اعدت تشغيل الجهاز تحمل معي
و هذا التقرير بس على فكرة ظهرت لي رسالة واحدة فقط و ضغط يس
هذا التقرير
ComboFix 09-05-20.A0 - I-R-I 05/21/2009 13:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.223.76 [GMT 3:00]
Running from: c:\documents and settings\I-R-I\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\winntue16.dll
D:\Desktop.ini
.
((((((((((((((((((((((((( Files Created from 2009-04-21 to 2009-05-21 )))))))))))))))))))))))))))))))
.
2009-05-21 05:04 . 2009-05-21 05:29 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-21 05:04 . 2009-05-21 05:29 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-21 05:03 . 2009-05-21 10:39 738336 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-21 05:03 . 2009-05-21 10:37 221216 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-21 05:03 . 2009-05-21 05:03 -------- d-----w c:\program files\Kaspersky Lab
2009-05-21 05:03 . 2009-05-21 10:38 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-21 01:13 . 2009-05-21 01:13 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-05-21 00:10 . 2009-03-24 13:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-21 00:10 . 2009-05-21 01:12 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-20 20:44 . 2009-05-20 20:44 -------- d-----w c:\program files\Conduit
2009-05-20 20:44 . 2009-05-20 20:44 -------- d-----w c:\documents and settings\I-R-I\Application Data\4shared Desktop
2009-05-20 12:21 . 2009-05-20 12:21 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Conduit
2009-05-20 12:20 . 2009-05-20 20:44 -------- d-----w c:\program files\4shared Desktop
2009-05-19 13:39 . 2009-05-20 20:44 -------- d-----w c:\program files\iVocalize Web Conference 4
2009-05-19 12:07 . 2009-05-19 12:09 811008 ----a-w c:\windows\AL-MOHAGR.scr
2009-05-19 02:43 . 2009-05-19 20:42 -------- d-----w c:\program files\a-squared Free
2009-05-18 11:59 . 2009-05-18 11:59 -------- d-----w c:\windows\Muslim Bag
2009-05-18 11:59 . 2009-05-18 12:00 -------- d-----w c:\program files\Muslim Bag
2009-05-16 07:30 . 2009-05-18 05:58 -------- d-----w c:\program files\LtUcx
2009-05-16 07:08 . 2009-05-16 07:08 -------- d-----w c:\program files\Domain Tools
2009-05-16 06:49 . 2009-05-16 07:19 -------- d-----w c:\program files\All2Chat
2009-05-14 09:21 . 2009-05-14 09:21 -------- d-----w c:\program files\BlazeVideo
2009-05-14 09:16 . 2009-05-14 09:16 -------- d-----w c:\documents and settings\All Users\Application Data\BlazeVideo
2009-05-14 09:16 . 2009-05-19 04:23 -------- d-----w c:\program files\Blaze Video Magic
2009-05-08 13:45 . 2009-05-08 13:49 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Google
2009-05-06 19:09 . 2009-05-06 19:09 -------- d-----w c:\program files\Satellite TV on PC
2009-05-06 01:57 . 2009-05-19 03:53 -------- d-----w c:\windows\Bifrost
2009-05-05 00:46 . 2009-05-05 00:46 196608 ----a-w c:\windows\system32\avisynth.dll
2009-05-05 00:46 . 2009-05-05 00:46 -------- d-----w c:\program files\DivXCodec
2009-05-05 00:46 . 2009-05-05 00:46 33280 ----a-w c:\windows\system32\HUFFYUV.DLL
2009-05-05 00:46 . 2009-05-05 00:47 -------- d-----w c:\program files\GordianKnot
2009-05-05 00:13 . 2009-05-09 09:59 -------- d-----w c:\documents and settings\I-R-I\Application Data\Thinstall
2009-05-05 00:13 . 2009-05-05 00:13 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Thinstall
2009-05-04 22:27 . 2009-05-04 22:27 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Identities
2009-05-04 04:54 . 2009-05-04 11:15 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Adobe
2009-05-04 00:05 . 2004-03-29 12:23 90112 ----a-w c:\windows\unvise32.exe
2009-05-04 00:05 . 2009-05-04 00:05 -------- d-----w c:\program files\Common Files\SWiSHzone.com
2009-05-04 00:05 . 2009-05-04 00:07 -------- d-----w c:\program files\SWiSH Max2
2009-05-03 08:11 . 2009-05-03 08:11 -------- d-----w c:\documents and settings\I-R-I\Application Data\Media Player Classic
2009-05-03 06:55 . 2009-05-08 15:35 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-03 06:55 . 2009-05-03 06:55 -------- d-----w c:\program files\Super Internet TV
2009-05-03 06:44 . 2009-05-03 06:44 -------- d--h--w c:\windows\PIF
2009-05-03 06:28 . 2009-05-03 06:28 -------- d-----w c:\windows\system32\shell
