اول شي عطل برنامج الحمايه<< سوى له خروج من شريط المهام
حمل هذه الاداة واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
يجب ان تكون جميع النوافذ مغلقة تماما
تفضل عزيزي
ComboFix 09-05-30.04 - sa2009 05/29/2009 4:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.239.75 [GMT 3:00]
Running from: c:\documents and settings\sa2009\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-29 )))))))))))))))))))))))))))))))
.
2009-05-29 01:06 . 2009-05-29 01:06 -------- d-----w- c:\documents and settings\sa2009\Application Data\Desktopicon
2009-05-29 01:06 . 2009-05-29 01:07 -------- d-----w- c:\program files\Unlocker
2009-05-24 00:46 . 2009-05-24 00:46 -------- d-----w- c:\program files\Trend Micro
2009-05-23 07:13 . 2004-08-03 21:56 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-05-23 07:13 . 2004-08-03 21:56 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-05-23 07:13 . 2004-08-03 19:58 14848 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2009-05-23 07:13 . 2004-08-03 19:58 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2009-05-19 00:51 . 2008-09-26 15:01 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2009-05-19 00:51 . 2008-09-26 15:01 113664 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-05-19 00:51 . 2008-09-26 15:01 101376 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-05-19 00:51 . 2008-09-26 15:00 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-05-19 00:50 . 2009-05-19 00:53 -------- d-----w- c:\program files\Mobily Connect Card
2009-05-19 00:49 . 2004-08-03 20:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-05-19 00:49 . 2004-08-03 20:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-05-17 04:11 . 2003-11-04 12:11 159744 ----a-w- c:\windows\system32\lfpng13n.dll
2009-05-17 04:04 . 2003-11-04 12:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2009-05-17 04:04 . 2004-01-11 23:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll
2009-05-16 23:29 . 2003-04-17 19:57 207 ------w- c:\windows\zend_encoder.dat
2009-05-16 23:29 . 2009-05-16 23:29 -------- d-----w- c:\program files\Zend
2009-05-16 23:26 . 2009-05-16 23:27 596312 ----a-w- c:\documents and settings\sa2009\Application Data\IDM\DwnlData\sa2009\ZendStudio-5_5_0a_904\ZendStudio-5_5_0a.exe
2009-05-11 21:42 . 2009-05-15 06:04 -------- d-----w- C:\Extracted
2009-05-02 23:13 . 2004-08-03 16:56 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-29 01:46 . 2009-03-18 11:58 -------- d-----w- c:\documents and settings\sa2009\Application Data\DMCache
2009-05-29 01:24 . 2009-03-19 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-29 01:22 . 2009-03-19 18:06 466976 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-29 01:22 . 2009-03-19 18:06 3724 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-29 01:22 . 2009-03-19 18:06 2645024 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-29 01:22 . 2009-03-19 18:06 22792 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-05-25 00:41 . 2009-03-18 11:58 -------- d-----w- c:\documents and settings\sa2009\Application Data\IDM
2009-05-16 23:29 . 2009-03-12 14:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-19 22:12 . 2009-03-28 19:45 -------- d-----w- c:\documents and settings\sa2009\Application Data\PC Suite
2009-04-16 09:46 . 2009-03-12 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-09 11:32 . 2009-04-09 11:32 89088 ----a-w- c:\documents and settings\sa2009\Application Data\Desktopicon\eBayShortcuts.exe
2009-04-07 10:18 . 2009-04-07 10:18 -------- d-----w- c:\program files\GlobalSCAPE
2009-04-04 15:49 . 2009-04-04 15:14 -------- d-----w- c:\program files\AskBarDis
2009-04-04 15:18 . 2009-04-04 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\GlobalSCAPE
2009-04-04 15:16 . 2009-04-04 15:16 -------- d-----w- c:\documents and settings\sa2009\Application Data\GlobalSCAPE
2009-03-31 15:44 . 2009-03-12 15:20 18599936 ----a-w- c:\windows\system32\videoencode.dll
2009-03-31 15:44 . 2009-03-12 15:20 90112 ----a-w- c:\windows\system32\ssvideo.dll
2009-03-31 15:44 . 2009-03-12 15:20 1128128 ----a-w- c:\windows\system32\NMSDVDXU.dll
2009-03-31 15:44 . 2009-03-12 15:20 18595840 ----a-w- c:\windows\system32\coredata.dll
2009-03-28 19:39 . 2009-03-28 19:39 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe
2009-03-28 19:39 . 2009-03-28 19:39 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-03-28 19:39 . 2009-03-28 19:39 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe
2009-03-28 19:36 . 2009-03-28 19:40 33973608 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ara.exe
2009-03-25 17:21 . 2009-03-25 17:21 81920 ----a-w- c:\documents and settings\sa2009\Application Data\ezpinst.exe
2009-03-25 17:21 . 2009-03-25 17:21 81920 ----a-w- c:\documents and settings\sa2009\Application Data\ezpinst.exe
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\documents and settings\sa2009\Application Data\pcouffin.sys
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\documents and settings\sa2009\Application Data\pcouffin.sys
2009-03-24 15:45 . 2009-03-24 15:45 7680 ----a-w- c:\documents and settings\sa2009\Application Data\Thinstall\Video Convert Master 8.0.10.31\4000001500003i\avcore.dll
2009-03-22 16:05 . 2009-03-22 16:05 129 ----a-w- c:\documents and settings\sa2009\Local Settings\Application Data\fusioncache.dat
2009-03-22 16:04 . 2009-03-22 16:04 1150 ----a-r- c:\documents and settings\sa2009\Application Data\Microsoft\Installer\{F3DFED0B-07F2-41B4-BD5D-7937A554FC73}\_4ae13d6c.exe
