جربت وصلت الجوال وشغالة 100 % وكمان وصلة المروحة وهي بعد شغالة
وهذا التقرير كامل
ComboFix 09-12-20.08 - TOSHIBA 12/21/2009 19:29:57.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.2038.1459 [GMT 3:00]
Running from: D:\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\\setup.exe
c:\program files\INSTALL.LOG
c:\program files\RelevantKnowledge
c:\program files\RelevantKnowledge\rlservice.exe
c:\program files\RelevantKnowledge\rlvknlg.exe
c:\windows\EventSystem.log
c:\windows\system32\prsgrc.dll
.
((((((((((((((((((((((((( Files Created from 2009-11-21 to 2009-12-21 )))))))))))))))))))))))))))))))
.
2009-12-18 22:19 . 2009-12-18 22:19 -------- d-----w- c:\program files\Ashampoo
2009-11-25 23:30 . 2009-11-25 23:30 -------- d-----w- c:\program files\MSXML 4.0
2009-11-25 14:10 . 2009-11-25 14:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-11-25 14:07 . 2009-11-25 14:07 -------- d-----w- c:\program files\Common Files\Apple
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-21 16:46 . 2009-05-26 10:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-12-21 16:43 . 2009-05-26 10:23 7280 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-12-21 16:43 . 2009-05-26 10:23 7142944 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-21 16:43 . 2009-05-26 10:23 57932 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-21 16:43 . 2009-05-26 10:23 1507360 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-12-21 10:53 . 2009-05-01 12:24 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-12 00:40 . 2008-07-20 16:48 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-12-07 00:54 . 2009-06-26 13:42 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Skype
2009-12-06 22:34 . 2009-06-26 13:48 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\skypePM
2009-11-25 20:53 . 2008-02-19 01:23 1290448 ----a-w- c:\documents and settings\TOSHIBA\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-25 14:11 . 2009-07-16 22:08 -------- d-----w- c:\program files\QuickTime
2009-11-22 09:52 . 2009-10-31 12:08 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Orbit
2009-11-20 15:00 . 2009-11-20 15:00 -------- d-----w- c:\program files\UnH Solutions
2009-11-19 19:26 . 2009-02-19 13:51 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\U3
2009-11-12 13:51 . 2008-02-26 16:36 -------- d-----w- c:\program files\Common Files\Adobe
2009-11-11 00:03 . 2009-09-16 21:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-08 19:50 . 2008-03-09 18:22 -------- d-----w- c:\program files\Messenger Plus! Live
2009-10-31 12:08 . 2009-10-31 12:08 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\GrabPro
2009-10-29 07:46 . 2004-08-03 20:56 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-03 20:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-03 20:56 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-28 19:04 . 2008-02-19 02:05 -------- d-----w- c:\program files\Microsoft Works
2009-10-28 14:23 . 2009-07-02 20:59 -------- d-----w- c:\program files\Xara
2009-10-28 12:58 . 2009-10-28 12:49 -------- d-----w- c:\program files\Your Uninstaller
2009-10-28 12:50 . 2009-10-28 12:50 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\URSoft
2009-10-28 11:48 . 2009-08-15 10:42 -------- d-----w- c:\program files\LeapFTP
2009-10-27 08:30 . 2009-10-27 08:25 -------- d-----w- c:\program files\Acme CADSee
2009-10-26 10:02 . 2009-03-11 20:17 -------- d-----w- c:\program files\MSBuild
2009-10-21 05:38 . 2004-08-03 20:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-03 20:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 19:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-14 15:00 . 2009-05-26 10:24 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-10-14 15:00 . 2009-05-26 10:24 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-10-13 10:30 . 2004-08-03 20:56 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-03 20:56 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-03 20:56 79872 ----a-w- c:\windows\system32\raschap.dll
2007-07-12 11:46 . 2009-07-20 08:16 8407040 ----a-w- c:\program files\Captivate_Installer.msi
2007-07-12 11:46 . 2009-07-20 08:16 1875 ----a-w- c:\program files\Setup.ini
2007-07-12 11:46 . 2009-07-20 08:15 177709209 ----a-w- c:\program files\Data1.cab
2007-07-12 11:16 . 2009-07-20 08:16 74317 ----a-w- c:\program files\Adobe Captivate 3 Read Me.pdf
2005-04-04 04:05 . 2009-07-20 08:16 2003176 ----a-w- c:\program files\instmsi30.exe
2005-04-03 17:10 . 2009-07-20 08:16 5515 ----a-w- c:\program files\0x0409.ini
