مشكور اخى كوباك على ردك
وده التقرير الي ظهر لي
ComboFix 09-06-26.02 - A M R 06/27/2009 16:03.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.503.246 [GMT 3:00]
Running from: F:\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\A M R\Application Data\inst.exe
c:\windows\Help\agt0401.hlp
c:\windows\Help\agt0405.hlp
c:\windows\Help\agt0408.hlp
c:\windows\Help\agt0415.hlp
c:\windows\Help\agt0419.hlp
c:\windows\system32\kakle.dll
c:\windows\system32\msssc.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.
2009-06-27 13:06 . 2009-06-27 13:06 -------- d-----w- c:\windows\LastGood
2009-06-27 12:01 . 2009-06-27 12:01 -------- d-----w- c:\documents and settings\N O G A\Application Data\Skype
2009-06-27 12:01 . 2009-06-27 12:01 364726 ----a-r- c:\documents and settings\N O G A\Application Data\Microsoft\Installer\{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}\SkypeIcon.exe
2009-06-27 12:01 . 2009-06-27 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-06-27 12:01 . 2009-06-27 12:01 -------- d-----r- c:\documents and settings\N O G A\Local Settings\Application Data\Skype
2009-06-27 11:51 . 2009-06-27 11:51 -------- d-----w- c:\documents and settings\N O G A\Contacts
2009-06-27 09:50 . 2009-06-27 09:50 -------- d-s---w- c:\documents and settings\N O G A\UserData
2009-06-27 09:36 . 2009-06-27 09:36 -------- d-----w- c:\documents and settings\N O G A\Local Settings\Application Data\Identities
2009-06-26 19:05 . 2009-06-26 19:05 4096 ----a-w- c:\windows\d3dx.dat
2009-06-25 10:26 . 2009-06-25 10:26 -------- d-sh--w- C:\FOUND.007
2009-06-25 01:19 . 2009-06-25 01:19 27264 ----a-w- c:\documents and settings\N O G A\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-24 17:45 . 2009-06-24 17:45 -------- d-----w- c:\windows\system32\LogFiles
2009-06-24 02:18 . 2009-06-24 02:18 -------- d-sh--w- C:\FOUND.006
2009-06-23 14:22 . 2009-06-23 14:22 -------- d-sh--w- C:\FOUND.005
2009-06-23 07:09 . 2009-06-23 07:09 -------- d-----w- c:\documents and settings\S O S O\Contacts
2009-06-23 06:35 . 2009-06-23 06:35 27264 ----a-w- c:\documents and settings\S O S O\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-23 04:43 . 2009-06-23 04:43 -------- d--h--w- c:\windows\PIF
2009-06-21 16:59 . 2009-06-21 16:59 7168 ----a-w- c:\documents and settings\S O S O\Application Data\Thinstall\Jacked\400000600002i\Splash.exe
2009-06-21 16:59 . 2009-06-21 16:59 -------- d-----w- c:\documents and settings\S O S O\Application Data\Thinstall
2009-06-21 02:52 . 2009-06-21 02:52 7168 ----a-w- c:\documents and settings\A M R\Application Data\Thinstall\Jacked\400000600002i\Splash.exe
2009-06-20 05:55 . 2009-06-20 05:55 -------- d-----w- c:\documents and settings\S O S O\Local Settings\Application Data\Adobe
2009-06-18 23:32 . 2009-06-18 23:32 -------- d-sh--w- C:\FOUND.004
2009-06-18 20:17 . 2009-06-18 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\InterAction studios
2009-06-18 19:30 . 2009-06-26 19:20 10 ----a-w- c:\windows\popcinfo.dat
2009-06-18 00:09 . 2009-06-18 00:09 -------- d-----w- c:\documents and settings\A M R\Local Settings\Application Data\Adobe
2009-06-18 00:07 . 2009-06-18 00:07 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-17 02:38 . 2009-06-17 02:38 -------- d-sh--w- C:\FOUND.003
2009-06-13 22:15 . 2009-06-13 22:15 -------- d-----w- c:\documents and settings\S O S O\Local Settings\Application Data\Identities
2009-06-12 22:12 . 2009-06-12 22:12 -------- d-----w- c:\documents and settings\S O S O\Application Data\Media Player Classic
