اخوي انتر تفضل التقارير علما الجهاز لم يعمل ريستارت مع اداة
تقرير combofix
ComboFix 08-09-05.12 - 3alawi 2008-10-12 18:58:06.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.965.1033.18.452 [GMT 3:00]
Running from: D:\ملف خاص لادوات التصليح\ادوات التقارير\اداة ComboFix\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2008-09-12 to 2008-10-12 )))))))))))))))))))))))))))))))
.
2008-10-12 16:34 . 2008-10-12 16:36 <DIR> d-------- C:\Program Files\Traduce Gratis
2008-10-12 16:14 . 2008-10-12 16:21 <DIR> d-------- C:\Program Files\myBabylon_English
2008-10-12 16:14 . 2008-10-12 16:14 <DIR> d-------- C:\Program Files\Conduit
2008-10-12 16:13 . 2008-10-12 18:55 <DIR> d--h----- C:\WINDOWS\system32\Bifrost
2008-10-12 16:13 . 2008-09-12 00:34 6,886,112 --a------ C:\Program Files\Babylon.exe
2008-10-12 16:08 . 2008-10-12 16:08 0 --ah----- C:\WINDOWS\SwSys2.bmp
2008-10-12 16:08 . 2008-10-12 16:08 0 --ah----- C:\WINDOWS\SwSys1.bmp
2008-10-12 16:07 . 2008-10-12 16:07 <DIR> d-------- C:\WINDOWS\speech
2008-10-12 16:07 . 2008-10-12 16:07 <DIR> d-------- C:\WINDOWS\lhsp
2008-10-12 16:07 . 2008-10-12 16:07 <DIR> d-------- C:\WINDOWS\LastGood
2008-10-12 16:07 . 2008-10-12 16:12 <DIR> d-------- C:\Program Files\Talking Translator Pro 1.9
2008-10-12 16:07 . 2005-06-20 18:51 212,240 --a------ C:\WINDOWS\system32\richtx32.ocx
2008-10-12 16:07 . 2004-03-09 00:00 152,848 --a------ C:\WINDOWS\system32\Comdlg32.ocx
2008-10-12 16:07 . 2004-03-09 00:00 132,880 --a------ C:\WINDOWS\system32\MsInet.ocx
2008-10-12 09:02 . 2008-10-12 09:02 96,645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-10-12 09:02 . 2008-10-12 09:02 87,941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-10-12 09:01 . 2008-10-12 09:01 <DIR> d-------- C:\Program Files\Kaspersky Lab
2008-10-12 09:01 . 2008-10-12 09:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-12 09:01 . 2008-10-12 09:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-10-12 09:01 . 2008-10-12 09:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-10-12 09:01 . 2008-10-12 09:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-12 09:01 . 2008-10-12 09:23 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-12 08:11 . 2008-10-12 08:11 355,584 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-10-12 08:11 . 2008-05-29 09:28 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-10-12 08:10 . 2008-10-12 13:11 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-10-12 08:10 . 2008-10-12 08:10 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-12 08:10 . 2008-10-12 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-10-12 07:59 . 2008-10-12 07:59 <DIR> d-------- C:\Program Files\XP TCPIP Repair
2008-10-12 07:59 . 2005-04-15 18:58 1,351,392 --a------ C:\WINDOWS\system32\COMCTL32.OCX
2008-10-12 07:47 . 2008-10-12 07:47 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-10-12 07:47 . 2008-10-12 07:47 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-10-12 07:44 . 2008-10-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-10-12 07:34 . 2008-10-12 07:35 <DIR> d-------- C:\zanti-adware
2008-10-12 07:31 . 2008-10-12 07:31 <DIR> d-------- C:\VundoFix Backups
2008-10-12 07:15 . 2008-10-12 07:15 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-10-12 07:15 . 2008-10-12 07:20 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-10-12 07:13 . 2008-10-12 07:13 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-10-12 01:32 . 2004-12-28 19:58 26,368 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-10-12 01:16 . 2008-10-12 01:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-11 17:59 . 2008-10-11 18:00 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-10-11 07:52 . 2008-10-11 07:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-10-11 04:08 . 2008-10-11 04:08 850 --a------ C:\WINDOWS\system32\ProductTweaks.xml
