اول شي : مشكوووووووووووووور اخوي ع الاهتمام وسرعة الرد :b:
ثاني شي : اخوي سوى فحص للجهاز بس ما سوى اعادة تشغيل واعطاني هذا التقرير
ComboFix 09-09-18.02 - MACC 09/22/2009 14:41.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.3582.3040 [GMT 3:00]
Running from: c:\documents and settings\MACC\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-08-22 to 2009-09-22 )))))))))))))))))))))))))))))))
.
2009-09-16 03:04 . 2009-09-16 03:04 -------- d-----w- c:\windows\system32\wbem\Repository
2009-09-16 03:03 . 2009-09-16 03:03 -------- d-----w- c:\program files\Realtek
2009-09-16 01:06 . 2009-09-16 01:06 -------- d-----w- c:\program files\Yahoo!
2009-09-15 16:18 . 2009-09-15 16:18 -------- d-----w- c:\documents and settings\MACC\Application Data\TechSmith
2009-09-15 14:52 . 2009-09-15 14:52 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith
2009-09-15 14:52 . 2009-09-16 03:58 -------- d-----w- c:\documents and settings\MACC\Local Settings\Application Data\TechSmith
2009-09-15 14:47 . 2009-09-15 14:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-05 03:49 . 2009-09-06 15:59 -------- d-----w- c:\program files\Reshade
2009-08-28 06:28 . 2009-08-28 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\IM
2009-08-28 06:27 . 2009-09-02 16:52 -------- d-----w- c:\documents and settings\MACC\Local Settings\Application Data\IM
2009-08-28 06:27 . 2009-08-28 06:27 -------- d-----w- c:\program files\IncrediMail
2009-08-28 06:27 . 2009-08-28 06:27 -------- d-----w- c:\documents and settings\All Users\Application Data\IncrediMail
2009-08-27 21:06 . 2009-08-27 21:06 -------- d--h--w- c:\windows\PIF
2009-08-26 17:01 . 2009-08-26 17:01 -------- d-----w- c:\program files\Windows Media Connect 2
2009-08-26 15:29 . 2009-08-26 15:29 -------- d-----w- c:\program files\Common Files\PCSuite
2009-08-26 15:28 . 2009-08-26 15:28 -------- d-----w- c:\program files\Common Files\muvee Technologies
2009-08-25 00:28 . 2009-08-25 00:28 -------- d-----w- c:\program files\Common Files\xing shared
2009-08-24 23:44 . 2009-08-24 23:44 -------- d-----w- c:\program files\Orb Networks
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-22 11:22 . 2009-08-17 10:12 -------- d-----w- c:\documents and settings\MACC\Application Data\IMVU
2009-09-21 23:51 . 2009-08-19 04:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-21 22:48 . 2009-08-19 04:49 516128 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-09-21 22:48 . 2009-08-19 04:49 3892 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-09-21 22:48 . 2009-08-19 04:49 2874400 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-21 22:48 . 2009-08-19 04:49 24584 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-19 07:08 . 2009-08-18 13:47 1166728 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-19 04:43 . 2001-09-19 11:00 72832 ----a-w- c:\windows\system32\perfc001.dat
2009-09-19 04:43 . 2001-09-19 11:00 379076 ----a-w- c:\windows\system32\perfh001.dat
2009-09-16 05:03 . 2009-07-20 19:51 -------- d-----w- c:\documents and settings\MACC\Application Data\Skype
2009-09-16 03:03 . 2009-03-16 16:21 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-15 21:07 . 2009-07-20 20:00 -------- d-----w- c:\documents and settings\MACC\Application Data\skypePM
2009-09-10 22:28 . 2009-08-19 04:50 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-09-10 22:28 . 2009-08-19 04:50 107547 ----a-w- c:\windows\system32\drivers\klin.dat
2009-09-03 21:45 . 2009-09-03 21:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-08-30 18:00 . 2009-03-17 20:52 -------- d-----w- c:\program files\Google
2009-08-26 23:59 . 2009-03-16 20:49 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-08-26 22:01 . 2009-08-18 13:52 -------- d-----w- c:\program files\Nokia
2009-08-26 17:16 . 2009-08-18 21:34 -------- d-----w- c:\documents and settings\MACC\Application Data\Nokia
2009-08-26 17:06 . 2009-03-16 16:21 54344 ----a-w- c:\documents and settings\MACC\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-26 15:45 . 2009-08-18 15:12 -------- d-----w- c:\program files\Common Files\Nokia
2009-08-25 00:28 . 2009-03-17 11:52 -------- d-----w- c:\program files\Common Files\Real
2009-08-23 05:36 . 2009-08-06 20:59 -------- d-----w- c:\documents and settings\MACC\Application Data\cleaner
2009-08-21 05:31 . 2009-08-21 05:22 -------- d-----w- c:\documents and settings\MACC\Application Data\Nseries
2009-08-19 21:40 . 2009-08-19 00:20 -------- d-----w- c:\documents and settings\MACC\Application Data\PC Suite
2009-08-19 06:21 . 2008-01-29 15:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-08-19 05:05 . 2009-08-19 05:05 19406 ----a-w- c:\documents and settings\MACC\Application Data\litemes.exe
2009-08-19 05:05 . 2009-08-19 05:05 18026 ----a-w- c:\program files\Common Files\kyjamanewy.pif
2009-08-19 05:05 . 2009-08-19 05:05 14084 ----a-w- c:\documents and settings\MACC\Application Data\racew.bin
2009-08-19 05:05 . 2009-08-19 05:05 13844 ----a-w- c:\windows\system32\foxyso.sys
2009-08-19 05:05 . 2009-08-19 05:05 13180 ----a-w- c:\documents and settings\MACC\Local Settings\Application Data\yxapami.pif
2009-08-19 05:05 . 2009-08-19 05:05 10174 ----a-w- c:\documents and settings\MACC\Application Data\nafehil.dll