2009-06-12 13:44 . 2009-06-12 13:44 -------- d-----w- c:\documents and settings\S O S O\Application Data\DivX
2009-06-11 22:22 . 2009-06-11 22:22 -------- d-----w- c:\documents and settings\S O S O\Application Data\Super-Cow
2009-06-11 21:36 . 2009-06-11 21:36 -------- d-----w- c:\documents and settings\S O S O\Application Data\PlayFirst
2009-06-11 21:25 . 2009-06-11 21:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Intenium
2009-06-11 17:51 . 2009-06-11 17:51 -------- d-----w- c:\documents and settings\N O G A\Application Data\DivX
2009-06-11 17:51 . 2009-06-11 17:51 -------- d-----w- c:\documents and settings\N O G A\Application Data\Media Player Classic
2009-06-11 12:44 . 2001-08-17 11:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-06-11 12:40 . 2002-02-15 10:33 20615 ----a-w- c:\windows\system32\drivers\LIKECDN2.sys
2009-06-11 12:40 . 2001-12-11 07:46 3524 ------w- c:\windows\system32\drivers\XSpaceWG.sys
2009-06-11 12:40 . 2009-06-11 12:40 -------- d-----w- c:\program files\SPACE INTERNATIONAL
2009-06-10 12:22 . 2009-06-10 12:22 -------- d-----w- c:\documents and settings\N O G A\Local Settings\Application Data\Help
2009-06-10 10:52 . 2009-06-10 10:52 -------- d-----w- c:\documents and settings\N O G A\Local Settings\Application Data\Yahoo
2009-06-10 08:27 . 2009-06-10 08:27 -------- d-----w- C:\zyz_auto_killer
2009-06-09 22:49 . 2009-06-09 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\PlayFirst
2009-06-09 22:49 . 2009-06-09 22:49 -------- d-----w- c:\documents and settings\A M R\Application Data\PlayFirst
2009-06-09 22:49 . 2009-06-09 22:49 -------- d-----w- C:\games
2009-06-09 21:25 . 2009-06-09 21:25 -------- d-----w- c:\documents and settings\A M R\Application Data\Super-Cow
2009-06-09 18:06 . 2009-06-09 18:06 -------- d-sh--w- C:\FOUND.002
2009-06-09 15:53 . 2009-06-09 15:53 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-06-09 15:28 . 2009-06-09 15:28 -------- d-----w- c:\documents and settings\A M R\Application Data\Thinstall
2009-06-09 13:46 . 2009-06-09 14:15 94208 ----a-w- c:\documents and settings\A M R\Application Data\ezplay.sys
2009-06-09 13:46 . 2009-06-09 13:46 94208 ----a-w- c:\windows\system32\drivers\ezplay.sys
2009-06-09 13:46 . 2009-06-09 14:15 47360 ----a-w- c:\documents and settings\A M R\Application Data\pcouffin.sys
2009-06-09 13:46 . 2009-06-09 13:46 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-06-09 13:46 . 2009-06-09 13:46 -------- d-----w- c:\documents and settings\A M R\Application Data\Vso
2009-06-09 13:19 . 2009-06-09 13:19 -------- d-----w- c:\documents and settings\A M R\Local Settings\Application Data\Ahead
2009-06-09 12:48 . 2009-06-09 12:48 -------- d-sh--w- C:\FOUND.001
2009-06-09 10:08 . 2009-06-09 10:08 -------- d-----w- c:\documents and settings\A M R\Contacts
2009-06-08 23:18 . 2009-06-08 23:18 -------- d-----w- c:\program files\Driver Checker
2009-06-08 22:53 . 2009-06-08 22:53 -------- d-----w- c:\program files\Plugins
2009-06-08 22:53 . 2009-06-08 22:53 -------- d-----w- c:\program files\Skins
2009-06-08 22:53 . 2009-06-08 22:53 62624 ----a-w- c:\program files\Uninstal.exe
2009-06-08 20:28 . 2009-06-08 20:28 -------- d-----w- c:\documents and settings\S O S O\Local Settings\Application Data\Yahoo
2009-06-08 15:02 . 2009-06-08 15:03 27264 ----a-w- c:\documents and settings\A M R\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-07 21:36 . 2009-06-26 15:58 716 ----a-w- C:\BOWLDA.DAT
2009-06-07 14:50 . 2009-06-07 14:50 -------- d-----w- c:\documents and settings\A M R\Application Data\Media Player Classic
