عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
==============
اول شي : مشكوووووووووووووور اخوي ع الاهتمام وسرعة الرد :b:
ثاني شي : اخوي سوى فحص للجهاز بس ما سوى اعادة تشغيل واعطاني هذا التقرير
ComboFix 09-09-18.02 - MACC 09/22/2009 14:41.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.3582.3040 [GMT 3:00]
Running from: c:\documents and settings\MACC\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-08-22 to 2009-09-22 )))))))))))))))))))))))))))))))
.
2009-09-16 03:04 . 2009-09-16 03:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-16 03:03 . 2009-09-16 03:03 -------- d-----w- c:\program files\Realtek
2009-09-16 01:06 . 2009-09-16 01:06 -------- d-----w- c:\program files\Yahoo!
2009-09-15 16:18 . 2009-09-15 16:18 -------- d-----w- c:\documents and settings\MACC\Application Data\TechSmith
2009-09-15 14:52 . 2009-09-15 14:52 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith
2009-09-15 14:52 . 2009-09-16 03:58 -------- d-----w- c:\documents and settings\MACC\Local Settings\Application Data\TechSmith
2009-09-15 14:47 . 2009-09-15 14:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-05 03:49 . 2009-09-06 15:59 -------- d-----w- c:\program files\Reshade
2009-08-28 06:28 . 2009-08-28 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\IM
2009-08-28 06:27 . 2009-09-02 16:52 -------- d-----w- c:\documents and settings\MACC\Local Settings\Application Data\IM
2009-08-28 06:27 . 2009-08-28 06:27 -------- d-----w- c:\program files\IncrediMail
2009-08-28 06:27 . 2009-08-28 06:27 -------- d-----w- c:\documents and settings\All Users\Application Data\IncrediMail
2009-08-27 21:06 . 2009-08-27 21:06 -------- d--h--w- c:\windows\PIF
2009-08-26 17:01 . 2009-08-26 17:01 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-26 15:29 . 2009-08-26 15:29 -------- d-----w- c:\program files\Common Files\PCSuite
2009-08-26 15:28 . 2009-08-26 15:28 -------- d-----w- c:\program files\Common Files\muvee Technologies
2009-08-25 00:28 . 2009-08-25 00:28 -------- d-----w- c:\program files\Common Files\xing shared
2009-08-24 23:44 . 2009-08-24 23:44 -------- d-----w- c:\program files\Orb Networks
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-22 11:22 . 2009-08-17 10:12 -------- d-----w- c:\documents and settings\MACC\Application Data\IMVU
2009-09-21 23:51 . 2009-08-19 04:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-21 22:48 . 2009-08-19 04:49 516128 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-21 22:48 . 2009-08-19 04:49 3892 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-21 22:48 . 2009-08-19 04:49 2874400 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-21 22:48 . 2009-08-19 04:49 24584 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-19 07:08 . 2009-08-18 13:47 1166728 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-19 04:43 . 2001-09-19 11:00 72832 ----a-w- c:\windows\system32\perfc001.dat
2009-09-19 04:43 . 2001-09-19 11:00 379076 ----a-w- c:\windows\system32\perfh001.dat
2009-09-16 05:03 . 2009-07-20 19:51 -------- d-----w- c:\documents and settings\MACC\Application Data\Skype
2009-09-16 03:03 . 2009-03-16 16:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-15 21:07 . 2009-07-20 20:00 -------- d-----w- c:\documents and settings\MACC\Application Data\skypePM
2009-09-10 22:28 . 2009-08-19 04:50 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-09-10 22:28 . 2009-08-19 04:50 107547 ----a-w- c:\windows\system32\drivers\klin.dat
2009-09-03 21:45 . 2009-09-03 21:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-08-30 18:00 . 2009-03-17 20:52 -------- d-----w- c:\program files\Google
2009-08-26 23:59 . 2009-03-16 20:49 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-08-26 22:01 . 2009-08-18 13:52 -------- d-----w- c:\program files\Nokia
2009-08-26 17:16 . 2009-08-18 21:34 -------- d-----w- c:\documents and settings\MACC\Application Data\Nokia
2009-08-26 17:06 . 2009-03-16 16:21 54344 ----a-w- c:\documents and settings\MACC\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-26 15:45 . 2009-08-18 15:12 -------- d-----w- c:\program files\Common Files\Nokia
2009-08-25 00:28 . 2009-03-17 11:52 -------- d-----w- c:\program files\Common Files\Real
2009-08-23 05:36 . 2009-08-06 20:59 -------- d-----w- c:\documents and settings\MACC\Application Data\cleaner
2009-08-21 05:31 . 2009-08-21 05:22 -------- d-----w- c:\documents and settings\MACC\Application Data\Nseries
2009-08-19 21:40 . 2009-08-19 00:20 -------- d-----w- c:\documents and settings\MACC\Application Data\PC Suite
2009-08-19 06:21 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-08-19 05:05 . 2009-08-19 05:05 19406 ----a-w- c:\documents and settings\MACC\Application Data\litemes.exe
2009-08-19 05:05 . 2009-08-19 05:05 18026 ----a-w- c:\program files\Common Files\kyjamanewy.pif
2009-08-19 05:05 . 2009-08-19 05:05 14084 ----a-w- c:\documents and settings\MACC\Application Data\racew.bin
2009-08-19 05:05 . 2009-08-19 05:05 13844 ----a-w- c:\windows\system32\foxyso.sys
2009-08-19 05:05 . 2009-08-19 05:05 13180 ----a-w- c:\documents and settings\MACC\Local Settings\Application Data\yxapami.pif
2009-08-19 05:05 . 2009-08-19 05:05 10174 ----a-w- c:\documents and settings\MACC\Application Data\nafehil.dll
