-05-19 14:36 426016 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-11 14:33 . 2009-05-11 14:33 -------- d-----w c:\program files\Kaspersky Lab
2009-05-11 14:33 . 2009-05-19 14:37 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-11 14:32 . 2009-05-11 14:32 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-11 14:04 . 2009-05-11 16:37 92992 ----a-w c:\documents and settings\fahd\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-11 13:58 . 2009-02-13 08:31 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-11 13:58 . 2009-05-11 14:31 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-11 13:15 . 2009-05-11 13:15 -------- d-----w c:\documents and settings\fahd\Local Settings\Application Data\ESET
2009-05-11 13:06 . 2009-05-11 13:06 -------- d-s---w c:\documents and settings\fahd\UserData
2009-05-11 12:58 . 2009-05-11 12:58 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-11 12:13 . 2009-05-11 12:13 -------- d-----w c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-05-11 12:12 . 2009-05-11 12:44 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-11 12:06 . 2005-03-22 05:58 159744 ----a-r c:\windows\system32\igfxres.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 14:42 . 2001-09-19 12:00 40316 ----a-w c:\windows\system32\perfc001.dat
2009-05-19 14:42 . 2001-09-19 12:00 251946 ----a-w c:\windows\system32\perfh001.dat
2009-05-19 14:36 . 2009-05-11 14:33 3584 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-19 14:36 . 2009-05-11 14:33 16492 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-19 00:45 . 2009-05-10 23:42 -------- d-----w c:\program files\Intel
2009-05-11 15:15 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-10 23:58 . 2009-05-10 23:41 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-10 23:57 . 2009-05-10 23:41 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-10 23:53 . 2009-05-10 23:53 -------- d-----w c:\program files\Broadcom
2009-05-10 23:47 . 2009-05-10 23:47 -------- d-----w c:\program files\Synaptics
2009-05-10 23:46 . 2009-05-10 23:46 -------- d-----w c:\program files\Realtek Sound Manager
2009-05-10 23:46 . 2009-05-10 23:46 -------- d-----w c:\program files\AvRack
2009-05-10 23:34 . 2009-05-10 23:34 -------- d-----w c:\program files\microsoft frontpage
2009-05-10 23:28 . 2009-05-10 23:28 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2004-08-03 21:55 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 21:55 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 21:55 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 21:55 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 21:55 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 21:55 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 21:55 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 21:53 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 21:56 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-09-19 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-03 21:55 283136 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-19_14.20.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-09-19 12:00 . 2009-05-19 12:42 40326 c:\windows\system32\perfc009.dat
+ 2001-09-19 12:00 . 2009-05-19 14:42 40326 c:\windows\system32\perfc009.dat
+ 2001-09-19 12:00 . 2009-05-19 14:42 311938 c:\windows\system32\perfh009.dat
- 2001-09-19 12:00 . 2009-05-19 12:42 311938 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-03-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-03-22 126976]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 102491]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 692315]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-11 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-13 198160]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-12-01 77824]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 2009\\avp.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R1 WWBPRAS;RAS Support for WooWeb-PRO;c:\program files\PROSUM\wwbpras.sys [16/05/2009 07:19 ص 18418]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.EXE --> c:\program files\Hotspot Shield\bin\HssTrayService.EXE [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-19 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-19 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-19 c:\windows\Tasks\User_Feed_Synchronization-{20F7E15F-F9EE-46A9-98FA-339E7F30978B}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: "إضافة إلى حاجب الدعايات" - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2009-05-19 17:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2025429265-1757981266-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3456)
c:\windows\system32\SynTPFcs.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-05-19 17:47
ComboFix-quarantined-files.txt 2009-05-19 14:47
ComboFix2.txt 2009-05-19 14:24
Pre-Run: 33,173,561,344 bytes free
Post-Run: 33,160,232,960 bytes free
233 --- E O F --- 2009-05-16 08:06
تأييد
0
MAAX
عضوشرف
غير متصل
اعد اسستخدام هذه الاداة بالوضع الامن
جرب او لا تجرب
حبيبي اعد تشغيل الجهاز ثم ادخل بالوضع الامن
واذهب الى قرص السي (c)
فتجد هذا الفيروس امامك مباشرة
قم بالضغط عليه بالزر الايمن ثم حذف
ثم قم بتحميل هذه الاداة لازالة بقايا هذا الفايروس
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
تأييد
0
MMA_LORD_735
زيزوومي جديد
- إنضم
- 17 مايو 2008
- المشاركات
- 3,645
- مستوى التفاعل
- 7
- النقاط
- 0
غير متصل
مرحباً ...
قد يكون البرنامج مسح أثار الفايروس من على رجستري ...
و مسح مفتاحه ألي ضايفه ...
أي أستفسار آخر ؟
توقيع : MMA_LORD_735
تأييد
0