اخوي شكرا لك على التواصل معي وهذا التقرير
ComboFix 09-07-09.08 - yy 07/11/2009 0:42.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.247.114 [GMT 3:00]
Running from: c:\documents and settings\yy\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\program files\AskSearch\bin\DefaultSearch.dll
.
((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))
.
2009-07-10 21:38 . 2009-07-10 21:39 -------- d-----w- c:\windows\LastGood
2009-07-10 20:11 . 2009-07-10 20:11 0 ----a-w- c:\documents and settings\yy\Application Data\IDM\DwnlData\yy\Zyzoom_kis2010_9.0.0.463AR_63\Zyzoom_kis2010_9.0.0.463AR.exe
2009-07-10 16:14 . 2009-07-10 16:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-07-10 03:35 . 2009-07-10 03:35 -------- d-----w- c:\windows\l2schemas
2009-07-10 03:35 . 2009-07-10 03:35 -------- d-----w- c:\windows\system32\ar
2009-07-10 03:35 . 2009-07-10 03:35 -------- d-----w- c:\windows\system32\bits
2009-07-10 03:29 . 2009-07-10 03:36 -------- d-----w- c:\windows\ServicePackFiles
2009-07-10 00:11 . 2009-07-10 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-07-10 00:10 . 2009-07-10 00:10 -------- d-----w- c:\program files\Yahoo!
2009-07-09 22:37 . 2001-09-19 11:00 18944 -c--a-w- c:\windows\system32\dllcache\simptcp.dll
2009-07-09 22:37 . 2001-09-19 11:00 18944 ----a-w- c:\windows\system32\simptcp.dll
2009-07-09 22:37 . 2008-04-14 15:59 18944 ----a-w- c:\windows\system32\lprmon.dll
2009-07-09 22:37 . 2008-04-14 15:59 22528 ----a-w- c:\windows\system32\lpdsvc.dll
2009-07-09 20:44 . 2009-07-09 20:44 -------- d-----w- c:\program files\FAHESS
2009-07-09 20:15 . 2009-07-09 20:45 -------- d-----w- c:\documents and settings\yy\Application Data\Motive
2009-07-09 20:14 . 2009-07-09 20:14 -------- d-----w- c:\program files\Fahess_Activation
2009-07-09 20:14 . 2009-07-09 20:44 -------- d-----w- c:\program files\Common Files\Motive
2009-07-09 20:13 . 2009-07-09 20:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-07-09 19:24 . 2009-07-09 19:24 -------- d-----w- c:\program files\PFPortChecker
2009-07-08 18:23 . 2009-07-08 18:23 -------- d-----w- c:\documents and settings\yy\Local Settings\Application Data\Identities
2009-07-08 18:11 . 2009-07-08 18:11 -------- d-sh--w- c:\documents and settings\yy\IECompatCache
2009-07-08 18:10 . 2009-07-08 18:10 -------- d-sh--w- c:\documents and settings\yy\PrivacIE
2009-07-08 17:59 . 2009-07-08 17:59 -------- d-sh--w- c:\documents and settings\yy\IETldCache
2009-07-08 17:49 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-07-08 17:49 . 2009-07-08 17:49 -------- d-----w- c:\windows\ie8updates
2009-07-08 17:48 . 2009-04-30 21:13 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-07-08 17:48 . 2009-04-30 21:13 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-07-08 17:48 . 2009-04-30 21:13 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-07-08 17:48 . 2009-04-30 21:13 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-08 17:46 . 2009-07-10 03:35 -------- d-----w- c:\windows\system32\ar-SA
2009-07-08 17:46 . 2009-07-08 17:48 -------- dc-h--w- c:\windows\ie8
2009-07-08 15:13 . 2008-10-16 11:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-07-08 15:13 . 2008-10-16 11:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-07-08 13:16 . 2000-06-26 08:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2009-07-08 13:16 . 2004-07-26 14:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2009-07-08 13:16 . 2004-07-26 14:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2009-07-08 13:16 . 2004-07-26 14:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2009-07-08 13:16 . 2004-07-26 14:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2009-07-08 13:16 . 2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2009-07-08 13:16 . 2009-07-08 13:16 -------- d-----w- c:\program files\Common Files\Ahead
2009-07-08 13:16 . 2009-07-08 13:16 -------- d-----w- c:\program files\Ahead
2009-07-07 21:57 . 2007-03-15 10:25 13312 ----a-w- c:\windows\system32\mpnatapi.dll
2009-07-07 20:58 . 2004-08-03 19:29 25471 ------w- c:\windows\system32\drivers\watv10nt.sys