2009-05-03 00:59 . 2009-05-03 00:59 -------- d-----w c:\documents and settings\I-R-I\Application Data\Malwarebytes
2009-05-03 00:59 . 2009-04-06 12:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-03 00:59 . 2009-04-06 12:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-03 00:59 . 2009-05-03 00:59 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-03 00:59 . 2009-05-03 01:02 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-02 20:55 . 2009-05-02 20:55 0 ----a-w c:\windows\nsreg.dat
2009-05-02 20:55 . 2009-05-02 20:55 -------- d-----w c:\documents and settings\I-R-I\Local Settings\Application Data\Mozilla
2009-05-02 13:51 . 2009-05-03 06:28 -------- d-----w c:\program files\Samy Soft
2009-05-01 17:44 . 2008-06-14 17:59 271616 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-01 17:44 . 2008-06-14 17:59 271616 ------w c:\windows\system32\drivers\bthport.sys
2009-05-01 17:12 . 2009-02-09 11:48 2059264 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-05-01 17:12 . 2009-02-09 11:48 2017280 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-01 17:12 . 2009-02-09 11:48 2182016 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-01 17:12 . 2009-02-09 11:48 2137600 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-01 16:56 . 2008-10-24 11:10 453632 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-01 16:41 . 2009-05-04 21:41 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-01 14:49 . 2009-05-02 00:22 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-01 14:43 . 2008-07-09 07:34 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-01 14:43 . 2009-05-02 00:50 -------- d--h--w c:\windows\$hf_mig$
2009-05-01 14:30 . 2008-10-16 11:09 43544 ----a-w c:\windows\system32\wups2.dll
2009-05-01 14:27 . 2009-05-01 14:27 -------- d-s---w c:\documents and settings\I-R-I\UserData
2009-05-01 13:18 . 2009-05-21 09:02 -------- d-----w c:\documents and settings\I-R-I\Application Data\X-NetStat
2009-05-01 13:18 . 2009-05-01 13:18 -------- d-----w c:\program files\X-NetStat Professional
2009-05-01 09:53 . 2009-05-01 09:53 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-01 09:47 . 2009-05-21 10:38 -------- d-----w c:\documents and settings\I-R-I\Tracing
2009-05-01 09:45 . 2009-05-01 09:45 -------- d-----w c:\program files\Microsoft
2009-05-01 09:45 . 2009-05-01 09:45 -------- d-----w c:\program files\Windows Live SkyDrive
2009-05-01 00:55 . 2009-05-01 00:55 -------- d-----w c:\documents and settings\I-R-I\Application Data\COWON
2009-04-30 21:00 . 2009-04-30 21:00 -------- d-----w c:\documents and settings\I-R-I\Contacts
2009-04-30 19:37 . 2009-04-30 19:37 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-30 19:01 . 2004-08-03 21:55 21504 ----a-w c:\windows\system32\hidserv.dll
2009-04-30 19:01 . 2004-08-03 21:55 21504 -c--a-w c:\windows\system32\dllcache\hidserv.dll
2009-04-30 19:01 . 2004-08-03 21:45 14720 -c--a-w c:\windows\system32\dllcache\kbdhid.sys
2009-04-30 19:01 . 2004-08-03 21:45 14720 ----a-w c:\windows\system32\drivers\kbdhid.sys
2009-04-30 19:01 . 2001-09-18 10:38 12160 -c--a-w c:\windows\system32\dllcache\mouhid.sys
2009-04-30 19:01 . 2001-09-18 10:38 12160 ----a-w c:\windows\system32\drivers\mouhid.sys
2009-04-30 19:01 . 2001-08-17 11:02 9600 -c--a-w c:\windows\system32\dllcache\hidusb.sys
2009-04-30 19:01 . 2001-08-17 11:02 9600 ----a-w c:\windows\system32\drivers\hidusb.sys
2009-04-30 19:01 . 2004-08-03 20:08 31616 -c--a-w c:\windows\system32\dllcache\usbccgp.sys
2009-04-30 19:01 . 2004-08-03 20:08 31616 ----a-w c:\windows\system32\drivers\usbccgp.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-21 10:39 . 2009-05-21 05:03 6848 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-21 10:37 . 2009-05-21 05:03 1836 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-21 10:04 . 2001-09-19 15:00 41076 ----a-w c:\windows\system32\perfc001.dat
2009-05-21 10:04 . 2001-09-19 15:00 254326 ----a-w c:\windows\system32\perfh001.dat
2009-05-21 05:29 . 2008-01-29 14:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-20 20:44 . 2009-04-30 14:54 -------- d-----w c:\program files\mpegable
2009-05-17 06:14 . 2009-04-30 14:55 -------- d-----w c:\program files\JetAudio
2009-05-09 13:01 . 2009-04-30 14:33 226304 ----a-w c:\documents and settings\I-R-I\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-08 13:42 . 2009-04-30 15:02 -------- d-----w c:\program files\Google