2009-04-03 09:34 . 2009-04-03 09:34 8 --sh--r- c:\windows\system32\F0954E38C8.sys
2009-06-19 11:26 . 2009-04-03 09:24 2828 --sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-07-21 208616]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KYESCAN.lnk]
backup=c:\windows\pss\KYESCAN.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
backup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^TOSHIBA^Start Menu^Programs^Startup^Adobe Gamma.lnk]
backup=c:\windows\pss\Adobe Gamma.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMReminderService
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 15:43 69632 -c--a-w- c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 00:12 110592 ----a-w- c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
2003-05-21 15:37 229437 -c--a-w- c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-10-23 16:51 233472 -c--a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2003-06-25 08:24 49152 -c--a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-09-01 11:42 176128 -c--a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-04-13 08:09 49152 -c--a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
2006-06-27 13:21 1449984 ----a-w- c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2005-12-07 19:57 30208 -c----w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-07-05 13:08 16380416 -c--a-w- c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-05-25 14:43 25477928 ----a-r- c:\program files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-06-19 10:47 198160 ------w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2006-10-24 13:10 4662776 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=
"c:\\Program Files\\Common Files\\Nokia\\MPAPI\\MPAPI3s.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LeapFTP\\LeapFTP.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\wamp\\bin\\apache\\apache2.2.8\\bin\\httpd.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2799:UDP"= 2799:UDP:Altova License Metering Port (UDP)
"2799:TCP"= 2799:TCP:Altova License Metering Port (TCP)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R2 osppsvc;Office Software Protection Platform;c:\windows\system32\OSPPSVC.EXE [08/04/2009 03:37 م 4319136]
R3 bbcap;bbcap;c:\windows\system32\drivers\bbcap.sys [24/07/2009 03:38 م 4096]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
S2 Phperl;Phperl; [x]
S2 site1;site1; [x]
S2 site2;site2; [x]
S2 site3;site3; [x]
S2 site4;site4; [x]
S2 site5;site5; [x]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.orbitdownloader.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Dodaj do listy blokowanych baner?w
IE: Dodaj do listy blokowanych baner?w - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Download with IDA
TCP: {CB2430D7-3060-42C0-8927-352A64F62C82} = 62.149.114.7,212.118.133.101
.
- - - - ORPHANS REMOVED - - - -
URLSearchHooks-{0c268c78-356f-4e61-a604-1e23f4bd68c3} - (no file)
Toolbar-{0c268c78-356f-4e61-a604-1e23f4bd68c3} - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{0C268C78-356F-4E61-A604-1E23F4BD68C3} - (no file)
AddRemove-HijackThis - D:\HijackThis.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-12-21 19:48
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1659004503-879983540-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7924CB45-C83E-2DA2-EB70-12BE66979023}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jaaebmmkpjgjamehnblo"=hex:61,61,00,00
"kaaebmmkjjljmfpchncokd"=hex:61,61,00,00
"faaebmmkmjhl"=hex:66,61,6f,6c,61,6d,63,64,62,6a,63,70,00,00
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):97,0f,d1,4c,da,0d,a7,6b,71,03,40,af,48,d3,71,98,42,da,8d,19,fe,
32,6e,e1,ce,fc,c9,5b,85,8a,10,15,23,a5,1d,90,76,00,82,0a,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{8b4e18b8-11ec-48a0-9b41-797b750084c3}]
@Denied: (Full) (Everyone)
"Model"=dword:00000081
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3424)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\windows\system32\ConnAPI.DLL
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_ara.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\Protexis\License Service\PSIService.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
.
**************************************************************************
.
Completion time: 2009-12-21 19:54:53 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-21 16:54
Pre-Run: 28,140,900,352 bytes free
Post-Run: 28,557,991,936 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 6F8ECE15FEF553D070ED052F43C8A01A
اسفة تعبتك ياخوي معاي :b:
