- بادئ الموضوع emad8540
- تاريخ البدء
- 1,016
kemo_2009
زيزوومى مميز
غير متصل
حمل هذا البرنامج
شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم
التعديل الأخير بواسطة المشرف:
تأييد
0
emad8540
زيزوومى مميز
غير متصل
تفضل عزيزي التقرير
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:34:17 ص, on 03/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Messenger.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.awalnet.net.sa:8080
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [+] C:\Extracted\111111111111111111111.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [paths] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Messenger.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Messenger
O4 - Global Startup: Messenger.exe
O4 - Global Startup: Optix_ScreenCapS.dll
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: أعرض كل الصور في نوعية أصلية. - C:\Program Files\
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: صورة المعرض في نوعية أصلية. - C:\Program Files\
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 6595 bytes
التعديل الأخير بواسطة المشرف:
تأييد
0
MAAX
عضوشرف
غير متصل
عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة
ثم
حمل الاداة التالية واحفظها على سطح المكتب
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة
تأييد
0
emad8540
زيزوومى مميز
غير متصل
تفضل عزيزي
ComboFix 09-05-30.04 - sa2009 05/29/2009 4:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.239.75 [GMT 3:00]
Running from: c:\documents and settings\sa2009\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-29 )))))))))))))))))))))))))))))))
.
2009-05-29 01:06 . 2009-05-29 01:06 -------- d-----w- c:\documents and settings\sa2009\Application Data\Desktopicon
2009-05-29 01:06 . 2009-05-29 01:07 -------- d-----w- c:\program files\Unlocker
2009-05-24 00:46 . 2009-05-24 00:46 -------- d-----w- c:\program files\Trend Micro
2009-05-23 07:13 . 2004-08-03 21:56 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-05-23 07:13 . 2004-08-03 21:56 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-05-23 07:13 . 2004-08-03 19:58 14848 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2009-05-23 07:13 . 2004-08-03 19:58 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2009-05-19 00:51 . 2008-09-26 15:01 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2009-05-19 00:51 . 2008-09-26 15:01 113664 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-05-19 00:51 . 2008-09-26 15:01 101376 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-05-19 00:51 . 2008-09-26 15:00 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-05-19 00:50 . 2009-05-19 00:53 -------- d-----w- c:\program files\Mobily Connect Card
2009-05-19 00:49 . 2004-08-03 20:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-05-19 00:49 . 2004-08-03 20:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-05-17 04:11 . 2003-11-04 12:11 159744 ----a-w- c:\windows\system32\lfpng13n.dll
2009-05-17 04:04 . 2003-11-04 12:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2009-05-17 04:04 . 2004-01-11 23:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll
2009-05-16 23:29 . 2003-04-17 19:57 207 ------w- c:\windows\zend_encoder.dat
2009-05-16 23:29 . 2009-05-16 23:29 -------- d-----w- c:\program files\Zend
2009-05-16 23:26 . 2009-05-16 23:27 596312 ----a-w- c:\documents and settings\sa2009\Application Data\IDM\DwnlData\sa2009\ZendStudio-5_5_0a_904\ZendStudio-5_5_0a.exe
2009-05-11 21:42 . 2009-05-15 06:04 -------- d-----w- C:\Extracted
2009-05-02 23:13 . 2004-08-03 16:56 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-05-29 01:46 . 2009-03-18 11:58 -------- d-----w- c:\documents and settings\sa2009\Application Data\DMCache
2009-05-29 01:24 . 2009-03-19 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-29 01:22 . 2009-03-19 18:06 466976 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-29 01:22 . 2009-03-19 18:06 3724 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-29 01:22 . 2009-03-19 18:06 2645024 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-29 01:22 . 2009-03-19 18:06 22792 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-05-25 00:41 . 2009-03-18 11:58 -------- d-----w- c:\documents and settings\sa2009\Application Data\IDM
