سويت يا أخي العزيز زي ما قلت و هذه نتائج التحاليل المخبرية ... والله يعطيك العافية
ComboFix 08-04-11.8 - 04/14/2008 0:57:46.2 TM - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.197 [GMT 3:00]
Running from: C:\Documents and Settings\TM\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\auto.exe
C:\Autorun.inf
C:\Program Files\Common Files\cpush
C:\Program Files\Common Files\cpush\cpush.dll
C:\Program Files\Common Files\cpush\Uninst.exe
C:\WINDOWS\system32\389A78B2.DLL
C:\WINDOWS\system32\drivers\acpidisk.sys
C:\WINDOWS\system32\mprmsgse.axz
C:\WINDOWS\system32\mscpx32r.det
C:\WINDOWS\TEMP\~my1.tmp
.
---- Previous Run -------
.
C:\auto.exe
C:\Autorun.inf
C:\Documents and Settings\All Users.WINDOWS\قائمة ابدأ\البرامج\ADSTechnology
C:\Documents and Settings\All Users.WINDOWS\قائمة ابدأ\البرامج\ADSTechnology\ADSTechnology.lnk
C:\Documents and Settings\All Users.WINDOWS\قائمة ابدأ\البرامج\ADSTechnology\Uninstall.lnk
C:\Documents and Settings\All Users.WINDOWS\Application Data\microsoft\pctools
C:\Documents and Settings\All Users.WINDOWS\Application Data\microsoft\pctools\pctools.dll
C:\privilege.dat
C:\Program Files\ActivationManager
C:\Program Files\ActivationManager\Uninstall.exe
C:\Program Files\ADSTechnology
C:\Program Files\ADSTechnology\Uninstall.exe
C:\Program Files\Common Files\cpush
C:\Program Files\Common Files\cpush\cpush.dll
C:\Program Files\Common Files\cpush\Uninst.exe
C:\Program Files\FunWebProducts
C:\v.exe
C:\WINDOWS\avpsrv.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\DbgHlp32.exe
C:\WINDOWS\dxtmechk
C:\WINDOWS\kvsc3.exe
C:\WINDOWS\lotushlp.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\msccrt.exe
C:\WINDOWS\msimms32.exe
C:\WINDOWS\NAVMon32.exE
C:\WINDOWS\regedit.com
C:\WINDOWS\SHAProc.exe
C:\WINDOWS\system32\389A78B2.DLL
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\avpsrv.dll
C:\WINDOWS\system32\bjrvm.cfg
C:\WINDOWS\system32\bjrvm.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\d3d1caps.srg
C:\WINDOWS\system32\D3D9_32.DLL
C:\WINDOWS\system32\D3D9_64.DLL
C:\WINDOWS\system32\DbgHlp32.dll
C:\WINDOWS\system32\drivers\acpidisk.sys
C:\WINDOWS\system32\drivers\msosmsfpfis64.sys
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\DXDLG.EXE
C:\WINDOWS\system32\iexplorer.exe
C:\WINDOWS\system32\k11125665002.exe
C:\WINDOWS\system32\k11125665012.exe
C:\WINDOWS\system32\k11125665013.exe
C:\WINDOWS\system32\k11125665023.exe
C:\WINDOWS\system32\k11125665024.exe
C:\WINDOWS\system32\k11125665065.exe
C:\WINDOWS\system32\k11125665076.exe
C:\WINDOWS\system32\kvsc3.dll
C:\WINDOWS\system32\lariytrz.dll
C:\WINDOWS\system32\LotusHlp.dll
C:\WINDOWS\system32\mppds.dll
C:\WINDOWS\system32\mprmsgse.axz
C:\WINDOWS\system32\msccrt.dll
C:\WINDOWS\system32\mscpx32r.det
C:\WINDOWS\system32\mseion.sys
C:\WINDOWS\system32\msepbe.dll
C:\WINDOWS\system32\msimms32.dll
C:\WINDOWS\system32\msosdohs.dat
C:\WINDOWS\system32\msosdohs00.dll
C:\WINDOWS\system32\NAVMon32.dll
C:\WINDOWS\system32\nvdispdrv.dll
C:\WINDOWS\system32\Packet.dll
C:\WINDOWS\system32\PTS****l.dll
C:\WINDOWS\system32\REGKEY.hiv
C:\WINDOWS\system32\SHAProc.dll
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\system32\ttDABDAB1058.dll
C:\WINDOWS\system32\ttDABDAB1058.exe
C:\WINDOWS\system32\upxdnd.dll
C:\WINDOWS\system32\WanPacket.dll
C:\WINDOWS\system32\WINSvr32.dll
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\system32\WSockDrv32.dll
C:\WINDOWS\TEMP\~my1.tmp
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\WSockDrv32.exe
E:\auto.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ACPIDISK
-------\Legacy_MSFPFIS64
-------\Service_acpidisk
-------\Service_lariytrz
-------\Service_msfpfis64
-------\Service_ttDABDAB1058
-------\Legacy_npf
-------\npf
-------\Legacy_ACPIDISK
-------\Service_acpidisk
((((((((((((((((((((((((( Files Created from 2008-03-13 to 2008-04-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-13 22:03 14,016 ----a-w C:\WINDOWS\system32\drivers\HBKernel.sys
2008-03-26 13:44 0 ----a-w C:\savelist.dat
2008-03-26 13:43 64 ----a-w C:\savelist1.dat
2008-03-11 18:53 --------- d-----w C:\Program Files\Windows Live
2008-03-11 18:53 --------- d-----w C:\Program Files\MSN Messenger
2008-03-11 18:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-03-10 15:17 --------- d-----w C:\Program Files\hp deskjet 3320 series
2008-03-10 13:59 --------- d-----w C:\Program Files\adcairo
2008-03-10 10:59 --------- d-----w C:\Program Files\Conduit
2008-02-27 01:37 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-02-27 01:37 172,032 ------w C:\WINDOWS\Setup1.exe
2008-02-20 22:31 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-17 17:22 105,525 --sh--r C:\m1t8ta.com
2007-08-17 11:56 92 ----a-w C:\Program Files\MapInfoProLicense800.LIC
2005-04-30 01:20 3,956,736 ----a-w C:\Program Files\MAPINFOW.bak
