الله يجزاك خير علي ماتقوم بة في خدمة اخوانك
وهذا ماظهر لي
ComboFix 09-06-04.A1 - Toshiba 06/05/2009 19:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1015.444 [GMT 3:00]
Running from: c:\documents and settings\Toshiba\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
AV: Outpost Security Suite Pro *On-access scanning disabled* (Updated) {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: <PRODUCT> *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
.
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.
2009-06-05 08:08 . 2009-06-05 08:08 -------- d-----w- c:\program files\Trend Micro
2009-06-04 12:27 . 2009-06-04 12:27 -------- d-----w- c:\documents and settings\Toshiba\LocalLow
2009-06-04 12:27 . 2009-06-04 12:27 -------- d-----w- c:\documents and settings\Toshiba\Local Settings\Application Data\TVU Networks
2009-06-04 12:27 . 2009-06-04 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\TVU Networks
2009-06-04 12:02 . 2001-09-18 11:03 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2009-05-28 14:15 . 2009-05-28 14:15 -------- d-----w- c:\windows\system32\wbem\Repository
2009-05-23 17:00 . 2009-05-23 17:00 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-05-21 13:05 . 2009-05-21 13:05 -------- d-sh--w- c:\documents and settings\Toshiba\IECompatCache
2009-05-21 13:04 . 2009-05-21 13:04 -------- d-sh--w- c:\documents and settings\Toshiba\PrivacIE
2009-05-21 13:00 . 2009-05-21 13:00 -------- d-sh--w- c:\documents and settings\Toshiba\IETldCache
2009-05-21 12:41 . 2009-05-21 12:41 -------- d-----w- c:\windows\ie8updates
2009-05-21 12:41 . 2009-04-25 05:30 102400 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-05-21 12:38 . 2009-05-21 12:40 -------- dc-h--w- c:\windows\ie8
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 16:50 . 2008-12-28 18:34 -------- d-----w- c:\documents and settings\Toshiba\Application Data\Software Informer
2009-06-05 16:50 . 2009-02-19 21:01 -------- d-----w- c:\documents and settings\Toshiba\Application Data\Skype
2009-06-05 16:50 . 2009-02-19 21:12 -------- d-----w- c:\documents and settings\Toshiba\Application Data\skypePM
2009-06-05 16:50 . 2009-03-31 08:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-05 16:45 . 2009-03-31 08:41 499744 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-05 16:45 . 2009-03-31 08:41 3836 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-05 16:45 . 2009-03-31 08:41 2272288 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-05 16:45 . 2009-03-31 08:41 20928 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-05 08:06 . 2001-09-19 12:00 40316 ----a-w- c:\windows\system32\perfc001.dat
2009-06-05 08:06 . 2001-09-19 12:00 251946 ----a-w- c:\windows\system32\perfh001.dat
2009-05-28 12:08 . 2008-12-24 09:02 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-28 10:27 . 2008-12-24 09:01 -------- d-----w- c:\program files\mpegable
2009-05-23 13:23 . 2009-03-25 13:31 -------- d-----w- c:\program files\XoftSpySE
2009-05-20 12:56 . 2009-03-31 08:42 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-20 12:56 . 2009-03-31 08:42 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-04 12:03 . 2009-05-04 12:03 59904 ----a-w- c:\windows\system32\zlib1.dll
2009-05-04 11:53 . 2009-05-04 11:53 286720 ----a-w- c:\windows\system32\libcurl.dll
2009-05-04 11:53 . 2009-05-04 11:53 196608 ----a-w- c:\windows\system32\ssleay32.dll
2009-05-04 11:53 . 2009-05-04 11:53 1028096 ----a-w- c:\windows\system32\libeay32.dll
2009-05-04 11:53 . 2009-05-04 11:53 143360 ----a-w- c:\windows\system32\libexpatw.dll
2009-05-02 09:54 . 2009-05-02 09:54 -------- d-----w- c:\program files\Microsoft Windows OneCare Live
2009-05-02 09:54 . 2009-02-17 18:37 -------- d-----w- c:\program files\Windows Live Safety Center
2009-04-01 07:37 . 2009-04-01 07:37 152576 ----a-w- c:\documents and settings\Toshiba\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-31 08:59 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-03-31 08:59 . 2009-03-31 08:59 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-03-31 08:59 . 2009-03-31 08:59 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-03-31 08:59 . 2009-03-31 08:59 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-03-28 07:04 . 2009-03-27 12:21 21 ----a-w- c:\windows\1 Click & Lock.dat
2009-03-23 19:28 . 2008-12-24 10:06 3766 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-03-23 19:28 . 2008-12-24 10:06 3766 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2009-03-23 06:55 . 2009-03-22 06:50 117760 ----a-w- c:\documents and settings\Toshiba\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-03-17 08:07 . 2009-03-17 08:07 152576 ----a-w- c:\documents and settings\Toshiba\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-03-09 02:19 . 2008-12-28 08:40 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-03-08 16:36 . 2009-03-08 16:36 720896 ----a-w- c:\windows\iun6002ev.exe