2009-05-16 23:29 . 2009-03-12 14:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-19 22:12 . 2009-03-28 19:45 -------- d-----w- c:\documents and settings\sa2009\Application Data\PC Suite
2009-04-16 09:46 . 2009-03-12 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-09 11:32 . 2009-04-09 11:32 89088 ----a-w- c:\documents and settings\sa2009\Application Data\Desktopicon\eBayShortcuts.exe
2009-04-07 10:18 . 2009-04-07 10:18 -------- d-----w- c:\program files\GlobalSCAPE
2009-04-04 15:49 . 2009-04-04 15:14 -------- d-----w- c:\program files\AskBarDis
2009-04-04 15:18 . 2009-04-04 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\GlobalSCAPE
2009-04-04 15:16 . 2009-04-04 15:16 -------- d-----w- c:\documents and settings\sa2009\Application Data\GlobalSCAPE
2009-03-31 15:44 . 2009-03-12 15:20 18599936 ----a-w- c:\windows\system32\videoencode.dll
2009-03-31 15:44 . 2009-03-12 15:20 90112 ----a-w- c:\windows\system32\ssvideo.dll
2009-03-31 15:44 . 2009-03-12 15:20 1128128 ----a-w- c:\windows\system32\NMSDVDXU.dll
2009-03-31 15:44 . 2009-03-12 15:20 18595840 ----a-w- c:\windows\system32\coredata.dll
2009-03-28 19:39 . 2009-03-28 19:39 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\Uninst CCD.exe
2009-03-28 19:39 . 2009-03-28 19:39 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\Uninst PCSFEMsi.exe
2009-03-28 19:39 . 2009-03-28 19:39 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\Uninst PCS.exe
2009-03-28 19:36 . 2009-03-28 19:40 33973608 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ara.exe
2009-03-25 17:21 . 2009-03-25 17:21 81920 ----a-w- c:\documents and settings\sa2009\Application Data\ezpinst.exe
2009-03-25 17:21 . 2009-03-25 17:21 81920 ----a-w- c:\documents and settings\sa2009\Application Data\ezpinst.exe
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\documents and settings\sa2009\Application Data\pcouffin.sys
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\documents and settings\sa2009\Application Data\pcouffin.sys
2009-03-24 15:45 . 2009-03-24 15:45 7680 ----a-w- c:\documents and settings\sa2009\Application Data\Thinstall\Video Convert Master 8.0.10.31\4000001500003i\avcore.dll
2009-03-22 16:05 . 2009-03-22 16:05 129 ----a-w- c:\documents and settings\sa2009\Local Settings\Application Data\fusioncache.dat
2009-03-22 16:04 . 2009-03-22 16:04 1150 ----a-r- c:\documents and settings\sa2009\Application Data\Microsoft\Installer\{F3DFED0B-07F2-41B4-BD5D-7937A554FC73}\_4ae13d6c.exe
2009-03-22 12:07 . 2009-03-22 12:06 857990 ----a-w- c:\documents and settings\sa2009\Application Data\Hide IP NG\hideipng-update.exe
2009-03-20 17:34 . 2009-03-20 17:34 181680 ----a-w- c:\documents and settings\sa2009\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-03-20 03:54 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-03-20 03:54 . 2009-03-19 18:08 101287 ----a-w- c:\windows\system32\drivers\klin.dat
2009-03-20 03:54 . 2009-03-19 18:08 89601 ----a-w- c:\windows\system32\drivers\klick.dat
2009-03-20 03:54 . 2009-03-20 03:54 44808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\fssync.dll
2009-03-20 03:54 . 2009-03-20 03:54 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\klbg.sys
2009-03-20 03:54 . 2009-03-20 03:54 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\avp.exe
2009-03-20 03:54 . 2009-03-20 03:54 213520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\XP\klif.sys
2009-03-16 11:02 . 2009-03-12 14:49 73792 ----a-w- c:\documents and settings\sa2009\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-12 15:20 . 2009-03-12 15:20 344064 ----a-w- c:\windows\system32\dkll.dll
2009-03-12 15:20 . 2009-03-12 15:20 196608 ----a-w- c:\windows\system32\maag.dll
2009-03-12 15:20 . 2009-03-12 15:20 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-03-12 15:20 . 2009-03-12 15:20 1986560 ----a-w- c:\windows\system32\akll.dll
2009-03-12 15:01 . 2004-04-05 07:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-03-12 15:01 . 2004-04-05 07:31 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-03-12 14:42 . 2009-03-12 14:42 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-03-12 14:42 . 2009-03-12 14:42 172032 ------w- c:\windows\Setup1.exe
