حياااك يا الغلا
بعد أذن الأخت ...
قم بأتباع الرد الأخ
أو
ضع الفلاش داخل الجهاز
وأعمل التالي
عطل برامج الحماية لديك
نزل هذه الاداة
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى الصق التقرير بردك الاول
وبعدها شوف شنو الوضع
تقرير الكومبو فيكس
ComboFix 09-04-17.05 - MGH 06/18/2009 14:57.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.971.1033.18.503.293 [GMT 4:00]
Running from: c:\documents and settings\MGH\Desktop\rebuilt.كرم\كرم\زيزووم\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\MGH\LOCALS~1\Temp\7zS9.tmp\msnmsgr.exe
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\PortableYahoo.exe
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\d32-fw.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\ft60.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\GIPSVoiceEngineDLL.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\id3lib.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\idle.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\msvcp71.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\msvcr71.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\MyYahoo.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\nspr4.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\pcre.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\res_msgr.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\XMLParse.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\Xmltok.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\YahooMessenger.exe
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\yaudiomgr.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\YCPFoundation.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\YImage.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\YIniDom.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\Yml.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\YPluginRegistry.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Messenger\yvoiceui.dll
c:\docume~1\MGH\LOCALS~1\Temp\RarSFX0\Yahoo!\Shared\YbSkin2.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-18 to 2009-06-18 )))))))))))))))))))))))))))))))
.
2009-06-17 17:47 . 2009-06-18 07:42 32 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-06-17 17:47 . 2009-06-18 07:42 32 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-06-17 16:41 . 2008-07-28 21:01 486519 ----a-w c:\windows\SuperCopier.exe
2009-06-17 00:08 . 2009-06-17 00:08 -------- d-----w c:\documents and settings\MGH\Local Settings\Application Data\Deployment
2009-06-16 10:26 . 2009-06-16 10:26 -------- d-----w c:\documents and settings\MGH\Application Data\Thinstall
2009-06-15 15:24 . 2009-06-15 15:25 -------- d-s---w c:\documents and settings\MGH\UserData
2009-06-15 12:12 . 2009-06-15 12:12 -------- d-----w c:\documents and settings\MGH\Local Settings\Application Data\Adobe
2009-06-14 16:09 . 2009-06-14 16:09 -------- d-----w c:\documents and settings\MGH\Local Settings\Application Data\Identities
2009-06-11 23:11 . 2009-06-11 23:11 -------- d-----w c:\documents and settings\MGH\Local Settings\Application Data\Help
2009-06-11 13:40 . 2009-06-11 13:40 -------- d-----w c:\windows\system32\LogFiles
2009-06-07 16:23 . 2009-06-01 10:19 126976 ----a-r c:\windows\system32\igfxres.dll
2009-06-07 16:13 . 2009-06-01 10:20 2732032 ----a-r c:\windows\system32\Netw2r32.dll
2009-06-07 16:13 . 2009-06-01 10:20 2210048 ----a-r c:\windows\system32\drivers\w29n51.sys
2009-06-07 16:13 . 2009-06-01 10:20 557056 ----a-r c:\windows\system32\Netw2c32.dll
2009-06-07 16:12 . 2009-06-01 10:18 88363 ----a-r c:\windows\AGRSMMSG.exe
2009-06-07 16:12 . 2009-06-01 10:18 64512 ----a-r c:\windows\agrsmdel.exe
2009-06-07 16:12 . 2009-06-01 10:18 1268204 ----a-r c:\windows\system32\drivers\AGRSM.sys
2009-06-07 16:11 . 2009-06-01 10:19 97280 ----a-r c:\windows\system32\drivers\gtipci21.sys
2009-06-07 16:11 . 2009-06-01 10:19 28672 ----a-r c:\windows\cttib1.dll
2009-06-07 16:11 . 2009-06-01 10:19 17120 ----a-r c:\windows\system32\drivers\tiscfw.deb
2009-06-07 16:09 . 2009-06-01 10:19 319488 ----a-r c:\windows\system32\drivers\tifm21.sys
2009-06-07 16:09 . 2009-06-01 10:20 77824 ----a-r c:\windows\system32\btw_ci.dll
2009-06-07 16:09 . 2009-06-01 10:20 57320 ----a-r c:\windows\system32\drivers\btwusb.sys
2009-06-07 16:08 . 2009-06-01 10:20 142720 ----a-w c:\windows\system32\dllcache\b57xp32.sys
2009-06-07 16:08 . 2009-06-01 10:20 142720 ----a-r c:\windows\system32\drivers\b57xp32.sys
2009-06-07 16:04 . 2004-08-03 20:56 7168 ----a-w c:\windows\system32\hccoin.dll
2009-06-07 16:04 . 2004-08-03 20:56 7168 ----a-w c:\windows\system32\dllcache\hccoin.dll
2009-06-07 16:04 . 2004-08-03 19:08 26624 ----a-w c:\windows\system32\drivers\usbehci.sys
2009-06-07 16:04 . 2004-08-03 19:08 26624 ----a-w c:\windows\system32\dllcache\usbehci.sys
2009-06-07 16:04 . 2009-06-07 16:04 -------- d-sh--w C:\FOUND.000
2009-06-07 15:54 . 2004-08-03 19:07 8832 ----a-w c:\windows\system32\drivers\wmiacpi.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-17 17:39 . 2009-06-17 17:39 -------- d-----w c:\program files\SuperCopier2
2009-06-16 14:21 . 2006-07-10 13:47 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-11 13:56 . 2009-06-11 13:56 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-06-11 13:54 . 2009-06-11 13:54 -------- d-----w c:\program files\Common Files\Adobe
2009-06-11 00:45 . 2006-07-10 14:21 30128 ----a-w c:\documents and settings\MGH\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-01 10:18 . 2009-06-07 16:10 127744 ----a-r c:\windows\system32\drivers\aeaudio.sys
2004-08-03 18:56 . 2004-08-03 18:56 25058 ---h--w c:\documents and settings\MGH\Application Data\addon.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2009-06-01 101144]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2009-06-01 84760]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2009-06-01 125720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2009-06-01 88363]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R3 NECIRDA;NEC IrCC Miniport Device Driver;c:\windows\system32\DRIVERS\smcirda.sys [2001-08-17 35913]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\DRIVERS\gtipci21.sys [2009-06-01 97280]
--- Other Services/Drivers In Memory ---
*Deregistered* - mchInjDrv
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0d2c861-0fe2-11db-a190-806d6172696f}]
\Shell\AutoRun\command - D:\setup.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{34F7905A-B033-BBD3-3771-64BF8FF19B85}]
c:\windows\systemB\systemB.exe s
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ae/
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-18 14:59
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\MGH\LOCALS~1\Temp\mc22.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3064)
c:\program files\SuperCopier2\SC2Hook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\SCARDSVR.EXE
.
**************************************************************************
.
Completion time: 2009-06-18 14:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-18 10:59
Pre-Run: 3,934,281,728 bytes free
Post-Run: 4,130,865,152 bytes free
144