2009-06-07 14:33 . 2009-06-07 14:33 -------- d-----w- c:\documents and settings\A M R\Local Settings\Application Data\Yahoo
2009-06-07 14:32 . 2009-06-07 14:32 -------- d-s---w- c:\documents and settings\S O S O\UserData
2009-06-07 14:22 . 2009-06-07 14:22 -------- d-sh--w- C:\FOUND.000
2009-06-07 14:02 . 2009-06-07 14:02 -------- d-----w- c:\windows\system32\DRVSTORE
2009-06-07 14:01 . 2009-06-07 14:01 -------- d-----w- c:\program files\MSN Messenger
2009-06-07 14:00 . 2009-06-07 14:00 -------- d-----w- c:\program files\Ringz Studio
2009-06-07 14:00 . 2009-06-07 14:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 13:01 . 2009-06-07 13:54 0 ----a-w- c:\windows\system32\drivers\IsPubDrv.sys
2009-06-27 13:01 . 2009-06-07 13:54 0 ----a-w- c:\windows\system32\drivers\IsDrv118.sys
2009-06-27 02:31 . 2009-06-09 18:19 102 ----a-w- c:\program files\Winamp.m3u
2009-06-11 12:46 . 2009-06-11 12:40 9152 ----a-w- c:\windows\system32\drivers\CDSpace.cfg
2009-06-10 16:40 . 2009-06-07 13:30 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-07 13:59 . 2009-06-07 13:59 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-07 13:58 . 2009-06-07 13:58 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-06-07 13:58 . 2009-06-07 13:58 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-06-07 13:58 . 2009-06-07 13:58 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-06-07 13:58 . 2009-06-07 13:58 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-06-07 13:58 . 2009-06-07 13:58 1986560 ----a-w- c:\windows\system32\akll.dll
2009-06-07 13:58 . 2009-06-07 13:58 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-06-07 13:58 . 2009-06-07 13:58 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-06-07 13:58 . 2009-06-07 13:58 -------- d-----w- c:\program files\Real_SC
2009-06-07 13:54 . 2009-06-07 13:54 108032 ----a-w- c:\windows\Netfathr.exe
2009-06-07 13:54 . 2009-06-07 13:54 -------- d-sh--r- c:\program files\tuEagles
2009-06-07 13:53 . 2009-06-07 13:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-07 13:53 . 2009-06-07 13:53 -------- d-----w- c:\program files\Yahoo!
2009-06-07 13:51 . 2009-06-07 13:51 -------- d-----w- c:\program files\Winamp
2009-06-07 13:49 . 2009-06-07 13:49 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-07 13:49 . 2009-06-07 13:49 -------- d-----w- c:\program files\Common Files\Real
2009-06-07 13:49 . 2009-06-07 13:49 -------- d-----w- c:\program files\Real
2009-06-07 13:45 . 2009-06-07 13:45 -------- d-----w- c:\program files\security
2009-06-07 13:45 . 2009-06-07 13:45 2232 ----a-w- c:\windows\java\Packages\Data\VJV9VZFT.DAT
2009-06-07 13:45 . 2009-06-07 13:45 155995 ----a-w- c:\windows\java\Packages\U7TBF1VL.ZIP
2009-06-07 13:45 . 2009-06-07 13:45 2678 ----a-w- c:\windows\java\Packages\Data\VHJ33LZH.DAT
2009-06-07 13:45 . 2009-06-07 13:45 2678 ----a-w- c:\windows\java\Packages\Data\22KVP7BL.DAT
2009-06-07 13:45 . 2009-06-07 13:45 2678 ----a-w- c:\windows\java\Packages\Data\MRHND3B1.DAT
2009-06-07 13:45 . 2009-06-07 13:45 2678 ----a-w- c:\windows\java\Packages\Data\M27HB93P.DAT
2009-06-07 13:45 . 2009-06-07 13:45 2678 ----a-w- c:\windows\java\Packages\Data\077DZXJL.DAT
2009-06-07 13:44 . 2009-06-07 13:44 198064 ----a-w- c:\documents and settings\A M R\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-07 13:44 . 2009-06-07 13:44 -------- d-----w- c:\documents and settings\A M R\Application Data\IDM
2009-06-07 13:44 . 2009-06-07 13:44 -------- d-----w- c:\documents and settings\A M R\Application Data\DMCache