2009-03-12 08:09 . 2009-03-11 19:42 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-12 07:38 . 2009-03-12 07:38 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-03-12 07:38 . 2009-03-12 07:38 0 ----a-w- c:\windows\system32\PTPTT.dat
2009-03-12 07:38 . 2009-03-12 07:38 0 ----a-w- c:\windows\system32\PTHSP.dat
2009-03-11 19:39 . 2009-03-11 19:39 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2004-08-03 16:56 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 16:56 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 16:56 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 16:56 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 16:56 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 16:56 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 16:56 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 16:56 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 16:56 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-08-23 12:00 156160 ----a-w- c:\windows\system32\msls31.dll
2009-03-06 14:44 . 2004-08-03 16:56 283648 ----a-w- c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-24_01.38.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-29 01:05 . 2009-05-29 01:01 261295 c:\windows\system32\en-US\unlocker1.8.7.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-03-20 2745776]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2005-06-24 95662]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 198160]
"+"="c:\extracted\111111111111111111111.exe" [2008-08-21 102403]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2006-08-02 577536]
"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2003-12-17 176128]
"PV92TRAY"="PV92Tray.exe" - c:\windows\system32\PV92Tray.exe [2003-12-17 128000]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-12 113664]
Messenger [2009-5-26 131656]
Messenger.exe [2009-5-15 65536]
Optix_ScreenCapS.dll [2009-5-23 180736]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-3-12 389120]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
R3 slnt;Realtek Rtl-8139d PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [12/03/2009 10:53 ص 18004]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{80C8F16B-0BC8-B0FC-306B-3C1252F6FAD5}]
c:\extracted\111111111111111111111.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A9C7B22F-5A46-DD4F-CE07-A712AEC3341D}]
c:\documents and settings\All Users\Start Menu\Programs\Startup\Messenger.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyServer = proxy.awalnet.net.sa:8080
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: أعرض كل الصور في نوعية أصلية. - c:\program files\
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: صورة المعرض في نوعية أصلية. - c:\program files\
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-29 04:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
+ = c:\extracted\111111111111111111111.exe???????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ????
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E916 4-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):2e,58,47,b0,ad,50,8e,07,1e,80,31,3 c,68,35,04,0a,46,9e,9c,13,02,
dd,d4,92,2f,10,1f,13,20,67,12,38,1d,c6,bf,12,64,5a ,3c,81,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d9002f2 1-9a69-4b7c-8998-d71db46221db}]
@Denied: (Full) (Everyone)
"Model"=dword:00000084
"Therad"=dword:00000004
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b ,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,2d,3a,98,2e,80,9a ,1a,a3,ee,2d,8e,3a,bd,e4,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3016)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-29 4:49
ComboFix-quarantined-files.txt 2009-05-29 01:49
ComboFix2.txt 2009-05-24 01:46
Pre-Run: 12,890,685,440 bytes free
Post-Run: 13,578,309,632 bytes free
214 --- E O F --- 2009-05-12 00:03
ComboFix 09-05-30.04 - sa2009 05/29/2009 4:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.239.75 [GMT 3:00]
Running from: c:\documents and settings\sa2009\My Documents\Downloads\Programs\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-29 )))))))))))))))))))))))))))))))
.