2009-08-19 04:38 . 2009-03-16 16:13 23408 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-19 04:26 . 2009-08-19 00:24 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-08-19 03:25 . 2009-08-19 03:25 14977 ----a-w- c:\documents and settings\All Users\Application Data\canaruwu.dat
2009-08-19 03:25 . 2009-08-19 03:25 11294 ----a-w- c:\program files\Common Files\bilud.dat
2009-08-19 02:47 . 2009-08-19 02:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-08-19 01:59 . 2009-08-19 01:59 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf
2009-08-19 01:59 . 2009-08-19 01:59 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
2009-08-19 01:58 . 2009-08-19 01:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-08-19 01:58 . 2009-08-19 01:58 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-08-19 00:27 . 2009-06-22 05:26 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-19 00:26 . 2009-08-19 00:25 -------- d-----w- c:\documents and settings\MACC\Application Data\muvee Technologies
2009-08-19 00:25 . 2009-08-19 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\muvee Technologies
2009-08-18 17:04 . 2009-08-18 17:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-08-18 17:01 . 2009-08-18 17:01 -------- d-----w- c:\documents and settings\All Users\Application Data\NokiaMusic
2009-08-18 14:11 . 2009-08-18 14:11 -------- d-----w- c:\program files\DIFX
2009-08-18 13:47 . 2009-08-18 13:47 -------- d-----w- c:\program files\MSBuild
2009-08-18 13:47 . 2009-08-18 13:47 -------- d-----w- c:\program files\Reference Assemblies
2009-08-18 13:44 . 2009-08-18 13:44 -------- d-----w- c:\program files\MSXML 6.0
2009-08-17 10:12 . 2009-08-13 01:46 -------- d-----w- c:\documents and settings\MACC\Application Data\IMVUClient
2009-08-17 08:37 . 2009-08-17 08:37 -------- d-----w- c:\program files\TechSmith
2009-08-07 10:03 . 2009-08-07 10:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-08-07 02:48 . 2009-03-19 17:31 -------- d-----w- c:\program files\Messenger Plus! Live
2009-08-07 02:16 . 2009-08-07 02:15 -------- d-----w- c:\program files\Windows Live
2009-08-07 02:15 . 2009-08-07 02:15 -------- d-----w- c:\program files\Microsoft
2009-08-07 02:15 . 2009-08-07 02:15 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-08-07 02:00 . 2009-08-07 02:00 -------- d-----w- c:\program files\Common Files\Windows Live
2009-08-06 23:38 . 2009-08-06 23:38 -------- d-----w- c:\program files\Windows Installer Clean Up
2009-08-06 23:38 . 2009-08-06 23:38 -------- d-----w- c:\program files\MSECACHE
2009-08-06 20:59 . 2009-08-06 20:59 -------- d-----w- c:\documents and settings\MACC\Application Data\CyberScrub
2009-08-06 19:23 . 2009-08-06 19:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-06 19:20 . 2009-08-06 19:20 -------- d-----w- c:\documents and settings\MACC\Application Data\Malwarebytes
2009-08-06 19:20 . 2009-08-06 19:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-06 16:29 . 2009-08-06 16:29 -------- d-----w- c:\program files\Trend Micro
2009-08-04 17:52 . 2009-08-04 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-08-03 10:36 . 2009-08-06 19:20 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-27 15:12 . 2009-07-04 19:00 -------- d-----w- c:\documents and settings\MACC\Application Data\elseisosize
2009-07-20 20:00 . 2009-07-20 20:00 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-07-09 20:12 . 2009-07-09 20:12 410984 ----a-w- c:\windows\system32\deploytk.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-08-10 251264]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-08-19 208616]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-08-25 198160]
"NokiaMusic FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-16 1630208]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\MACC\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
IMVU.lnk - c:\documents and settings\MACC\Application Data\IMVUClient\IMVUClient.exe [2009-8-6 52992]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
SymmTime.lnk - c:\program files\Symmetricom\SymmTime\GeTTime.exe [2009-4-6 1347584]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
S2 TwonkyMedia;TwonkyMedia;c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 --> c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [31/03/2009 01:28 ص 33176]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
IE: &Search
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\MACC\قائمة ابدأ\البرامج\IMVU\Run IMVU.lnk
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com \download.windowsupdate
Trusted Zone: windowsupdate.com\download
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\MACC\Application Data\Mozilla\Firefox\Profiles\kmvi3293.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/firefox?client=firefox-a&rls=org.mozilla:en-US
fficial
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - component: c:\documents and settings\MACC\Application Data\Mozilla\Firefox\Profiles\kmvi3293.default\extensions\{6FF1D3C4-61BC-4021-89B7-AF8A8F784EBB}\components\snagitmozextension.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-09-22 14:42
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(1224)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-22 14:45
ComboFix-quarantined-files.txt 2009-09-22 11:44
ComboFix2.txt 2009-09-22 11:39
ComboFix3.txt 2009-08-06 18:32
Pre-Run: 122,259,214,336 bytes free
Post-Run: 122,248,978,432 bytes free
194
