:i:
اخي فارس انت متأكد انك فهمت اسئلتي ؟
انا ما قلت ابي احذف وخلاص
انا كنت استفسر عن طريقة الحذف الصحيحه لكن يبدو انك استعجلت في وضع الحل
وربما
انك لم تتطلع على رسالة الكومبو في بداية الموضوع
الرساله تقول ان هناك ملف ناقص من آداة الكومبو
يعني في حالة تشغيل الآداة لن تعمل بشكل كامل وهذا ما حدث بالفعل
بعد ما قلت لي
شغل الآداة واتركها إلى انت تنتهي ثم احذف اللي تبي
قلت نجرب عشان نتأكد بس
والنتيجه بعد تشغيل آداة الكومبو ظهرت نفس الرساله اثناء العمل وضغطت على موافق
وتركتها تكمل حتى ظهر التقرير
وبعدها قمت بإعادة تشغيل الجهاز مره اخرى ثم ظهرت نفس الرساله :f:
عموماً جزاك الله خير اخي فارس على المساعده
وهذا تقرير آداة الكومبو
ComboFix 09-05-14.03 - win 06/25/2009 11:39.4 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.502.286 [GMT 3:00]
Running from: c:\documents and settings\win\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.
2009-06-24 18:58 . 2009-06-24 18:58 -------- d-----w c:\documents and settings\win\Application Data\Thinstall
2009-06-22 20:00 . 2009-06-22 20:00 -------- d-sh--w C:\FOUND.014
2009-06-17 09:55 . 2009-06-17 09:55 -------- d-----w c:\program files\SWiSH Max2
2009-06-13 19:34 . 2009-06-13 19:34 -------- d-----w c:\documents and settings\win\Application Data\CyberScrub
2009-06-13 19:33 . 2009-06-13 19:33 -------- d-----w c:\documents and settings\win\Application Data\cleaner
2009-06-12 13:28 . 2009-06-12 13:28 -------- d--h--w c:\windows\system32\GroupPolicy
2009-06-12 11:28 . 2009-06-12 11:28 -------- d-sh--w C:\Recycled
2009-06-12 11:12 . 2009-06-08 05:10 155136 ----a-w c:\windows\PEV.exe
2009-06-11 23:11 . 2009-06-11 23:11 -------- d-----w c:\documents and settings\win\DoctorWeb
2009-06-09 22:14 . 2009-06-09 22:14 -------- d-----w c:\documents and settings\All Users\Application Data\SWiSHMax2WorkFolder
2009-06-09 22:05 . 2009-06-09 22:05 -------- d-----w c:\program files\Common Files\SWiSHzone.com
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-24 23:16 . 2007-10-26 11:03 317216 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-06-24 23:16 . 2007-10-26 11:03 2336 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-06-24 23:16 . 2007-10-26 11:03 2336 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-06-24 23:16 . 2007-10-26 11:03 16808 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-06-24 23:16 . 2007-07-03 08:25 12 ----a-w c:\windows\bthservsdp.dat
2009-05-26 08:21 . 2009-05-26 08:20 -------- d-----w c:\program files\zuhrof
2009-05-20 14:27 . 2007-10-26 11:03 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-20 14:27 . 2007-10-26 11:03 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-12 12:37 . 2009-05-12 12:37 -------- d-----w c:\program files\Trend Micro
2009-05-03 17:06 . 2009-05-03 17:06 28672 ----a-w c:\windows\system32\qttask.exe
2009-05-02 19:01 . 2007-07-03 08:10 159304 ----a-w c:\documents and settings\win\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-23 08:45 . 2007-09-23 16:44 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-23 08:45 . 2007-09-23 16:44 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-04 14:36 . 2009-04-04 14:36 308 ----a-w c:\windows\GooGleeee.pif
2009-03-31 17:47 . 2001-09-19 09:00 41274 ----a-w c:\windows\system32\perfc001.dat
2009-03-31 17:47 . 2001-09-19 09:00 254598 ----a-w c:\windows\system32\perfh001.dat
2008-05-10 06:51 . 2008-02-10 18:13 286 ----a-w c:\program files\uniextract.txt
2005-06-22 05:37 . 2006-05-24 17:37 45568 --sha-r c:\windows\system32\cygz.dll
.