2009-05-29 01:06 . 2009-05-29 01:06 -------- d-----w- c:\documents and settings\sa2009\Application Data\Desktopicon
2009-05-29 01:06 . 2009-05-29 01:07 -------- d-----w- c:\program files\Unlocker
2009-05-24 00:46 . 2009-05-24 00:46 -------- d-----w- c:\program files\Trend Micro
2009-05-23 07:13 . 2004-08-03 21:56 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2009-05-23 07:13 . 2004-08-03 21:56 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-05-23 07:13 . 2004-08-03 19:58 14848 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2009-05-23 07:13 . 2004-08-03 19:58 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2009-05-19 00:51 . 2008-09-26 15:01 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2009-05-19 00:51 . 2008-09-26 15:01 113664 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-05-19 00:51 . 2008-09-26 15:01 101376 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-05-19 00:51 . 2008-09-26 15:00 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-05-19 00:50 . 2009-05-19 00:53 -------- d-----w- c:\program files\Mobily Connect Card
2009-05-19 00:49 . 2004-08-03 20:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-05-19 00:49 . 2004-08-03 20:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-05-17 04:11 . 2003-11-04 12:11 159744 ----a-w- c:\windows\system32\lfpng13n.dll
2009-05-17 04:04 . 2003-11-04 12:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-05-17 04:04 . 2004-05-14 13:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2009-05-17 04:04 . 2004-01-11 23:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll
2009-05-16 23:29 . 2003-04-17 19:57 207 ------w- c:\windows\zend_encoder.dat
2009-05-16 23:29 . 2009-05-16 23:29 -------- d-----w- c:\program files\Zend
2009-05-16 23:26 . 2009-05-16 23:27 596312 ----a-w- c:\documents and settings\sa2009\Application Data\IDM\DwnlData\sa2009\ZendStudio-5_5_0a_904\ZendStudio-5_5_0a.exe
2009-05-11 21:42 . 2009-05-15 06:04 -------- d-----w- C:\Extracted
2009-05-02 23:13 . 2004-08-03 16:56 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-05-29 01:46 . 2009-03-18 11:58 -------- d-----w- c:\documents and settings\sa2009\Application Data\DMCache
2009-05-29 01:24 . 2009-03-19 18:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-29 01:22 . 2009-03-19 18:06 466976 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-29 01:22 . 2009-03-19 18:06 3724 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-29 01:22 . 2009-03-19 18:06 2645024 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-05-29 01:22 . 2009-03-19 18:06 22792 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-05-25 00:41 . 2009-03-18 11:58 -------- d-----w- c:\documents and settings\sa2009\Application Data\IDM
2009-05-16 23:29 . 2009-03-12 14:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-04-19 22:12 . 2009-03-28 19:45 -------- d-----w- c:\documents and settings\sa2009\Application Data\PC Suite
2009-04-16 09:46 . 2009-03-12 15:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-09 11:32 . 2009-04-09 11:32 89088 ----a-w- c:\documents and settings\sa2009\Application Data\Desktopicon\eBayShortcuts.exe
2009-04-07 10:18 . 2009-04-07 10:18 -------- d-----w- c:\program files\GlobalSCAPE
2009-04-04 15:49 . 2009-04-04 15:14 -------- d-----w- c:\program files\AskBarDis
2009-04-04 15:18 . 2009-04-04 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\GlobalSCAPE
2009-04-04 15:16 . 2009-04-04 15:16 -------- d-----w- c:\documents and settings\sa2009\Application Data\GlobalSCAPE
2009-03-31 15:44 . 2009-03-12 15:20 18599936 ----a-w- c:\windows\system32\videoencode.dll
2009-03-31 15:44 . 2009-03-12 15:20 90112 ----a-w- c:\windows\system32\ssvideo.dll
2009-03-31 15:44 . 2009-03-12 15:20 1128128 ----a-w- c:\windows\system32\NMSDVDXU.dll
2009-03-31 15:44 . 2009-03-12 15:20 18595840 ----a-w- c:\windows\system32\coredata.dll
2009-03-28 19:39 . 2009-03-28 19:39 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\Uninst CCD.exe
2009-03-28 19:39 . 2009-03-28 19:39 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\Uninst PCSFEMsi.exe
2009-03-28 19:39 . 2009-03-28 19:39 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\Uninst PCS.exe