2009-05-01 09:45 . 2009-04-30 14:53 -------- d-----w c:\program files\Windows Live
2009-04-30 17:40 . 2009-04-30 14:50 -------- d-----w c:\program files\Common Files\Adobe
2009-04-30 17:38 . 2009-04-30 14:55 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-30 17:31 . 2009-04-30 17:31 -------- d-----w c:\program files\Conexant
2009-04-30 15:02 . 2009-04-30 15:02 -------- d-----w c:\program files\GRETECH
2009-04-30 15:01 . 2009-04-30 15:01 -------- d-----w c:\program files\Common Files\xing shared
2009-04-30 15:01 . 2009-04-30 15:01 -------- d-----w c:\program files\Common Files\Real
2009-04-30 15:01 . 2009-04-30 15:01 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-30 15:01 . 2003-02-21 02:42 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-30 15:01 . 2009-04-30 15:01 -------- d-----w c:\program files\Real
2009-04-30 14:58 . 2009-04-30 14:58 -------- d-----w c:\program files\VideoLAN
2009-04-30 14:58 . 2009-04-30 14:58 -------- d-----w c:\program files\XP Codec Pack
2009-04-30 14:56 . 2009-04-30 14:55 -------- d-----w c:\program files\Common Files\COWON
2009-04-30 14:55 . 2009-04-30 14:55 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-30 14:54 . 2009-04-30 14:54 47104 ------w c:\windows\AKDeInstall.exe
2009-04-30 14:48 . 2009-04-30 14:48 2232 ----a-w c:\windows\java\Packages\Data\RTFJPJFX.DAT
2009-04-30 14:48 . 2009-04-30 14:48 155995 ----a-w c:\windows\java\Packages\2KUYYN97.ZIP
2009-04-30 14:48 . 2009-04-30 14:48 2678 ----a-w c:\windows\java\Packages\Data\HBV7PZJ1.DAT
2009-04-30 14:48 . 2009-04-30 14:48 2678 ----a-w c:\windows\java\Packages\Data\ZP753JH3.DAT
2009-04-30 14:48 . 2009-04-30 14:48 2678 ----a-w c:\windows\java\Packages\Data\WFHRT39J.DAT
2009-04-30 14:48 . 2009-04-30 14:48 2678 ----a-w c:\windows\java\Packages\Data\VL3TBRNB.DAT
2009-04-30 14:48 . 2009-04-30 14:48 2678 ----a-w c:\windows\java\Packages\Data\KAP7RN73.DAT
2009-04-30 14:47 . 2009-04-30 14:47 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-04-30 14:47 . 2009-04-30 14:47 172032 ------w c:\windows\Setup1.exe
2009-04-30 14:47 . 2009-04-30 14:47 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-30 14:44 . 2009-04-30 14:44 -------- d-----w c:\program files\Microsoft.NET
2009-04-30 14:26 . 2009-04-30 14:26 -------- d-----w c:\program files\microsoft frontpage
2009-04-30 14:25 . 2001-09-19 15:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-04-30 14:25 . 2009-04-30 14:25 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-30 14:22 . 2009-04-30 14:22 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-06 14:44 . 2004-08-04 00:55 282624 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DSLSTATEXE"="c:\program files\Conexant\Adsl\dslstat.exe" [2005-08-25 344064]
"DSLAGENTEXE"="c:\program files\Conexant\Adsl\dslagent.exe" [2005-08-25 65536]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-21 206088]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{AC456810-5875-7680-8C89-12FBF6A9A98A}]
c:\windows\Bifrost\win.exe s
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: إضافة إلى حاجب إعلان الشعار - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
TCP: {C7EB8285-CDE3-4272-B9E9-AB6BF5E66784} = 84.235.6.55
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\I-R-I\Application Data\Mozilla\Firefox\Profiles\ipxx5lif.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - component: c:\documents and settings\I-R-I\Application Data\Mozilla\Firefox\Profiles\ipxx5lif.default\extensions\{09ec805c-cb2e-4d53-b0d3-a75a428b81c7}\components\FFExternalAlert.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-21 13:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(956)
c:\windows\system32\NTMARTA.DLL
- - - - - - - > 'explorer.exe'(3420)
c:\windows\system32\msi.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.ARA
.
------------------------ Other Running Processes ------------------------
.
c:\program files\a-squared Free\a2service.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2009-05-21 13:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-21 10:41
Pre-Run: 13,063,933,952 bytes free
Post-Run: 13,247,246,336 bytes free
218 --- E O F --- 2009-05-19 00:01
