السلام عليكم اخي في الله
هذا التقرير الذي نتج عن الاداة الاولى مع العلم ان الجهاز لم يقوم لعمل اعادة التشغيل
وهذا التقرير
ComboFix 09-06-05.02 - AL_fahdawy 06/05/2009 22:32.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.445 [GMT 4:00]
Running from: c:\documents and settings\AL_fahdawy\Desktop\we.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
.
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.
2009-06-05 17:20 . 2009-06-05 17:20 -------- d-----w- c:\windows\LastGood
2009-06-05 17:19 . 2009-06-05 17:19 -------- d-----w- c:\program files\Trend Micro
2009-06-05 17:01 . 2009-06-05 17:01 1024 ----a-w- c:\documents and settings\AL_fahdawy\Application Data\IDM\DwnlData\AL_fahdawy\ComboFix_31\ComboFix.exe
2009-06-05 15:09 . 2005-02-25 03:35 22752 ----a-w- c:\windows\system32\spupdsvc.exe
2009-06-05 15:09 . 2009-06-05 17:45 -------- d--h--w- c:\windows\$hf_mig$
2009-06-05 14:22 . 2009-06-05 17:42 120915 ----a-w- c:\documents and settings\AL_fahdawy\Application Data\IDM\DwnlData\AL_fahdawy\max_17\max.exe
2009-06-05 12:05 . 2009-03-30 06:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-05 12:05 . 2009-02-13 08:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-05 12:05 . 2009-02-13 08:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-05 12:05 . 2009-06-05 12:05 -------- d-----w- c:\program files\Avira
2009-06-05 10:07 . 2009-06-05 10:07 -------- d-----w- c:\documents and settings\AL_fahdawy\Local Settings\Application Data\Yahoo
2009-06-05 10:05 . 2008-09-19 12:41 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-06-05 10:05 . 2009-06-05 10:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-05 10:05 . 2009-06-05 10:05 -------- d-----w- c:\program files\Yahoo!
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 18:34 . 2009-06-04 14:43 -------- d-----w- c:\documents and settings\AL_fahdawy\Application Data\DMCache
2009-06-05 16:49 . 2009-06-05 10:38 4 ----a-w- C:\timeStmp.tmp
2009-06-05 13:08 . 2009-06-04 13:23 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-05 12:05 . 2009-06-04 17:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-06-05 11:55 . 2009-06-04 13:51 -------- d-----w- c:\program files\ASUS
2009-06-04 17:38 . 2009-06-04 17:38 -------- d-----w- c:\program files\MSN Messenger
2009-06-04 17:34 . 2009-06-04 17:34 -------- d-----w- c:\program files\Realtek
2009-06-04 17:22 . 2009-06-04 17:22 -------- d-----w- c:\documents and settings\AL_fahdawy\Application Data\AdobeUM
2009-06-04 14:44 . 2009-06-04 14:43 -------- d-----w- c:\documents and settings\AL_fahdawy\Application Data\IDM
2009-06-04 14:44 . 2009-06-04 14:44 181680 ----a-w- c:\documents and settings\AL_fahdawy\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-06-04 14:43 . 2009-06-04 14:43 -------- d-----w- c:\program files\Internet Download Manager
2009-06-04 14:09 . 2009-06-04 14:09 -------- d-----w- c:\program files\NT1+Multi
2009-06-04 13:58 . 2009-06-04 13:58 -------- d-----w- c:\program files\Toshiba
2009-06-04 13:57 . 2009-06-04 13:57 -------- d-----w- c:\program files\Atheros
2009-06-04 13:56 . 2009-06-04 13:56 -------- d-----w- c:\documents and settings\AL_fahdawy\Application Data\InstallShield
2009-06-04 13:56 . 2009-06-04 13:56 -------- d-----w- c:\program files\Wireless Console 2
2009-06-04 13:55 . 2009-06-04 13:55 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-04 13:54 . 2009-06-04 13:54 4499453 ----a-w- c:\windows\ASUS Camera ScreenSaver.exe
2009-06-04 13:54 . 2009-06-04 13:54 270336 ----a-w- c:\windows\ASUS Camera ScreenSaver Uninstaller.exe
2009-06-04 13:54 . 2009-06-04 13:54 503808 ----a-w- c:\windows\Asus_Camera_ScreenSaver.scr
2009-06-04 13:54 . 2009-06-04 13:54 606848 ----a-w- c:\windows\flashax.exe
2009-06-04 13:54 . 2009-06-04 13:54 12288 ----a-w- c:\windows\impborl.dll
2009-06-04 13:54 . 2009-06-04 13:54 -------- d-----w- c:\program files\PowerForPhone
2009-06-04 13:53 . 2009-06-04 13:53 17542 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{57B15AD4-8C9D-4164-82BB-E33D8644E757}\_294823.exe
2009-06-04 13:51 . 2009-06-04 13:51 17542 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}\_294823.exe
2009-06-04 13:50 . 2009-06-04 13:31 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-04 13:46 . 2009-06-04 13:46 -------- d-----w- c:\documents and settings\AL_fahdawy\Application Data\ATI
