شكرا جميعا على ردودكم
اخي ابو غازي انا لا اريد اخفائها اريدها لا تظهر حتى عندما تكون ليست مخفية
اخي العزيز بوب هذا هو التقرير
ComboFix 08-05-15.3 - amgad2 05/19/2008 20:38:40.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.476 [GMT 3:00]
Running from: C:\Documents and Settings\amgad\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\artools.dll
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\h@tkeysh@@k.dll
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\vm.exe
C:\WINDOWS\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-19 15:50 5,528 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-19 15:50 36,384 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-19 15:50 19,844 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-19 15:50 1,425,408 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-16 22:15 --------- d-----w C:\Program Files\Internet Download Manager
2008-05-16 22:15 --------- d-----w C:\Documents and Settings\amgad2\Application Data\IDM
2008-05-16 22:15 --------- d-----w C:\Documents and Settings\amgad2\Application Data\DMCache
2008-05-12 19:34 --------- d-----w C:\Program Files\NeroInstall.bak
2008-05-12 19:32 --------- d-----w C:\Documents and Settings\amgad2\Application Data\Nero
2008-05-12 19:29 --------- d-----w C:\Program Files\Nero
2008-05-12 19:29 --------- d-----w C:\Program Files\Common Files\Nero
2008-05-12 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-05-12 17:19 --------- d-----w C:\Program Files\AskTBar
2008-05-12 15:45 --------- d-----w C:\Documents and Settings\amgad2\Application Data\Ahead
2008-05-09 18:27 --------- d-----w C:\Program Files\Common Files\TechSmith Shared
2008-05-09 18:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith
2008-05-09 04:59 --------- d-----w C:\Documents and Settings\multiskype.MAKKAH\Application Data\Skype
2008-05-08 00:45 --------- d-----w C:\Program Files\Common Files\Skype
2008-05-07 09:05 --------- d-----w C:\Program Files\TVPlayerClassic
2008-05-07 08:04 --------- d-----w C:\Program Files\ProgDVB
2008-05-02 16:28 --------- d-----w C:\Documents and Settings\AMGAD.MAKKAH.000\Application Data\Grisoft
2008-04-25 20:10 --------- d-----w C:\Program Files\Power Video Converter
2008-04-25 18:58 --------- d-----w C:\Program Files\CubeDesktop
2008-04-25 18:58 --------- d-----w C:\Documents and Settings\amgad2\Application Data\Thinking Minds Budiling Bytes
2008-04-25 18:05 --------- d-----w C:\Documents and Settings\amgad2\Application Data\Apple Computer
2008-04-25 18:04 --------- d-----w C:\Program Files\QuickTime
2008-04-25 18:04 --------- d-----w C:\Program Files\iTunes
2008-04-25 18:04 --------- d-----w C:\Program Files\iPod
2008-04-25 18:04 --------- d-----w C:\Program Files\Bonjour
2008-04-25 18:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-12 22:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\RoboForm
2008-04-08 12:14 --------- d-----w C:\Documents and Settings\amgad2\Application Data\TVU Networks
2008-03-29 23:25 --------- d-----w C:\Program Files\Real_SC
2008-03-29 23:09 --------- d-----w C:\Program Files\Your Uninstaller 2008
2008-03-29 23:09 --------- d-----w C:\Documents and Settings\amgad2\Application Data\URSoft
2008-03-25 15:32 --------- d-----w C:\Documents and Settings\amgad2\Application Data\G-Lock Software
2008-03-23 12:16 --------- d-----w C:\Program Files\Fine Uninstall
2008-03-21 23:30 --------- d-----w C:\Program Files\MassSender
2008-03-12 17:27 50,520 ----a-w C:\WINDOWS\system32\csvidcap.dll
2008-02-28 10:26 1,414,440 ----a-w C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-02-20 12:28 47,399 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-02-20 12:28 2,140 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-02-20 02:42 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-01 02:01 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-09-20 04:32 55,070 --sha-r C:\WINDOWS\3JFGPOEBMJAPIVIPXPEGB.dll
.
------- Sigcheck -------
04/20/2006 04:51 AM 359808 b4e29943b4b04bd5e7381546848e6669 C:\WINDOWS\system32\drivers\tcpip.sys
04/20/2006 04:51 AM 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\system32\dllcache\tcpip.sys
04/20/2006 05:18 AM 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
08/03/2004 11:14 PM 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{6D023EBF-70B8-45A6-9ED5-556515FA0FE4}]
C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
"DLD.EXE"="C:\Program Files\Download Direct\DLD.exe" [ ]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [12/17/2007 05:13 PM 3810544]
"vEmotion"="C:\Program Files\freebird\vEmotion\vEmotion.exe" [ ]
"CubeDesktop"="" []
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [02/07/2006 08:39 AM 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [02/07/2006 08:36 AM 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [02/07/2006 08:40 AM 118784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [01/13/2006 04:33 PM 761946]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [01/05/2006 10:30 AM 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 12:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [08/22/2007 09:12 PM 24576]
"FixCamera"="C:\WINDOWS\FixCamera.exe" [02/12/2007 02:50 PM 20480]
"BearFlix"="C:\Program Files\BearFlix\bearflix.exe" [ ]
"ماركت بروف"="C:\MarketProf\MarketProf.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 12:25 PM 6731312]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM 31016]
"SeePassword"="C:\Program Files\SeePassword\SeePassword.exe" [ ]
"kav"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [03/07/2006 05:48 PM 139367]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/20/2008 05:42 AM 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM 267048]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM 155648]
"SystemInit"="" []
"Karen"="" []
"raVe"="" []
"SystemBackup"="" []
"Win32BaseServiceMOD"="" []
"startIE"="" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"raVe"="" []
"Driver32"="" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
«©م، ¢¬نïé Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-04-07 16:37:00 1773568]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.speex32"= speex32.acm
"vidc.sccd"= C:\PROGRA~1\LUMINO~1\SoftCam1.5\Driver\SCCodec.dll
"MSVideo7"= C:\PROGRA~1\LUMINO~1\SoftCam1.5\Driver\SCVid32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Paltalk Messenger\\PALTALK.EXE"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 HFSYS;HFSYS;C:\WINDOWS\system32\drivers\HFSYS.SYS [10/27/2002 03:09 PM]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM]
S3 SNP325;USB PC Camera (SNPSTD325);C:\WINDOWS\system32\DRIVERS\snp325.sys []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b33b3fe8-5e70-11dc-aa3f-0011e2fc6cde}]
\Shell\Auto\command - auto.exe
\Shell\AutoRun\command - auto.exe
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
"2008-05-19 16:53:50 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-04-12 12:11:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-19 17:40:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{2EE5D503-F28E-41BC-8D77-19A59C20A9BD}.job"
- C:\WINDOWS\system32\msfeedssync.exe
"2008-05-11 16:00:40 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-05-19 20:40:54
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 05/19/2008 20:41:28
ComboFix-quarantined-files.txt 2008-05-19 17:41:26
Pre-Run: 18,281,742,336 bytes free
Post-Run: 20,501,708,800 bytes free
198 --- E O F --- 2008-01-07 00:04:39
تحياتي لكم جميعا