2009-03-08 01:34 . 2004-08-03 21:55 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 21:55 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 21:55 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 21:55 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 21:55 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 21:55 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 21:55 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 21:53 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 21:56 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-09-19 12:00 156160 ----a-w- c:\windows\system32\msls31.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-05-27 4269296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Software Informer"="c:\program files\Software Informer\softinfo.exe" [2008-12-24 1626181]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-02-04 23975720]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-11-06 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-11-06 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-11-06 138008]
"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-04-24 225280]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-11-06 888832]
"pdfFactory Pro Dispatcher v3"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2008-09-30 573440]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-24 180269]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-18 49152]
"SoloSentry"="c:\srnmic~1\SOLOSENT.EXE" [2007-10-14 77824]
"SoloSysCheck"="c:\srnmic~1\SYSCHECK.COM" [2007-10-14 237568]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-03-31 206088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-11-06 16384512]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-11-06 1826816]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-12-24 118784]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\SRN Micro\\SOLOSCAN.EXE"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/03/2009 10:08 م 64160]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [28/02/2009 12:05 م 705600]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [17/04/2007 08:09 م 11032]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [28/02/2009 12:04 م 30864]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [28/02/2009 12:05 م 257432]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 06:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [24/12/2008 11:33 ص 264576]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe --> c:\progra~1\Agnitum\OUTPOS~1\acs.exe [?]
S2 AntiVirUpgradeService;Avira Upgrade Service;"c:\docume~1\Toshiba\LOCALS~1\Temp\AVSETUP_49c28cf1\basic\avupgsvc.exe" /TEMPSTART:""c:\docume~1\Toshiba\LOCALS~1\Temp\AVSETUP_49c28cf1\basic\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE" --> c:\docume~1\Toshiba\LOCALS~1\Temp\AVSETUP_49c28cf1\basic\avupgsvc.exe [?]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll [28/02/2009 12:05 م 35296]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [07/03/2009 05:22 م 33752]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [26/02/2009 02:02 م 138112]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [26/02/2009 02:02 م 8320]
S3 VBEngNT;VBEngNT;c:\windows\system32\drivers\VBEngNT.sys [28/02/2009 12:05 م 1166155]
S3 VBFilt;VBFilt;c:\windows\system32\Filt\VBFilt.dll [28/02/2009 12:05 م 235520]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 11:21]
2009-06-04 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-06-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-06-05 c:\windows\Tasks\User_Feed_Synchronization-{75D8321B-E4D8-4763-88E8-2D48FB9820F5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 01:31]
2009-06-05 c:\windows\Tasks\XoftSpySE 2.job
- c:\program files\XoftSpySE\XoftSpy.exe [2009-03-11 05:43]
2009-03-28 c:\windows\Tasks\XoftSpySE.job
- c:\program files\XoftSpySE\XoftSpy.exe [2009-03-11 05:43]
.
- - - - ORPHANS REMOVED - - - -
Notify-WgaLogon - (no file)
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: View Original Image -
IE: إضافة إلى حاجب إعلان الشعار - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
FF - ProfilePath - c:\documents and settings\Toshiba\Application Data\Mozilla\Firefox\Profiles\lzzgfawk.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077543&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - ToggleEN Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2077543&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=2&q=
FF - component: c:\documents and settings\Toshiba\Application Data\Mozilla\Firefox\Profiles\lzzgfawk.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\FFAlert.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-05 19:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(168)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\windows\system32\msiexec.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-06-05 19:53 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-05 16:53
Pre-Run: 41,040,519,168 bytes free
Post-Run: 41,090,953,216 bytes free
224 --- E O F --- 2009-05-21 12:41
.png)
.png)
k: بارك الله فيك