2009-03-28 19:36 . 2009-03-28 19:40 33973608 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ara.exe
2009-03-25 17:21 . 2009-03-25 17:21 81920 ----a-w- c:\documents and settings\sa2009\Application Data\ezpinst.exe
2009-03-25 17:21 . 2009-03-25 17:21 81920 ----a-w- c:\documents and settings\sa2009\Application Data\ezpinst.exe
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\documents and settings\sa2009\Application Data\pcouffin.sys
2009-03-25 17:21 . 2009-03-25 17:21 47360 ----a-w- c:\documents and settings\sa2009\Application Data\pcouffin.sys
2009-03-24 15:45 . 2009-03-24 15:45 7680 ----a-w- c:\documents and settings\sa2009\Application Data\Thinstall\Video Convert Master 8.0.10.31\4000001500003i\avcore.dll
2009-03-22 16:05 . 2009-03-22 16:05 129 ----a-w- c:\documents and settings\sa2009\Local Settings\Application Data\fusioncache.dat
2009-03-22 16:04 . 2009-03-22 16:04 1150 ----a-r- c:\documents and settings\sa2009\Application Data\Microsoft\Installer\{F3DFED0B-07F2-41B4-BD5D-7937A554FC73}\_4ae13d6c.exe
2009-03-22 12:07 . 2009-03-22 12:06 857990 ----a-w- c:\documents and settings\sa2009\Application Data\Hide IP NG\hideipng-update.exe
2009-03-20 17:34 . 2009-03-20 17:34 181680 ----a-w- c:\documents and settings\sa2009\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-03-20 03:54 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-03-20 03:54 . 2009-03-19 18:08 101287 ----a-w- c:\windows\system32\drivers\klin.dat
2009-03-20 03:54 . 2009-03-19 18:08 89601 ----a-w- c:\windows\system32\drivers\klick.dat
2009-03-20 03:54 . 2009-03-20 03:54 44808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\fssync.dll
2009-03-20 03:54 . 2009-03-20 03:54 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\klbg.sys
2009-03-20 03:54 . 2009-03-20 03:54 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\avp.exe
2009-03-20 03:54 . 2009-03-20 03:54 213520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.4 54\XP\klif.sys
2009-03-16 11:02 . 2009-03-12 14:49 73792 ----a-w- c:\documents and settings\sa2009\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-12 15:20 . 2009-03-12 15:20 344064 ----a-w- c:\windows\system32\dkll.dll
2009-03-12 15:20 . 2009-03-12 15:20 196608 ----a-w- c:\windows\system32\maag.dll
2009-03-12 15:20 . 2009-03-12 15:20 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-03-12 15:20 . 2009-03-12 15:20 1986560 ----a-w- c:\windows\system32\akll.dll
2009-03-12 15:01 . 2004-04-05 07:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-03-12 15:01 . 2004-04-05 07:31 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-03-12 14:42 . 2009-03-12 14:42 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-03-12 14:42 . 2009-03-12 14:42 172032 ------w- c:\windows\Setup1.exe
2009-03-12 08:09 . 2009-03-11 19:42 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-12 07:38 . 2009-03-12 07:38 1536 ----a-w- c:\windows\system32\TrueSoft.dat
2009-03-12 07:38 . 2009-03-12 07:38 0 ----a-w- c:\windows\system32\PTPTT.dat
2009-03-12 07:38 . 2009-03-12 07:38 0 ----a-w- c:\windows\system32\PTHSP.dat
2009-03-11 19:39 . 2009-03-11 19:39 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-08 01:34 . 2004-08-03 16:56 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-03 16:56 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-03 16:56 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-03 16:56 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-03 16:56 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-03 16:56 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-03 16:56 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-03 16:56 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-03 16:56 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-08-23 12:00 156160 ----a-w- c:\windows\system32\msls31.dll
2009-03-06 14:44 . 2004-08-03 16:56 283648 ----a-w- c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-05-24_01.38.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-29 01:05 . 2009-05-29 01:01 261295 c:\windows\system32\en-US\unlocker1.8.7.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-03-20 2745776]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2005-06-24 95662]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 198160]