2009-03-22 12:07 . 2009-03-22 12:06 857990 ----a-w- c:\documents and settings\sa2009\Application Data\Hide IP NG\hideipng-update.exe
2009-03-20 17:34 . 2009-03-20 17:34 181680 ----a-w- c:\documents and settings\sa2009\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-03-20 03:54 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-03-20 03:54 . 2009-03-19 18:08 101287 ----a-w- c:\windows\system32\drivers\klin.dat
2009-03-20 03:54 . 2009-03-19 18:08 89601 ----a-w- c:\windows\system32\drivers\klick.dat
2009-03-20 03:54 . 2009-03-20 03:54 44808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\fssync.dll
2009-03-20 03:54 . 2009-03-20 03:54 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\klbg.sys
2009-03-20 03:54 . 2009-03-20 03:54 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\avp.exe
2009-03-20 03:54 . 2009-03-20 03:54 213520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\XP\klif.sys
2009-03-16 11:02 . 2009-03-12 14:49 73792 ----a-w- c:\documents and settings\sa2009\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-12 15:20 . 2009-03-12 15:20 344064 ----a-w- c:\windows\system32\dkll.dll
2009-03-12 15:20 . 2009-03-12 15:20 196608 ----a-w- c:\windows\system32\maag.dll
2009-03-12 15:20 . 2009-03-12 15:20 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-03-12 15:20 . 2009-03-12 15:20 1986560 ----a-w- c:\windows\system32\akll.dll
2009-03-12 15:01 . 2004-04-05 07:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-03-12 15:01 . 2004-04-05 07:31 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-03-12 14:42 . 2009-03-12 14:42 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-03-12 14:42 . 2009-03-12 14:42 172032 ------w- c:\windows\Setup1.exe
2009-03-12 08:09 . 2009-03-11 19:42 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-12 07:38 . 2009-03-12 07:38 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-03-12 07:38 . 2009-03-12 07:38 0 ----a-w- c:\windows\system32\PTPTT.dat
2009-03-12 07:38 . 2009-03-12 07:38 0 ----a-w- c:\windows\system32\PTHSP.dat
2009-03-11 19:39 . 2009-03-11 19:39 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2004-08-03 16:56 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 16:56 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 16:56 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 16:56 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 16:56 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 16:56 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 16:56 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 16:56 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 16:56 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-08-23 12:00 156160 ----a-w- c:\windows\system32\msls31.dll
2009-03-06 14:44 . 2004-08-03 16:56 283648 ----a-w- c:\windows\system32\pdh.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-05-24_01.38.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-29 01:05 . 2009-05-29 01:01 261295 c:\windows\system32\en-US\unlocker1.8.7.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-03-20 2745776]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2005-06-24 95662]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 198160]
"+"="c:\extracted\111111111111111111111.exe" [2008-08-21 102403]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2006-08-02 577536]
"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2003-12-17 176128]
"PV92TRAY"="PV92Tray.exe" - c:\windows\system32\PV92Tray.exe [2003-12-17 128000]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-12 113664]
Messenger [2009-5-26 131656]
Messenger.exe [2009-5-15 65536]
Optix_ScreenCapS.dll [2009-5-23 180736]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-3-12 389120]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
R3 slnt;Realtek Rtl-8139d PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [12/03/2009 10:53 ص 18004]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{80C8F16B-0BC8-B0FC-306B-3C1252F6FAD5}]
c:\extracted\111111111111111111111.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A9C7B22F-5A46-DD4F-CE07-A712AEC3341D}]
c:\documents and settings\All Users\Start Menu\Programs\Startup\Messenger.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyServer = proxy.awalnet.net.sa:8080
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: أعرض كل الصور في نوعية أصلية. - c:\program files\
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: صورة المعرض في نوعية أصلية. - c:\program files\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-29 04:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
+ = c:\extracted\111111111111111111111.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):2e,58,47,b0,ad,50,8e,07,1e,80,31,3c,68,35,04,0a,46,9e,9c,13,02,
dd,d4,92,2f,10,1f,13,20,67,12,38,1d,c6,bf,12,64,5a,3c,81,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d9002f21-9a69-4b7c-8998-d71db46221db}]
@Denied: (Full) (Everyone)
"Model"=dword:00000084
"Therad"=dword:00000004
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,2d,3a,98,2e,80,9a,1a,a3,ee,2d,8e,3a,bd,e4,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3016)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-29 4:49
ComboFix-quarantined-files.txt 2009-05-29 01:49
ComboFix2.txt 2009-05-24 01:46
Pre-Run: 12,890,685,440 bytes free
Post-Run: 13,578,309,632 bytes free
214 --- E O F --- 2009-05-12 00:03
