اخى زيزوم
الفحص انتهى ولم يقم الجهاز بعمل ريستارت
قمت انا بعمل ريستارت للجهاز
وهذا التقرير قبل الريستارت ظهر لى وقمت بحفظـــة
ComboFix 08-04-26.5 - Administrator 04/28/2008 10:23:06.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.104 [GMT -7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AlxRes_dll_IMAGE_bg_popup.gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AlxRes_dll_IMAGE_window_sliver.gif
C:\Documents and Settings\LocalService\Application Data\wsnpoem
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll
C:\Documents and Settings\NetworkService\Application Data\wsnpoem
C:\Documents and Settings\NetworkService\Application Data\wsnpoem\audio.dll
C:\Program Files\alexa toolbar
C:\WINDOWS\system32\dllcache\spoolsv.exe
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\Ultra.dll
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll
.
((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-28 06:52 --------- d-----w C:\Program Files\Kaspersky Lab
2008-04-27 22:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-27 19:38 91,700 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-04-27 19:38 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-04-27 19:36 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-04-27 19:36 32 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-04-27 19:36 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-04-27 19:36 32 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-04-27 07:27 --------- d-----w C:\Program Files\NoCUT
2008-04-27 03:49 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-02 20:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-03-23 20:22 --------- d-----w C:\Program Files\WinWatermark 2.2
2008-03-12 14:42 --------- d-----w C:\Program Files\Bug Doctor
2008-03-09 23:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Talkback
2008-03-09 18:11 --------- d-----w C:\Program Files\LeapFTP
2008-03-09 17:48 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Yahoo!
2008-03-09 17:47 --------- d-----w C:\Program Files\Yahoo!
2008-03-09 06:47 155,995 ----a-w C:\WINDOWS\java\Packages\WNBDZFVZ.ZIP
2008-03-09 05:49 --------- d-----w C:\Program Files\MSN Messenger Khalid Edition 4.2 AR
2008-03-09 02:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-03-09 00:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-09 00:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-03-08 23:43 --------- d-----w C:\Program Files\Internet Download Manager
2008-03-08 23:43 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IDM
2008-03-08 23:43 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DMCache
2008-03-08 19:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-08 19:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-08 00:44 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-15 14:12 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-02-09 01:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/09/2006 03:41 PM 4617720]
"msnmsgr"="C:\Program Files\MSN Messenger Khalid Edition 4.2 AR\msnmsgr.exe" [07/14/2005 06:30 PM 6787072]
"Messenger Plus3"="C:\Program Files\MSN Messenger Khalid Edition 4.2 AR\Messenger Plus! 3\MsgPlus.exe" [07/08/2005 05:08 AM 185480]
"NoCUT Control"="C:\Program Files\NoCUT\NCTCtl.exe" [03/28/2006 06:14 PM 78848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [03/11/2004 04:19 PM 158208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"raVe"="" []
"Driver32"="" []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=MsgPlusLoader.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 03/12/2004 12:18 AM 14336 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 03/08/2008 04:43 PM 2594224 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Karen]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\raVe]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\startIE]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemInit]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Win32BaseServiceMOD]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"C:\\Program Files\\LeapFTP\\LeapFTP.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\MSN Messenger Khalid Edition 4.2 AR\\msnmsgr.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
R2 NoCUT;NoCUT;"C:\WINDOWS\system32\NoCUT.exe" [03/28/2006 06:13 PM]
R3 CCCP106;CIF USB Camera (2110A);C:\WINDOWS\system32\DRIVERS\cccp106.sys [09/23/2003 05:48 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [12/13/2007 01:28 PM]
R3 trid3d;trid3d;C:\WINDOWS\system32\DRIVERS\trid3dm.sys [08/17/2001 12:51 PM]
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-04-28 10:25:57
Windows 5.1.2600 Service Pack 2, v.2096 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 04/28/2008 10:27:10
ComboFix-quarantined-files.txt 2008-04-28 17:27:06
Pre-Run: 1,113,968,640 bytes free
Post-Run: 1,241,776,128 bytes free
141
بالانتظـــــــــار