2009-07-07 20:58 . 2004-08-03 19:29 22271 ------w- c:\windows\system32\drivers\watv06nt.sys
2009-07-07 20:58 . 2004-08-03 19:29 11935 ------w- c:\windows\system32\drivers\wadv11nt.sys
2009-07-07 20:58 . 2004-08-03 19:29 11871 ------w- c:\windows\system32\drivers\wadv09nt.sys
2009-07-07 20:58 . 2004-08-03 19:29 11807 ------w- c:\windows\system32\drivers\wadv07nt.sys
2009-07-07 20:58 . 2004-08-03 19:29 11295 ------w- c:\windows\system32\drivers\wadv08nt.sys
2009-07-07 20:56 . 2009-07-07 22:04 -------- d-----w- c:\program files\Hotspot Shield
2009-07-07 18:07 . 2009-07-07 18:07 -------- d-sh--w- c:\documents and settings\yy\UserData
2009-07-07 17:59 . 2009-07-10 21:33 -------- d-----w- c:\documents and settings\yy\Tracing
2009-07-07 17:55 . 2009-07-07 17:55 -------- d-----w- c:\program files\Microsoft
2009-07-07 17:54 . 2009-07-07 17:54 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-07-07 17:54 . 2009-07-07 17:56 -------- d-----w- c:\program files\Windows Live
2009-07-07 17:45 . 2009-02-09 11:22 2190592 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-07-07 17:45 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-07-07 17:45 . 2009-03-06 14:20 283136 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-07-07 17:45 . 2009-02-09 11:21 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-07-07 17:45 . 2009-02-09 10:51 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-07-07 17:45 . 2009-02-09 10:51 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-07-07 17:45 . 2009-02-09 10:51 723456 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-07-07 17:45 . 2009-02-09 10:51 681472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-07-07 17:45 . 2009-02-09 10:51 693760 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-07-07 17:45 . 2009-02-09 10:51 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-07-07 17:45 . 2009-02-09 11:22 2146816 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-07-07 17:45 . 2009-02-09 11:22 2025472 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-07-07 17:40 . 2008-06-14 17:31 271616 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-07-07 17:40 . 2008-06-14 17:31 271616 ------w- c:\windows\system32\drivers\bthport.sys
2009-07-07 17:37 . 2009-07-07 17:37 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-07 17:34 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2009-07-07 17:34 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-07-07 17:34 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys
2009-07-07 17:33 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2009-07-07 17:31 . 2008-10-15 16:35 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2009-07-07 17:30 . 2008-04-21 21:14 215040 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-07-07 17:25 . 2009-01-07 15:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-07-07 17:25 . 2009-07-10 14:10 -------- d--h--w- c:\windows\$hf_mig$
2009-07-07 17:24 . 2009-07-07 17:24 -------- d-----w- c:\documents and settings\yy\Application Data\Media Player Classic
2009-07-07 17:22 . 2009-07-07 17:22 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-07 17:22 . 2009-07-07 17:22 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-07-07 17:20 . 2009-07-07 17:20 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-18 15:48 . 2009-06-18 15:48 1915520 ----a-w- c:\documents and settings\yy\Application Data\Macromedia\Flash Player\
2009-06-18 15:38 . 2009-07-10 21:21 -------- d-----w- c:\documents and settings\yy\Local Settings\Application Data\Google
2009-06-18 15:20 . 2009-06-18 15:20 198064 ----a-w- c:\documents and settings\yy\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-18 15:20 . 2009-07-10 21:45 -------- d-----w- c:\documents and settings\yy\Application Data\DMCache
2009-06-18 15:20 . 2009-07-08 17:14 -------- d-----w- c:\documents and settings\yy\Application Data\IDM
2009-06-18 15:20 . 2009-07-08 18:24 -------- d-----w- c:\program files\Internet Download Manager
2009-06-18 14:34 . 2009-06-18 14:34 -------- d-----w- c:\program files\uTorrent
2009-06-18 14:34 . 2009-07-10 21:42 -------- d-----w- c:\documents and settings\yy\Application Data\uTorrent
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-10 21:24 . 2009-06-16 19:16 28240 ----a-w- c:\documents and settings\yy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-10 04:02 . 2001-09-19 11:00 39982 ----a-w- c:\windows\system32\perfc001.dat
2009-07-10 04:02 . 2001-09-19 11:00 251478 ----a-w- c:\windows\system32\perfh001.dat
2009-07-08 00:43 . 2009-06-16 18:15 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-08 00:35 . 2009-07-08 00:35 2232 ----a-w- c:\windows\java\Packages\Data\1J97ZP31.DAT
2009-07-08 00:35 . 2009-07-08 00:35 155995 ----a-w- c:\windows\java\Packages\XBTBPNRP.ZIP
2009-07-08 00:35 . 2009-07-08 00:35 2678 ----a-w- c:\windows\java\Packages\Data\LJ753735.DAT
2009-07-08 00:35 . 2009-07-08 00:35 2678 ----a-w- c:\windows\java\Packages\Data\WTJFFZZZ.DAT
2009-07-08 00:35 . 2009-07-08 00:35 2678 ----a-w- c:\windows\java\Packages\Data\F3JP7BBZ.DAT
2009-07-08 00:35 . 2009-07-08 00:35 2678 ----a-w- c:\windows\java\Packages\Data\0MZJPBV1.DAT
2009-07-08 00:35 . 2009-07-08 00:35 2678 ----a-w- c:\windows\java\Packages\Data\4FBDV71J.DAT
2009-07-07 17:22 . 2009-07-07 17:22 -------- d-----w- c:\program files\Common Files\Real
2009-07-07 17:22 . 2009-07-07 17:20 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-07-07 17:22 . 2009-07-07 17:22 -------- d-----w- c:\program files\Real
2009-06-18 15:26 . 2009-06-16 18:54 -------- d-----w- c:\program files\ESET
2009-06-18 12:57 . 2009-06-16 17:48 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-16 18:26 . 2009-06-16 18:26 -------- d-----w- c:\program files\C-Media 3D Audio
2009-06-16 18:24 . 2009-06-16 18:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-16 18:08 . 2009-06-16 18:08 -------- d-----w- c:\program files\FaxTalk NetOnHold
2009-06-16 18:04 . 2009-06-16 18:04 -------- d-----w- c:\program files\FaxTalk Communicator
2009-06-16 17:49 . 2009-06-16 17:49 -------- d-----w- c:\program files\microsoft frontpage
2009-06-16 17:44 . 2009-06-16 17:44 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-13 05:02 . 2004-08-03 21:55 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-08 06:15 . 2009-05-08 06:15 76384 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\STC Kaspersky Internet Security 2009\Arabic\setup.exe
2009-05-07 15:32 . 2004-08-03 21:55 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-19 19:47 . 2004-08-03 21:46 1847040 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:52 . 2004-08-03 21:55 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-07-07 2815408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-06-18 288048]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CallControl 4.5"="c:\program files\FaxTalk Communicator\FTCtrl32.exe" [2003-06-03 123392]
"NetOnHold"="c:\program files\FaxTalk NetOnHold\Ftnohmgr.exe" [2003-01-24 344064]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-04-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-04-06 114688]
"CM-SmWizard"="c:\windows\System\SmWizard.exe" [2003-08-29 1454080]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-07 185896]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"FAHESS_McciTrayApp"="c:\program files\FAHESS\McciTrayApp.exe" [2009-01-22 1482240]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2003-04-08 548864]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
R4 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys --> c:\windows\system32\drivers\klbg.sys [?]
S3 NtApm;NT Apm/Legacy Interface Driver;c:\windows\system32\drivers\NtApm.sys [16/06/2009 11:38 م 9472]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Cmaudio - cmicnfg.cpl
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.m3com.com.sa
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-11 00:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3268)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-07-10 0:47
ComboFix-quarantined-files.txt 2009-07-10 21:47
Pre-Run: 9,395,671,040 bytes free
Post-Run: 9,384,402,944 bytes free
203 --- E O F --- 2009-07-10 17:09