2002-04-12 21:31 15,327 --sh--w C:\WINDOWS\system32\cuhad.dll
2007-04-16 15:52 11,932 --sh--w C:\WINDOWS\system32\gmnait.dll
2002-04-03 22:20 20,345 --sh--w C:\WINDOWS\system32\wuauc1t.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{11F09AFD-75AD-4E51-AB43-E09E9351CE16}]
03/17/2008 12:15 PM 180224 --a------ C:\Program Files\Common Files\CPUSH\cpush.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [11/01/2005 04:15 AM 163840 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [03/08/2005 03:33 AM 53248 C:\WINDOWS\system32\VTTimer.exe]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [08/04/2004 12:56 AM 142848]
"SoundMan"="SOUNDMAN.EXE" [10/04/2005 02:12 PM 90112 C:\WINDOWS\soundman.exe]
"SMSERIAL"="sm56hlpr.exe" [07/06/2005 04:47 AM 544768 C:\WINDOWS\sm56hlpr.exe]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [12/05/2003 02:22 PM 159744]
"ygzjslit"="C:\WINDOWS\gjltlpbx.exe" [04/12/2002 08:37 PM 18985]
"tciocp32"="C:\WINDOWS\tciocp32.exe" [04/11/2002 01:47 AM 17353]
"dndsioc"="C:\WINDOWS\dndsioc.exe" [04/11/2002 01:48 AM 16849]
"fmbiost"="C:\WINDOWS\fmbiost.exe" [04/11/2002 01:48 AM 17101]
"fmsbbqi"="C:\WINDOWS\fmsbbqi.exe" [04/11/2002 01:48 AM 17805]
"fmsbbqi"="C:\WINDOWS\fmsbbqi.exe" [04/11/2002 01:48 AM 17805]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\****lexecutehooks]
"{0098EFB8-D7A2-456A-AE04-EB9ABF822FE4}"= C:\DOCUME~1\4949~1\LOCALS~1\Temp\k101847887819ow.dll [04/11/2002 01:48 AM 17120]
"{C0595A7E-2E2F-4B34-A83A-019270A0A464}"= C:\WINDOWS\system32\tdffdl.dll [04/13/2002 12:30 AM 165462]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360rpt.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360safe.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\360tray.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ANTIARP.exe]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Ast.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AutoRunKiller.exe]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AvMonitor.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AVP.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\CCenter.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Frameworkservice.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IceSword.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Iparmor.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KASARP.exe]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KRegEx.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVMonxp.kxp]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVSrvXP.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\KVWSC.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Mmsk.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Navapsvc.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Nod32kui.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\QQDOCTOR.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Regedit.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\VPC32.exe]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\VPTRAY.exe]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\WOPTILITIES.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Wuauclt.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\~.EXE]
Debugger=C:\WINDOWS\system32\wuauc1t.exe
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\قائمة ابدأ\البرامج\بدء التشغيل\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^قائمة ابدأ^البرامج^بدء التشغيل^InterVideo WinCinema Manager.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\قائمة ابدأ\البرامج\بدء التشغيل\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Athan]
--a------ 03/05/2005 12:29 PM 700416 C:\Program Files\Athan\Athan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_EMC]
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 08/04/2004 12:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/04/2004 12:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DialerDetect]
--a------ 05/03/2005 05:06 PM 860160 C:\PROGRA~1\COMMON~1\Nesma\Nesma.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 07/11/2002 09:03 PM 188416 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McENUI]
C:\PROGRA~1\McAfee\MHN\McENUI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mfchlp32]
--a------ 04/11/2002 01:48 AM 15580 C:\WINDOWS\mfchlp32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MskAgentexe]
C:\Program Files\McAfee\MSK\MskAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 10/13/2004 07:24 PM 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 10/18/2007 11:34 AM 5724184 c:\program files\windows live\messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
--a------ 02/10/2005 05:00 PM 1937408 C:\program files\ahead\nero backitup\nbj.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 10:50 AM 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSLauncher]