------- Sigcheck -------
[-] 2004-08-03 17:14 359040 6A603809F598332DBEDD535BDBCE313E c:\windows\system32\drivers\tcpip.sys
[7] 2004-08-03 17:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-05-12_12.31.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-03 00:20 . 2004-03-29 13:23 90112 c:\windows\unvise32.exe
- 2008-01-03 00:20 . 2004-03-29 12:23 90112 c:\windows\unvise32.exe
+ 2007-08-18 06:56 . 2009-06-21 03:50 9728 c:\windows\system32\BASSMOD.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 385024]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 356352]
"LManager"="c:\program files\Launch Manager\QtZgAcer.EXE" [2005-03-28 319488]
"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-09-06 820736]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2005-06-29 176128]
"ACU"="c:\program files\Atheros\ACU.exe" [2005-05-31 303104]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-23 198160]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-5-25 565309]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-7-4 113664]
REALTEK PCI&Cardbus Wireless LAN Utility.lnk - c:\program files\REALTEK PCI&Cardbus Wireless LAN Driver and Utility\RtWLan.exe [2009-2-15 794624]
REALTEK RTL8187 Wireless LAN Utility.lnk - c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe [2009-2-15 737280]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 08:27 110592 ----a-w c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKLM\~\startupfolder\C:^Documents and Settings^win^قائمة ابدأ^البرامج^بدء التشغيل^ctfmon.exe]
path=c:\documents and settings\win\قائمة ابدأ\البرامج\بدء التشغيل\ctfmon.exe
backup=c:\windows\pss\ctfmon.exeStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\REALPLAY.EXE"=
"c:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\AVP.EXE"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\AppServ\\Apache2.2\\bin\\httpd.exe"=
"c:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"c:\\SpeedTouch_upgrade_wizard_R4421\\upgradeST.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
R2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [09/01/2007 07:17 م 20539]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [15/02/2009 01:14 ص 38144]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [04/04/2007 02:58 م 24344]
S2 7C0D52E37CEADD4820437743F169C150;7C0D52E37CEADD4820437743F169C150;cmd /k start /i "/dC:" "c:\combofix\HIDEC.exe" "c:\combofix\SWREG.EXE" ACL "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_Beep" /RESET /Q --> cmd [?]
S2 PHPGeekUtil;PHPGeekUtil;"c:\apache\APACHE.EXE" --ntservice --> c:\apache\APACHE.EXE [?]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\DRIVERS\br3gmdm.sys --> c:\windows\system32\DRIVERS\br3gmdm.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25/01/2007 08:31 م 42000]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [15/02/2009 01:25 ص 194304]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [15/02/2009 01:24 ص 13532]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EE3DD54E-05C4-5931-50B9-AF1B8E9563EE}]
c:\program files\Common Files\WD\winIogon.exe s
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 212.67.97.23:8080
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Lookup on Merriam Webster -
files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia -
files\ieSpell\wikipedia.HTM
IE: Save F&lash with FlashCapture - c:\program files\FlashCapture\fciext.dll/FCIEXT.htm
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\win\Application Data\Mozilla\Firefox\Profiles\ipwuwfvk.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-25 11:40
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\7C0D52E37CEADD4820437743F169C150]
"ImagePath"="cmd /k start /i \"/d%systemdrive%\" \"c:\combofix\HIDEC.exe\" \"c:\combofix\SWREG.EXE\" ACL \"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_Beep\" /RESET /Q"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mysql]
"ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1409082233-1647877149-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.* j*p*g*\OpenWithList]
@Class="Shell"
"a"="mspaint.exe"
"MRUList"="ba"
"b"="shimgvw.dll"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):ba,0b,a4,24,7d,4f,9d,26,91,84,50,74,eb,24,07,cf,0c,f4,02,18,33,
ba,19,68,ba,22,4d,43,5a,cb,d3,ab,78,64,32,a5,85,5b,07,04,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b8,0a,15,b5,58,cc,fd,7d,b6,f4,5b,dc,f4,b7,e5,22,38,0b,f7,2c,f6,
d8,d9,45,32,22,fc,72,eb,f1,93,49,86,4c,39,7f,8d,1b,06,80,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{85f68ba6-5c97-45dd-a30a-814fe6761874}]
@Denied: (Full) (Everyone)
"Model"=dword:00000125
"Therad"=dword:00000017
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,8d,5f,a0,ce,48,c0,b1,ca,4f,22,68,df,28,28,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{baaed58b-0cdf-4bc7-acc2-93d8d6fd80fd}]
@Denied: (Full) (Everyone)
"Model"=dword:000000e4
"Therad"=dword:0000001a
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1684)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
c:\windows\system32\klogon.dll
c:\windows\system32\athgina.dll
c:\windows\system32\athcfg11.dll
c:\windows\system32\athcfg11Res.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
c:\windows\system32\igfxsrvc.dll
c:\windows\system32\hccutils.DLL
- - - - - - - > 'lsass.exe'(1740)
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll
.
Completion time: 2009-06-25 11:43
ComboFix-quarantined-files.txt 2009-06-25 08:43
Pre-Run: 3,626,598,400 bytes free
Post-Run: 4,208,033,792 bytes free
213
ملاحظه ( هذا الموضوع الثالث لي في قسم المشاكل عن مشاكل في الجهاز ودائماً اضع اسئله ويتم تجاهلها بقول ضع تقرير وحمل هذه الآداة :f: )
السؤال :
هل المساعده تكون بطريقه احترافيه ؟ أم نسخ لصق من ردود محترفين ؟
والمعذره انك كان كلامي فيه شيء يزعل اخواني في المنتدى
ودمتم بود