2008-10-11 04:08 . 2008-10-11 04:08 385 --a------ C:\WINDOWS\system32\user_gensett.xml
2008-10-11 01:02 . 2008-10-11 01:03 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-10-10 10:54 . 2008-10-10 10:54 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-10-10 08:37 . 2008-10-12 18:21 <DIR> d-------- C:\Program Files\AutorunRemover
2008-10-10 08:35 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-10 08:32 . 2008-10-10 08:35 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-10 08:32 . 2008-10-10 08:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-10 08:32 . 2008-10-10 08:32 <DIR> d-------- C:\Documents and Settings\3alawi\Application Data\Malwarebytes
2008-10-10 08:32 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-10 05:54 . 2008-10-10 05:54 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-10-10 05:53 . 2008-10-10 05:53 <DIR> d-------- C:\Program Files\Real
2008-10-10 05:53 . 2008-10-10 05:54 <DIR> d-------- C:\Program Files\Common Files\Real
2008-10-10 05:06 . 2008-10-10 05:06 <DIR> d---s---- C:\Documents and Settings\3alawi\UserData
2008-10-10 03:02 . 2008-10-10 03:02 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-10-10 03:00 . 2008-10-10 10:54 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-10-10 03:00 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-10-10 01:15 . 2008-10-10 01:15 <DIR> d-------- C:\Program Files\MSN Messenger
2008-10-10 01:13 . 2008-10-11 07:50 <DIR> d-------- C:\Documents and Settings\3alawi\Contacts
2008-10-10 01:12 . 2008-10-10 01:12 268 --ah----- C:\sqmdata00.sqm
2008-10-10 01:12 . 2008-10-10 01:12 244 --ah----- C:\sqmnoopt00.sqm
2008-10-09 18:22 . 2008-10-09 18:22 <DIR> d-------- C:\Program Files\Windows Live Toolbar
2008-10-09 18:22 . 2008-10-09 18:22 <DIR> d-------- C:\Program Files\Windows Live Favorites
2008-10-09 18:16 . 2008-10-09 18:16 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-10-09 17:22 . 2008-10-12 02:32 <DIR> d-------- C:\Documents and Settings\3alawi\Application Data\DMCache
2008-10-09 17:16 . 2008-10-09 18:16 <DIR> d-------- C:\Program Files\Windows Live
2008-10-09 17:16 . 2008-10-09 18:15 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-10-09 17:16 . 2008-10-09 17:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-10-09 17:14 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
2008-10-09 17:14 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-10-09 17:14 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-10-09 17:14 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-10-09 17:14 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-10-09 17:14 . 2008-07-18 22:08 20,680 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-10-09 17:08 . 2001-08-17 16:28 794,399 --a------ C:\WINDOWS\system32\drivers\USR1806V.SYS
2008-10-09 17:08 . 2004-08-04 01:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-10-09 17:08 . 2004-08-04 03:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-10-09 17:07 . 2004-08-04 03:56 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-10-09 17:07 . 2004-08-04 01:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-10-09 17:07 . 2006-02-01 00:31 145,920 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2008-10-09 17:07 . 2004-08-04 03:56 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax
2008-10-09 17:07 . 2001-08-17 15:20 96,256 --a------ C:\WINDOWS\system32\drivers\ac97intc.sys
2008-10-09 17:07 . 2004-08-04 03:56 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2008-10-09 17:07 . 2004-08-04 02:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-10-09 17:07 . 2004-08-04 02:07 42,368 --a------ C:\WINDOWS\system32\drivers\AGP440.SYS