--a------ 11/28/2006 01:12 AM 2658304 C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 06/27/2006 04:21 PM 1449984 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerDVD]
--a------ 11/02/2004 08:33 PM 499712 C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 11/02/2004 08:24 PM 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteAdvisor]
C:\Program Files\SiteAdvisor\6145\SiteAdv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 04/19/2006 08:27 AM 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\InterVideo\\DVD5\\WinDVD.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
R2 acpidisk;acpidisk;C:\WINDOWS\system32\drivers\acpidisk.sys [01/09/2008 12:05 PM]
S2 99CA27F6;99CA27F6;C:\WINDOWS\system32\A1CF0B14.EXE [04/11/2002 01:47 AM]
S2 dohs;dohs;C:\DOCUME~1\4949~1\LOCALS~1\Temp\tmp5F.tmp []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15cd6cbe-ec7c-11dc-92f1-0014a546c2cd}]
\****l\Auto\command - E:\auto.exe
\****l\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE ****l32.DLL,****lExec_RunDLL auto.exe
\****l\explore\Command - E:\m1t8ta.com
\****l\open\Command - E:\m1t8ta.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15cd6cd1-ec7c-11dc-92f1-0014a546c2cd}]
\****l\AutoRun\command - E:\m1t8ta.com
\****l\explore\Command - E:\m1t8ta.com
\****l\open\Command - E:\m1t8ta.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{301b8773-d598-11dc-a51c-0014a546c2cd}]
\****l\Auto\command - E:\auto.exe
\****l\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE ****l32.DLL,****lExec_RunDLL auto.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af94ed84-4d3d-11d6-882d-0014a546c2cd}]
\****l\Auto\command - E:\auto.exe
\****l\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE ****l32.DLL,****lExec_RunDLL auto.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e2d7714a-b7b9-11dc-83a8-0014a546c2cd}]
\****l\AutoRun\command - E:\m1t8ta.com
\****l\explore\Command - E:\m1t8ta.com
\****l\open\Command - E:\m1t8ta.com
*Newly Created Service* - ACPIDISK
.
*******s of the 'Scheduled Tasks' folder
"2008-03-28 14:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
"2007-06-09 22:15:04 C:\WINDOWS\Tasks\Microsoft Office Word 2003.job"
- C:\Documents and Settings\All Users.WINDOWS\çں
"2002-04-13 20:42:54 C:\WINDOWS\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_000-FD1368ED51B_Administrator.job"
- C:\WINDOWS\system32\mobsync.exeR /Schedule=
.
**************************************************************************
catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-04-14 01:04:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\mscpx32r.det 2560 bytes
scan completed successfully
hidden files: 1
**************************************************************************
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"HB Kernel"="RUNDLL32.EXE C:\\WINDOWS\\system32\\HBKrnl.dll,DllRegisterServer"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HBKernel]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\HBKernel.sys"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dohs]
"ImagePath"="\??\C:\DOCUME~1\4949~1\LOCALS~1\Temp\tmp5F.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\389A78B2.DLL
-> C:\WINDOWS\system32\winlib .dll
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\389A78B2.DLL
PROCESS: C:\WINDOWS\system32\csrss.exe
-> C:\WINDOWS\system32\389A78B2.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\WLTRAY.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Apoint2K\ApntEx.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 04/14/2002 1:07:25 - machine was rebooted [ںéمںé،]
ComboFix-quarantined-files.txt 2002-04-13 22:07:17
Pre-Run: 25,321,504,768 bytes free
Post-Run: 25,299,607,552 bytes free
.
2008-03-13 00:03:46 --- E O F ---
Logfile of HijackThis v1.99.1
Scan saved at 01:10, on 2002-04-14
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CF22535.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauc1t.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauc1t.exe
C:\Documents and Settings\TM\سطح المكتب\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 212.62.79.20
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 212.62.79.20
R3 - URLSearchHook: (no name) - {8d87e7f8-63ac-4340-857e-e2c50c3ec3a6} - (no file)
O2 - BHO: AdPopup - {11F09AFD-75AD-4E51-AB43-E09E9351CE16} - C:\Program Files\Common Files\CPUSH\cpush.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ygzjslit] C:\WINDOWS\gjltlpbx.exe
O4 - HKLM\..\Run: [tciocp32] C:\WINDOWS\tciocp32.exe
O4 - HKLM\..\Run: [dndsioc] C:\WINDOWS\dndsioc.exe
O4 - HKLM\..\Run: [fmbiost] C:\WINDOWS\fmbiost.exe
O4 - HKLM\..\Run: [fmsbbqi] C:\WINDOWS\fmsbbqi.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: 99CA27F6 - Unknown owner - C:\WINDOWS\system32\A1CF0B14.EXE
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