2009-08-19 04:38 . 2009-03-16 16:13 23408 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-19 04:26 . 2009-08-19 00:24 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-08-19 03:25 . 2009-08-19 03:25 14977 ----a-w- c:\documents and settings\All Users\Application Data\canaruwu.dat
2009-08-19 03:25 . 2009-08-19 03:25 11294 ----a-w- c:\program files\Common Files\bilud.dat
2009-08-19 02:47 . 2009-08-19 02:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-08-19 01:59 . 2009-08-19 01:59 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-08-19 01:59 . 2009-08-19 01:59 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-08-19 01:58 . 2009-08-19 01:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-08-19 01:58 . 2009-08-19 01:58 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-08-19 00:27 . 2009-06-22 05:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-19 00:26 . 2009-08-19 00:25 -------- d-----w- c:\documents and settings\MACC\Application Data\muvee Technologies
2009-08-19 00:25 . 2009-08-19 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\muvee Technologies
2009-08-18 17:04 . 2009-08-18 17:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-08-18 17:01 . 2009-08-18 17:01 -------- d-----w- c:\documents and settings\All Users\Application Data\NokiaMusic
2009-08-18 14:11 . 2009-08-18 14:11 -------- d-----w- c:\program files\DIFX
2009-08-18 13:47 . 2009-08-18 13:47 -------- d-----w- c:\program files\MSBuild
2009-08-18 13:47 . 2009-08-18 13:47 -------- d-----w- c:\program files\Reference Assemblies
2009-08-18 13:44 . 2009-08-18 13:44 -------- d-----w- c:\program files\MSXML 6.0
2009-08-17 10:12 . 2009-08-13 01:46 -------- d-----w- c:\documents and settings\MACC\Application Data\IMVUClient
2009-08-17 08:37 . 2009-08-17 08:37 -------- d-----w- c:\program files\TechSmith
2009-08-07 10:03 . 2009-08-07 10:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-08-07 02:48 . 2009-03-19 17:31 -------- d-----w- c:\program files\Messenger Plus! Live
2009-08-07 02:16 . 2009-08-07 02:15 -------- d-----w- c:\program files\Windows Live
2009-08-07 02:15 . 2009-08-07 02:15 -------- d-----w- c:\program files\Microsoft
2009-08-07 02:15 . 2009-08-07 02:15 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-07 02:00 . 2009-08-07 02:00 -------- d-----w- c:\program files\Common Files\Windows Live
2009-08-06 23:38 . 2009-08-06 23:38 -------- d-----w- c:\program files\Windows Installer Clean Up
2009-08-06 23:38 . 2009-08-06 23:38 -------- d-----w- c:\program files\MSECACHE
2009-08-06 20:59 . 2009-08-06 20:59 -------- d-----w- c:\documents and settings\MACC\Application Data\CyberScrub
2009-08-06 19:23 . 2009-08-06 19:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-06 19:20 . 2009-08-06 19:20 -------- d-----w- c:\documents and settings\MACC\Application Data\Malwarebytes
2009-08-06 19:20 . 2009-08-06 19:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-06 16:29 . 2009-08-06 16:29 -------- d-----w- c:\program files\Trend Micro
2009-08-04 17:52 . 2009-08-04 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-08-03 10:36 . 2009-08-06 19:20 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-27 15:12 . 2009-07-04 19:00 -------- d-----w- c:\documents and settings\MACC\Application Data\elseisosize
2009-07-20 20:00 . 2009-07-20 20:00 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-07-09 20:12 . 2009-07-09 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-08-10 251264]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-08-19 208616]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-08-25 198160]
"NokiaMusic FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-16 1630208]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\MACC\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
IMVU.lnk - c:\documents and settings\MACC\Application Data\IMVUClient\IMVUClient.exe [2009-8-6 52992]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
SymmTime.lnk - c:\program files\Symmetricom\SymmTime\GeTTime.exe [2009-4-6 1347584]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
S2 TwonkyMedia;TwonkyMedia;c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 --> c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [31/03/2009 01:28 ص 33176]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &Search
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\MACC\قائمة ابدأ\البرامج\IMVU\Run IMVU.lnk
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com \download.windowsupdate
Trusted Zone: windowsupdate.com\download
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\MACC\Application Data\Mozilla\Firefox\Profiles\kmvi3293.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/firefox?client=firefox-a&rls=org.mozilla:en-US
fficial
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - component: c:\documents and settings\MACC\Application Data\Mozilla\Firefox\Profiles\kmvi3293.default\extensions\{6FF1D3C4-61BC-4021-89B7-AF8A8F784EBB}\components\snagitmozextension.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-09-22 14:42
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1224)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-22 14:45
ComboFix-quarantined-files.txt 2009-09-22 11:44
ComboFix2.txt 2009-09-22 11:39
ComboFix3.txt 2009-08-06 18:32
Pre-Run: 122,259,214,336 bytes free
Post-Run: 122,248,978,432 bytes free
194