2009-06-04 13:40 . 2009-06-04 13:40 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{F2AAE965-966C-104E-ECCD-9F111A83139C}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{3C3CA756-9FB1-60D9-4435-6D9FEB42C637}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{57EF4BC7-0C52-1872-C0CE-AEAB996E5626}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{6D219284-A368-A0A5-AA55-8BAAE9EA60CC}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{B02A3921-F7B7-C73F-395B-8172C9EE4006}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{9D7802F0-3C39-ED52-10D9-AE8A7FB5A94C}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{5B701396-48C3-A3FA-43DB-FF975446759C}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{0EA06F05-4320-E4DC-4374-E6C0986C964D}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{89EAD7B4-1CAC-CC9E-F040-FE041A2EA77C}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{4B546AE5-DF17-6D39-A846-A9ECD0153C9A}\ARPPRODUCTICON.exe
2009-06-04 13:39 . 2009-06-04 13:39 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{68B84920-CD46-8C5B-DABE-EC0FF6F0C703}\ARPPRODUCTICON.exe
2009-06-04 13:38 . 2009-06-04 13:38 -------- d-----w- c:\program files\Synaptics
2009-06-04 13:38 . 2009-06-04 13:38 9158 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{DCE907E3-4D72-4CD3-A08A-BEFC8C7A5869}\NewShortcut1_45160C5661F6468DA5B09FAE2C3E68D6.exe
2009-06-04 13:38 . 2009-06-04 13:38 10134 ----a-r- c:\documents and settings\AL_fahdawy\Application Data\Microsoft\Installer\{DCE907E3-4D72-4CD3-A08A-BEFC8C7A5869}\ARPPRODUCTICON.exe
2009-06-04 13:37 . 2009-06-04 13:37 -------- d-----w- c:\program files\Attansic
2009-06-04 13:29 . 2009-06-04 13:29 34232 ----a-w- c:\documents and settings\AL_fahdawy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-04 13:24 . 2009-06-04 13:24 -------- d-----w- c:\program files\microsoft frontpage
2009-06-04 13:20 . 2009-06-04 13:20 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-24 12:08 . 2009-06-04 17:23 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-23 2745776]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2008-09-19 4347120]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"PowerForPhone"="c:\program files\PowerForPhone\PowerForPhone\PowerForPhone.exe" [2006-06-29 774144]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"ACU"="c:\program files\Atheros\ACU.exe" [2006-11-17 348249]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
c:\documents and settings\AL_fahdawy\Start Menu\Programs\Startup\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2006-5-24 49152]
CAPI Monitor.lnk - c:\program files\NT1+Multi\calltray.exe [2009-6-4 147456]
MultiFrame.lnk - c:\program files\ASUS\Asus MultiFrame\MultiFrame.exe [2009-6-4 491520]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [6/5/2009 4:05 PM 194817]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/5/2009 4:05 PM 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [6/5/2009 4:05 PM 432897]
R2 capi;ELCON NT1+Multi Driver capi;c:\windows\system32\drivers\capi.sys [6/4/2009 6:08 PM 28723]
R2 capifw;ELCON NT1+Multi Driver capifw;c:\windows\system32\drivers\capifw.sys [6/4/2009 6:08 PM 225332]
R2 fwmm;ELCON NT1+Multi Driver fwmm;c:\windows\system32\drivers\fwmm.sys [6/4/2009 6:08 PM 26686]
R3 l1utah;ELCON NT1+Multi Driver l1utah;c:\windows\system32\drivers\l1utah.sys [6/4/2009 6:08 PM 61794]
R3 SynMini;USB2.0 1.3M WebCam;c:\windows\system32\drivers\SynMini.sys [6/4/2009 5:51 PM 1116544]
R3 SynScan;USB2.0 1.3M WebCam Still Image;c:\windows\system32\drivers\SynScan.sys [6/4/2009 5:51 PM 7808]
R3 vmdmc;ELCON VCOMM Port Driver;c:\windows\system32\drivers\vmdmc.sys [6/4/2009 6:09 PM 355953]
R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [6/4/2009 5:57 PM 54432]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: {AB294D1B-9823-4426-833E-FB96FEEFD72C} = 213.178.225.25 199.202.55.2
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-05 22:34
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(836)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(892)
c:\program files\Avira\AntiVir Desktop\avsda.dll
- - - - - - - > 'explorer.exe'(2324)
c:\program files\ASUS\Asus MultiFrame\HookTitle.dll
c:\windows\system32\msi.dll
.
Completion time: 2009-06-05 22:35
ComboFix-quarantined-files.txt 2009-06-05 18:35
Pre-Run: 34,586,447,872 bytes free
Post-Run: 34,821,570,560 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
168 --- E O F --- 2009-06-05 15:09
ولا زال التقرير الثاني