2009-06-07 13:44 . 2009-06-07 13:44 -------- d-----w- c:\program files\Internet Download Manager
2009-06-07 13:42 . 2009-06-07 13:42 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-07 13:42 . 2009-06-07 13:42 -------- d-----w- c:\program files\Ahead
2009-06-07 13:37 . 2009-06-07 13:37 -------- d-----w- c:\program files\Analog Devices
2009-06-07 13:37 . 2009-06-07 13:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-07 13:36 . 2009-06-07 13:36 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-07 13:35 . 2009-06-07 13:35 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-07 13:35 . 2009-06-07 13:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-07 13:27 . 2009-06-07 13:27 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-29 20:37 . 2006-11-01 06:54 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2009-05-29 20:31 . 2006-11-01 06:52 881664 ----a-w- c:\windows\system32\xvidcore.dll
2009-05-26 16:50 . 2009-06-07 13:53 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2003-05-04 10:57 . 2003-05-04 21:45 1941 ----a-r- c:\program files\WINAMP.INI
2003-02-01 20:00 . 2003-05-04 21:45 142 ----a-r- c:\program files\WINAMP.PIC
2003-01-14 15:19 . 2003-05-04 21:45 8639 ----a-r- c:\program files\WINAMPMB.HTM
2003-01-14 15:19 . 2003-05-04 21:45 4587 ----a-r- c:\program files\WINAMP.Q1
2003-01-14 15:19 . 2003-05-04 21:45 880640 ----a-r- c:\program files\Winamp.exe
2003-01-14 15:19 . 2003-05-04 21:45 25599 ----a-r- c:\program files\WHATSNEW.TXT
.
------- Sigcheck -------
[-] 2006-09-08 22:02 2198144 BA08992ECFB4B23B9204ADD12AB385EA c:\windows\system32\ntkrnlpa.exe
[-] 2006-09-08 20:01 2321024 EF63859E4FD9CB3EC31A111481F4B1B6 c:\windows\system32\ntoskrnl.exe
[-] 2006-09-08 21:48 1616896 7F9583EFF8102BCE8BD6716744018F83 c:\windows\explorer.exe
[-] 2006-09-09 06:45 125720 B04B182A92C119511DD3CDBE18602DB1 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-06-07 2794928]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-01-31 98304]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2002-05-28 69632]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SDaemon"="c:\windows\sdaemon.exe" [2005-04-18 111104]
"SWd"="c:\windows\winwd.exe" [2005-04-18 26624]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-07 180269]
"eagleeye"="c:\program files\tuEagles\EagleSvr.exe" [2006-09-24 1348608]
"StormCodec_Helper"="c:\program files\Ringz Studio\Storm Codec\StormSet.exe" [2006-11-26 97357]
"Emurayden PSX Emulator"="f:\gemes\_ط___ _ط_ط___و_غ\Emurayden PSX AutoLauncher.exe" [2002-07-25 61440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R0 WINSEC;WINSEC;c:\windows\system32\drivers\winsec.sys [4/19/2005 12:57 AM 20352]
R1 LIKECDN2;LIKECDN2;c:\windows\system32\drivers\LIKECDN2.sys [6/11/2009 3:40 PM 20615]
R1 XSPACEWG;XSPACEWG;c:\windows\system32\drivers\XSpaceWG.sys [6/11/2009 3:40 PM 3524]
R2 winser;winser;c:\windows\system32\winsersec.exe [4/14/2005 1:37 AM 53248]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.eg/
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-27 16:08
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
c:\program files\TUEAGLES\EAGLESVR.EXE [1696] 0x82012DA0
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(960)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll
- - - - - - - > 'lsass.exe'(1016)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
.
Completion time: 2009-06-27 16:09
ComboFix-quarantined-files.txt 2009-06-27 13:09
Pre-Run: 4,054,728,704 bytes free
Post-Run: 5,694,119,936 bytes free
238
