تفضل اخوي هذه هو التقرير..
ComboFix 09-08-03.03 - M.J 08/04/2009 0:09.1.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.304 [GMT 3:00]
Running from: c:\documents and settings\M.J\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ASC3360PR
-------\Service_asc3360pr
((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))
.
2009-08-03 20:38 . 2009-08-03 20:38 -------- d-----w- c:\program files\KalOnlineEngTest
2009-08-03 20:38 . 2005-05-04 10:39 94208 ----a-w- c:\windows\system32\China.dll
2009-08-03 20:08 . 2009-08-03 20:08 -------- d-----w- c:\program files\Trend Micro
2009-08-03 03:02 . 2003-03-19 03:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-08-03 03:02 . 2003-02-21 11:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-08-03 03:02 . 2003-03-19 04:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-08-03 03:02 . 2009-08-03 03:02 -------- d-----w- c:\program files\KalOnlineEng
2009-08-03 00:31 . 2009-08-03 00:31 -------- d-----w- c:\documents and settings\M.J\Application Data\IDM
2009-08-03 00:31 . 2009-08-03 00:31 -------- d-----w- c:\documents and settings\M.J\Application Data\DMCache
2009-08-02 23:52 . 2009-08-02 23:52 -------- d-sh--w- C:\FOUND.006
2009-07-29 09:21 . 2009-07-29 09:21 -------- d-sh--w- C:\FOUND.005
2009-07-28 09:12 . 2009-07-28 09:12 -------- d-sh--w- C:\FOUND.004
2009-07-27 00:41 . 2009-07-27 00:41 -------- d-sh--w- C:\FOUND.003
2009-07-25 18:28 . 2009-07-25 18:28 -------- d-sh--w- C:\FOUND.002
2009-07-24 13:59 . 2009-07-24 13:59 -------- d-----w- c:\documents and settings\M.J\Application Data\DivX
2009-07-24 06:11 . 2009-07-24 06:11 -------- d-sh--w- C:\FOUND.001
2009-07-23 16:54 . 2009-07-23 16:54 -------- d-----w- c:\documents and settings\M.J\Local Settings\Application Data\Identities
2009-07-23 16:32 . 2004-08-04 02:00 100992 ----a-w- c:\windows\system32\drivers\bthpan.sys
2009-07-23 16:32 . 2004-08-04 02:00 100992 ----a-w- c:\windows\system32\dllcache\bthpan.sys
2009-07-23 16:31 . 2004-08-04 02:00 59648 ----a-w- c:\windows\system32\drivers\rfcomm.sys
2009-07-23 16:31 . 2004-08-04 02:00 59648 ----a-w- c:\windows\system32\dllcache\rfcomm.sys
2009-07-23 16:31 . 2004-08-04 02:00 17024 ----a-w- c:\windows\system32\drivers\BthEnum.sys
2009-07-23 16:31 . 2004-08-04 02:00 17024 ----a-w- c:\windows\system32\dllcache\bthenum.sys
2009-07-23 06:11 . 2009-07-23 06:11 -------- d-sh--w- C:\FOUND.000
2009-07-22 22:52 . 2009-07-23 19:51 4128 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-22 21:37 . 2009-08-03 21:13 836 ----a-w- c:\windows\bthservsdp.dat
2009-07-22 19:35 . 2009-07-22 19:35 -------- d-----w- c:\documents and settings\M.J\Application Data\Apple Computer
2009-07-22 19:35 . 2008-04-17 10:12 15464 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-07-22 19:35 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-07-22 19:35 . 2009-07-22 19:35 -------- d-----w- c:\program files\iPod
2009-07-22 19:34 . 2009-07-22 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-07-22 19:34 . 2009-07-22 19:34 -------- d-----w- c:\program files\iTunes
2009-07-22 19:34 . 2009-07-22 19:34 -------- d-----w- c:\program files\Bonjour
2009-07-22 19:33 . 2009-07-22 19:33 -------- d-----w- c:\program files\QuickTime
2009-07-22 19:33 . 2009-07-22 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-07-22 19:33 . 2009-07-22 19:33 -------- d-----w- c:\documents and settings\M.J\Local Settings\Application Data\Apple
2009-07-22 19:33 . 2009-07-22 19:33 -------- d-----w- c:\program files\Apple Software Update
2009-07-22 19:32 . 2009-07-22 19:33 -------- d-----w- c:\program files\Common Files\Apple
2009-07-22 19:32 . 2009-07-22 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-07-22 19:32 . 2009-07-22 19:32 -------- d-----w- c:\documents and settings\M.J\Local Settings\Application Data\Apple Computer