2008-10-09 17:07 . 2004-08-04 03:56 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2008-10-09 17:05 . 2008-10-12 16:08 <DIR> dr------- C:\Documents and Settings\All Users\Documents
2008-10-09 17:05 . 2001-08-23 17:00 176,157 --a--c--- C:\WINDOWS\system32\dllcache\dgrpsetu.dll
2008-10-09 17:03 . 2004-08-04 04:58 2,012,670 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT
2008-10-09 17:02 . 2008-10-12 07:46 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-10-09 17:02 . 2008-10-12 18:56 <DIR> d--h----- C:\Documents and Settings\Default User
2008-10-09 17:02 . 2008-10-09 14:17 <DIR> d-------- C:\Documents and Settings\All Users
2008-10-09 17:02 . 2008-10-09 15:43 <DIR> d-------- C:\Documents and Settings
2008-10-09 17:02 . 2004-08-04 04:57 1,086,058 -ra------ C:\WINDOWS\SET4.tmp
2008-10-09 17:02 . 2004-08-04 05:03 1,042,903 -ra------ C:\WINDOWS\SET3.tmp
2008-10-09 17:02 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-10-09 17:02 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-10-09 17:00 . 2008-10-09 14:22 261 --a------ C:\WINDOWS\system32\$winnt$.inf
2008-10-09 15:43 . 2008-10-12 08:49 <DIR> d-------- C:\Documents and Settings\3alawi
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-10 22:15 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-10-09 13:11 --------- d-----w C:\Documents and Settings\3alawi\Application Data\TuneUp Software
2008-10-09 11:18 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-10-10 255504]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 283912]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 C:\WINDOWS\system32\bthprops.cpl]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-10-12 183296]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\برامج الضغط\\wrar340a\\wrar340a.exe"=
"C:\\WINDOWS\\Explorer.EXE"=
"D:\\برامج الفحص والتصليح\\TuneUp Utilities\\TuneUp Utilities 2008\\TU2008TrialEN.exe"=
"D:\\ماسنجر\\WLinstaller.exe"=
"C:\\WINDOWS\\system32\\ctfmon.exe"=
"D:\\ماسنجر\\باتشات\\باتش عجيب\\ALL MSN Messenger.exe"=
"C:\\Program Files\\Windows Live Toolbar\\MSNTBUP.EXE"=
"C:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=
"D:\\AA96~1\\PHOTOS~2\\PHOTOS~1\\setup.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\MSNMSGR.EXE"= C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\3alawi\\My Documents\\Downloads\\Programs\\Kaspersky Internet Security 2009\\ملف التعريب\\arabic.exe"=
"C:\\Documents and Settings\\3alawi\\My Documents\\Downloads\\Programs\\Kaspersky Internet Security 2009\\ملف التعريب\\by Al jNtEeL.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 2009\\avp.exe"=
"C:\\WINDOWS\\system32\\userinit.exe"=
"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\usnsvc.exe"=
"C:\\Program Files\\Common Files\\Adobe\\Calibration\\Adobe Gamma Loader.exe"=
"C:\\DOCUME~1\\3alawi\\LOCALS~1\\Temp\\jhpvm.exe"=
"C:\\DOCUME~1\\3alawi\\LOCALS~1\\Temp\\wintlrea.exe"=
"D:\\E?C?? C??U?\\wrar340a\\wrar340a.exe"=
"D:\\E?C?? C???? ?C?E????\\TuneUp Utilities\\TuneUp Utilities 2008\\TU2008TrialEN.exe"=
"D:\\?C????\\WLinstaller.exe"=
"D:\\?C????\\ECEOCE\\ECEO ???E\\ALL MSN Messenger.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R3 asc3360pr;asc3360pr;C:\WINDOWS\system32\drivers\gllhon.sys [ ]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592]
S2 BDVEDISK;BDVEDISK;C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-10-12 355584]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.traducegratis.com/homepage.html
O8 -: Add to Windows &Live Favorites -
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-10-12 18:58:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-10-12 18:59:53
ComboFix-quarantined-files.txt 2008-10-12 15:59:48
ComboFix2.txt 2008-10-12 15:56:53
Pre-Run: 21,319,704,576 bytes free
Post-Run: 21,265,117,184 bytes free
214 --- E O F --- 2008-10-11 14:39:48
k: