اسف على التاخير لانشغالي
تم التحميل والفحص
وهذا التقرير
ComboFix 09-07-28.06 - Admin 07/29/2009 19:30.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1013.667 [GMT 3:00]
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Admin\Application Data\inst.exe
c:\windows\MsnMsngr.exe
c:\windows\system32\شلال 1.exe
c:\windows\system32\شلال 2.exe
c:\windows\system32\ألعاب نارية.exe
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\ماء.exe
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-29 10:24 . 2009-07-29 10:24 -------- d-----w- c:\program files\Trend Micro
2009-07-28 13:42 . 2009-07-28 13:42 -------- d-sh--w- C:\FOUND.006
2009-07-27 21:44 . 2009-07-27 21:44 -------- d-sh--w- C:\FOUND.005
2009-07-17 14:32 . 2009-07-17 14:32 -------- d-sh--w- C:\FOUND.004
2009-07-13 17:04 . 2009-07-13 17:04 -------- d-sh--w- C:\FOUND.003
2009-07-11 14:01 . 2009-07-11 14:01 -------- d-sh--w- C:\FOUND.002
2009-07-09 15:20 . 2009-07-09 15:20 -------- d-sh--w- C:\FOUND.001
2009-07-05 17:13 . 2007-12-18 07:45 221184 ----a-r- c:\windows\brprs.exe
2009-07-01 15:49 . 2003-12-12 13:06 1693696 ----a-w- c:\windows\system32\ltclr13n.dll
2009-07-01 15:49 . 2003-11-04 12:11 155648 ----a-w- c:\windows\system32\lftif13n.dll
2009-07-01 15:49 . 2003-11-04 12:10 98304 ----a-w- c:\windows\system32\lffax13n.dll
2009-07-01 15:49 . 2003-11-04 12:10 69632 ----a-w- c:\windows\system32\lfgif13n.dll
2009-07-01 15:49 . 2004-05-14 13:53 462848 ----a-w- c:\windows\system32\ltkrn13n.dll
2009-07-01 15:49 . 2004-05-14 13:53 450560 ----a-w- c:\windows\system32\ltimg13n.dll
2009-07-01 15:49 . 2004-05-14 13:53 299008 ----a-w- c:\windows\system32\ltdis13n.dll
2009-07-01 15:49 . 2004-05-14 13:53 163840 ----a-w- c:\windows\system32\ltfil13n.dll
2009-07-01 15:49 . 2004-05-14 13:53 57344 ----a-w- c:\windows\system32\lfbmp13n.dll
2009-07-01 15:49 . 2004-05-14 13:53 401408 ----a-w- c:\windows\system32\lfcmp13n.dll
2009-07-01 15:49 . 2004-01-11 23:09 206336 ----a-w- c:\windows\system32\ltefx13n.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-28 21:06 . 2009-06-28 21:06 -------- d-----w- c:\documents and settings\Admin\Application Data\WORLDSPAN
2009-06-27 06:50 . 2009-06-27 06:50 -------- d-----w- c:\documents and settings\All Users\Application Data\SSScanAppDataDir
2009-06-27 06:50 . 2009-06-27 06:50 -------- d-----w- c:\documents and settings\All Users\Application Data\MSScanAppDataDir
2009-06-27 06:49 . 2009-06-17 19:18 196982 ----a-w- c:\windows\hpwins19.dat
2009-06-27 06:48 . 2009-06-27 06:48 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-06-18 06:46 . 2009-06-18 06:46 -------- d-----w- c:\documents and settings\Admin\Application Data\HP
2009-06-17 19:30 . 2009-06-17 19:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-06-17 19:28 . 2009-06-17 19:28 -------- d-----w- c:\documents and settings\Admin\Application Data\HPAppData
2009-06-17 19:26 . 2009-06-17 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-06-17 19:26 . 2009-06-17 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-06-17 19:25 . 2009-06-17 19:25 -------- d-----w- c:\program files\Common Files\HP
2009-06-17 19:25 . 2009-06-17 19:25 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-06-17 19:25 . 2009-06-17 19:25 -------- d-----w- c:\program files\Hewlett-Packard
2009-06-17 19:23 . 2009-06-17 19:23 -------- d-----w- c:\program files\HP
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-12 185896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
TP-LINK Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN313G_353G_353GD\RtWLan.exe [2009-3-9 790528]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
Worldspan Filter Agent.lnk - c:\wspan\swgw\FilterAgent.exe [2009-6-29 127044]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NMIndexingService"=3 (0x3)
"BITS"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Corel\\DVD9\\WinDVD.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\System32\\DllHost.exe"=
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [3/9/2009 2:13 AM 38144]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [4/17/2007 8:09 PM 11032]
S3 trid3d;trid3d;c:\windows\system32\drivers\trid3dm.sys [5/12/2008 1:42 AM 222336]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Winreg32 - MsnMsngr.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: amadeusproweb.com
Trusted Zone: amadeusvista.com
Trusted Zone: worldspan.com
Trusted Zone: wspan.com
Trusted Zone: amadeusproweb.com
Trusted Zone: amadeusvista.com
DPF: Microsoft XML Parser for Java -
DPF: {7B72C3FC-34B5-4504-B4BE-EB38971A0888} - hxxp://go.worldspan.com/Dlls/WSFileIO3.cab
DPF: {F96020DD-C373-44A0-82B6-064EF0AEEAE3} - hxxp://certificates.amadeusvista.com/sgwadmin/RegSiteTools.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-29 19:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-07-29 19:35
ComboFix-quarantined-files.txt 2009-07-29 16:35
Pre-Run: 35,613,868,032 bytes free
Post-Run: 37,263,671,296 bytes free
131