2009-07-22 15:47 . 2004-08-04 02:00 274304 ----a-w- c:\windows\system32\drivers\bthport.sys
2009-07-22 15:47 . 2004-08-04 02:00 274304 ----a-w- c:\windows\system32\dllcache\bthport.sys
2009-07-22 15:47 . 2004-08-04 02:00 18944 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2009-07-22 15:47 . 2004-08-04 02:00 18944 ----a-w- c:\windows\system32\dllcache\bthusb.sys
2009-07-22 12:54 . 2009-07-22 12:54 -------- d-----w- c:\documents and settings\M.J\Application Data\AdobeUM
2009-07-22 12:53 . 2009-07-22 12:54 -------- d-----w- c:\documents and settings\M.J\Local Settings\Application Data\Adobe
2009-07-22 12:53 . 2009-07-22 12:53 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-21 01:39 . 2009-07-21 01:39 -------- d-----w- c:\documents and settings\M.J\Contacts
2009-07-21 01:38 . 2009-07-21 01:38 -------- d-----w- c:\windows\system32\DRVSTORE
2009-07-21 01:38 . 2009-07-21 01:38 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-21 01:38 . 2009-07-21 01:38 -------- d-----w- c:\program files\Common Files\Real
2009-07-21 01:38 . 2009-07-21 01:38 -------- d-----w- c:\program files\Real
2009-07-21 01:38 . 2009-07-21 01:38 -------- d-----w- c:\program files\MSN Messenger
2009-07-21 01:36 . 2009-07-21 01:36 -------- d-s---w- c:\documents and settings\M.J\UserData
2009-07-21 01:34 . 2009-07-21 01:34 -------- d-----w- c:\windows\Downloaded Installations
2009-07-21 01:32 . 2005-05-27 08:06 253952 ----a-w- c:\windows\system32\Uninstall_eRecovery.exe
2009-07-21 01:32 . 2009-07-21 01:32 -------- d-----w- c:\program files\acer
2009-07-21 01:31 . 2009-07-21 01:31 -------- d-----w- c:\program files\Launch Manager
2009-07-21 01:31 . 2005-01-10 13:48 147456 ----a-w- c:\windows\UNINST32.EXE
2009-07-21 01:31 . 2004-12-09 09:04 5120 ----a-w- c:\windows\system32\FILTRCOI.DLL
2009-07-21 01:31 . 2004-12-08 11:10 16896 ----a-w- c:\windows\system32\drivers\DKbFltr.SYS
2009-07-21 01:29 . 2009-07-21 01:30 -------- d-----w- C:\Acer
2009-07-21 01:29 . 2005-04-07 15:08 78208 ----a-w- c:\windows\system32\drivers\epm-shd.sys
2009-07-21 01:29 . 2004-09-01 20:57 221258 ----a-w- c:\windows\system32\Epm-Po.dll
2009-07-21 01:29 . 2004-07-19 10:10 4096 ----a-w- c:\windows\system32\drivers\epm-psd.sys
2009-07-20 23:29 . 2009-07-20 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-20 23:13 . 2004-08-04 02:00 26496 ----a-w- c:\windows\system32\dllcache\usbstor.sys
2009-07-20 15:43 . 2009-07-20 15:43 -------- d-----w- c:\documents and settings\M.J\amsn
2009-07-20 15:42 . 2009-07-20 15:42 -------- d-----w- c:\program files\aMSN
2009-07-20 15:36 . 2009-07-20 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-07-20 15:25 . 2001-08-17 10:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-07-20 15:25 . 2004-08-04 02:00 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-07-20 14:30 . 2009-07-20 14:30 -------- d-----w- c:\program files\Windows Live
2009-07-20 14:30 . 2009-07-20 14:30 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-20 14:30 . 2009-07-20 14:30 34232 ----a-w- c:\documents and settings\M.J\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-20 13:52 . 2009-07-20 13:52 -------- d-----w- c:\windows\Applian FLV Player
2009-07-20 13:52 . 2009-07-20 13:52 -------- d-----w- c:\program files\FLV Player
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-26 08:38 . 2009-07-26 08:38 2678 ----a-w- c:\windows\java\Packages\Data\5NVPVFN1.DAT
2009-07-26 08:38 . 2009-07-26 08:38 2678 ----a-w- c:\windows\java\Packages\Data\MZ5ZBJ5R.DAT
2009-07-26 08:38 . 2009-07-26 08:38 2678 ----a-w- c:\windows\java\Packages\Data\I1ZX717T.DAT