"+"="c:\extracted\111111111111111111111.exe" [2008-08-21 102403]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2006-08-02 577536]
"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2003-12-17 176128]
"PV92TRAY"="PV92Tray.exe" - c:\windows\system32\PV92Tray.exe [2003-12-17 128000]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-12 113664]
Messenger [2009-5-26 131656]
Messenger.exe [2009-5-15 65536]
Optix_ScreenCapS.dll [2009-5-23 180736]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-3-12 389120]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
R3 slnt;Realtek Rtl-8139d PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [12/03/2009 10:53 ص 18004]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{80C8F16B-0BC8-B0FC-306B-3C1252F6FAD5}]
c:\extracted\111111111111111111111.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A9C7B22F-5A46-DD4F-CE07-A712AEC3341D}]
c:\documents and settings\All Users\Start Menu\Programs\Startup\Messenger.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyServer = proxy.awalnet.net.sa:8080
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: أعرض كل الصور في نوعية أصلية. - c:\program files\
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: صورة المعرض في نوعية أصلية. - c:\program files\
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2009-05-29 04:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
+ = c:\extracted\111111111111111111111.exe???????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ????
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E916 4-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):2e,58,47,b0,ad,50,8e,07,1e,80,31,3 c,68,35,04,0a,46,9e,9c,13,02,
dd,d4,92,2f,10,1f,13,20,67,12,38,1d,c6,bf,12,64,5a ,3c,81,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d9002f2 1-9a69-4b7c-8998-d71db46221db}]
@Denied: (Full) (Everyone)
"Model"=dword:00000084
"Therad"=dword:00000004
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b ,2a,ca,fe,43,98,07,ff,fc,5d,
df,1c,2f,3b,8a,0a,32,11,89,01,b5,2d,3a,98,2e,80,9a ,1a,a3,ee,2d,8e,3a,bd,e4,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3016)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-05-29 4:49
ComboFix-quarantined-files.txt 2009-05-29 01:49
ComboFix2.txt 2009-05-24 01:46
Pre-Run: 12,890,685,440 bytes free
Post-Run: 13,578,309,632 bytes free
214 --- E O F --- 2009-05-12 00:03
تأييد
0
MAAX
عضوشرف
غير متصل
حدد التالي واحذفه
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file
O4 - HKLM\..\Run: [+] C:\Extracted\111111111111111111111.exe
O4 - HKLM\..\Run: [paths] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Messenger.exe
O4 - Global Startup: Messenger
O4 - Global Startup: Messenger.exe
O4 - Global Startup: Optix_ScreenCapS.dll
طريقة الحذف
.png)
.png)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file
O4 - HKLM\..\Run: [+] C:\Extracted\111111111111111111111.exe
O4 - HKLM\..\Run: [paths] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Messenger.exe
O4 - Global Startup: Messenger
O4 - Global Startup: Messenger.exe
O4 - Global Startup: Optix_ScreenCapS.dll
طريقة الحذف
تأييد
0
emad8540
زيزوومى مميز
غير متصل
حذفت ولازالت المشكلة مستمرةحدد التالي واحذفه
o2 - bho: (no name) - {02478d38-c3f9-4efb-9b51-7695eca05670} - (no file
o4 - hklm\..\run: [+] c:\extracted\111111111111111111111.exe
o4 - hklm\..\run: [paths] c:\documents and settings\all users\start menu\programs\startup\messenger.exe
o4 - global startup: Messenger
o4 - global startup: Messenger.exe
o4 - global startup: Optix_screencaps.dll
طريقة الحذف
تأييد
0
emad8540
زيزوومى مميز
غير متصل
تفضل التقرير:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:20:18 ص, on 05/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\PV92Tray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.awalnet.net.sa:8080
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: أعرض كل الصور في نوعية أصلية. - C:\Program Files\
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: صورة المعرض في نوعية أصلية. - C:\Program Files\
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5609 bytes
تأييد
0
- الحالة