2009-07-26 08:38 . 2009-07-26 08:38 2678 ----a-w- c:\windows\java\Packages\Data\CQHVFZHB.DAT
2009-07-26 08:38 . 2009-07-26 08:38 2678 ----a-w- c:\windows\java\Packages\Data\5FXNBF5B.DAT
2009-07-24 09:08 . 2009-07-24 09:08 -------- d-----w- c:\program files\DivX
2009-07-24 09:08 . 2009-07-24 09:08 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-07-23 19:51 . 2009-07-22 22:52 1124 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-22 23:05 . 1979-12-31 21:00 593920 ----a-w- c:\windows\ALAUNCH.EXE
2009-07-22 21:10 . 2005-03-16 16:10 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-07-21 11:09 . 2009-07-21 11:09 2232 ----a-w- c:\windows\java\Packages\Data\R73F3TBB.DAT
2009-07-21 11:09 . 2009-07-21 11:09 155995 ----a-w- c:\windows\java\Packages\VRN939RZ.ZIP
2009-07-21 01:30 . 2005-03-16 16:31 1024 ---h--r- c:\windows\system32\NTIBUN4.dll
2009-07-21 01:30 . 2005-03-16 16:30 1024 ---h--r- c:\windows\system32\NTIMPEG2.dll
2009-07-21 01:30 . 2005-03-16 16:30 1024 ---h--r- c:\windows\system32\NTIMP3.dll
2009-07-21 01:30 . 2005-03-16 16:30 1024 ---h--r- c:\windows\system32\NTIFCD3.dll
2009-07-21 01:30 . 2005-03-16 16:30 1024 ---h--r- c:\windows\system32\NTICDMK7.dll
2009-07-21 01:30 . 2005-03-16 16:30 6144 ----a-w- c:\windows\system32\drivers\NTIDrvr.sys
2009-07-20 14:21 . 1979-12-31 21:00 4094 ----a-w- c:\windows\CLEANUP.CMD
2009-07-20 14:21 . 1979-12-31 21:00 228 ----a-w- c:\windows\HOTFIX.BAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2009-07-22 5748080]
"IDMan"="D:\Idman.exe" [2007-09-12 884224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-07 102491]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-07 692315]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-03-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-03-22 204800]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-14 32768]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-04-21 188416]
"ePowerManagement"="c:\acer\ePM\ePM.exe" [2005-03-15 2893824]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2005-04-28 483328]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-21 185872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-07-22 483328]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2004-12-01 77824]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-04-15 88202]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"d:\\wrar38b5.exe"=
"c:\\Program Files\\FLV Player\\flvplayer.exe"=
"c:\\WINDOWS\\Alaunch.exe"=
"c:\\Program Files\\KalOnlineEng\\KalOnline.exe"=
"c:\\PROGRA~1\\LAUNCH~1\\LManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\Program Files\\QuickTime\\QTTask.exe"= c:\\Program Files\\QuickTime\\qttask.exe
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\Program Files\\aMSN\\BIN\\wish.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"d:\\Idman.exe"=
"c:\\ComboFix\\NirCmd.cfexe"=
"c:\\WINDOWS\\SOUNDMAN.EXE"=
--- Other Services/Drivers In Memory ---
*NewlyCreated* - ASC3360PR
.
Contents of the 'Scheduled Tasks' folder
2009-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-eRecoveryService - c:\program files\Acer\eRecovery\Monitor.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local;*.local
IE: Download All Links with IDM - D:\IEGetAll.htm
IE: Download FLV video content with IDM - D:\IEGetVL.htm
IE: Download with IDM - D:\IEExt.htm
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-08-04 00:15
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\RUNDLL32.EXE
c:\acer\eManager\anbmServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-08-03 0:17 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-03 21:17
Pre-Run: 18,709,774,336 bytes free
Post-Run: 19,200,917,504 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
235
؟
