اولا تقرير اداة ComboFix
ComboFix 08-11-12.02 - P C 11/14/2008 22:51:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.237 [GMT 2:00]
Running from: c:\documents and settings\P C\Desktop\موسوعة الأدوات والطرق المساعدة في حل المشاكل المطروحة في هذا القسم (متجدد بإذن الله)\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\x64
.
((((((((((((((((((((((((( Files Created from 2008-10-14 to 2008-11-14 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 20:54 --------- d-----w c:\documents and settings\P C\Application Data\DMCache
2008-11-14 20:49 --------- d-----w c:\program files\Clean Disk Security
2008-11-14 20:27 --------- d-----w c:\documents and settings\P C\Application Data\zyzprivacy
2008-11-14 20:27 --------- d-----w c:\documents and settings\P C\Application Data\CyberScrub
2008-11-14 17:52 --------- d-----w c:\program files\Common Files\SWF Studio
2008-11-14 17:45 --------- d-----w c:\program files\KON
2008-11-14 16:14 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-14 16:13 --------- d-----w c:\documents and settings\P C\Application Data\AlMAdinahMushaf
2008-11-14 16:11 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-11-14 16:08 --------- d-----w c:\documents and settings\P C\Application Data\Winamp
2008-11-14 13:39 --------- d-----w c:\program files\Microsoft Windows Vista Upgrade Advisor
2008-11-14 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Corporation
2008-11-14 13:02 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-14 12:35 --------- d-----w c:\documents and settings\P C\Application Data\vlc
2008-11-14 09:33 --------- d-----w c:\documents and settings\P C\Application Data\IDM
2008-11-14 09:22 --------- d-----w c:\program files\Winamp
2008-11-14 08:56 --------- d-----w c:\program files\VideoLAN
2008-11-14 08:50 --------- d-----w c:\documents and settings\P C\Application Data\Avira
2008-11-14 08:25 --------- d-----w c:\program files\Windows Live
2008-11-14 08:10 --------- d-----w c:\program files\Foxit Software
2008-11-14 08:08 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-14 08:05 --------- d-----w c:\program files\Yahoo!
2008-11-14 08:03 --------- d-----w c:\program files\USB Disk Security
2008-11-14 06:57 99,856 ----a-w c:\windows\system32\drivers\cmdguard.sys
2008-11-14 06:57 31,504 ----a-w c:\windows\system32\drivers\cmdhlp.sys
2008-11-14 06:48 --------- d-----w c:\program files\Internet Download Manager
2008-11-14 06:40 --------- d-----w c:\documents and settings\All Users\Application Data\comodo
2008-11-14 06:28 --------- d-----w c:\program files\MSConfig CleanUp
2008-11-14 06:06 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-11-14 06:06 --------- d-----w c:\documents and settings\P C\Application Data\TuneUp Software
2008-11-14 06:06 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-11-14 06:05 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-14 06:02 --------- d-----w c:\program files\COMODO
2008-11-14 06:02 --------- d-----w c:\documents and settings\P C\Application Data\Comodo
2008-11-13 21:54 --------- d-----w c:\program files\Ela-Salaty
2008-11-13 21:17 --------- d-----w c:\documents and settings\P C\Application Data\Media Player Classic
2008-11-13 21:16 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-13 21:16 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-13 20:54 --------- d-----w c:\program files\Avira
2008-11-13 20:54 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-11-13 20:50 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-13 20:49 --------- d-----w c:\program files\MSBuild
2008-11-13 20:49 --------- d-----w c:\program files\Microsoft Works
2008-11-13 20:30 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [10/28/2008 01:39 PM 2606512]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= c:\windows\system32\guard32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i263_32.drv
"VIDC.DIV3"= c:\progra~1\K-LITE~1\codecs\DivXc32.dll
"VIDC.DIV4"= c:\progra~1\K-LITE~1\codecs\DivXc32f.dll
"VIDC.3iv2"= c:\progra~1\K-LITE~1\codecs\3IVXVF~1.DLL
"VIDC.HFYU"= c:\progra~1\K-LITE~1\codecs\huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.VP60"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP61"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP62"= c:\progra~1\K-LITE~1\codecs\vp6vfw.dll
"VIDC.VP70"= c:\progra~1\K-LITE~1\codecs\vp7vfw.dll
"VIDC.VP31"= c:\progra~1\K-LITE~1\codecs\vp31vfw.dll
"VIDC.MPG4"= c:\progra~1\K-LITE~1\codecs\Mpg4c32.dll
"VIDC.MP42"= c:\progra~1\K-LITE~1\codecs\Mpg4c32.dll
"VIDC.MP43"= c:\progra~1\K-LITE~1\codecs\Mpg4c32.dll
"VIDC.FFDS"= c:\progra~1\K-LITE~1\ffdshow\ff_vfw.dll
"msacm.ac3acm"= c:\progra~1\K-LITE~1\codecs\ac3acm.acm
"msacm.lameacm"= c:\progra~1\K-LITE~1\codecs\lameACM.acm
"msacm.l3fhg"= c:\progra~1\K-LITE~1\codecs\l3codecp.acm
"msacm.divxa32"= c:\progra~1\K-LITE~1\codecs\divxa32.acm
"msacm.imc"= imc32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^P C^Start Menu^Programs^Startup^Broadband Connection.lnk]
path=c:\documents and settings\P C\Start Menu\Programs\Startup\Broadband Connection.lnk
backup=c:\windows\pss\Broadband Connection.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^P C^Start Menu^Programs^Startup^Ela-Salaty.lnk]
path=c:\documents and settings\P C\Start Menu\Programs\Startup\Ela-Salaty.lnk
backup=c:\windows\pss\Ela-Salaty.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
--a------ 06/12/2008 02:28 PM 266497 c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Firewall Pro]
--a------ 11/14/2008 08:43 AM 1797880 c:\program files\COMODO\Firewall\cfp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Internet Security]
--a------ 11/14/2008 08:43 AM 1797880 c:\program files\COMODO\Firewall\cfp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 01:56 AM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 10/27/2006 12:47 AM 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 10/06/2006 12:13 PM 114688 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 10/28/2008 01:39 PM 2606512 c:\program files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 10/06/2006 12:11 PM 98304 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KON]
--a------ 07/19/2002 04:13 PM 2379600 c:\progra~1\KON\kon\KON.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 10/06/2006 12:10 PM 94208 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Antivirus]
--a------ 07/24/2008 11:24 PM 798720 c:\program files\USB Disk Security\USBGuard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 05/03/2005 06:43 PM 69632 c:\windows\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 03/26/2008 04:14 PM 16859136 c:\windows\RTHDCPL.EXE
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [11/14/2008 08:57 AM 99856]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [11/14/2008 08:57 AM 31504]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [07/11/2008 12:23 PM 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;c:\program files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [06/12/2008 02:59 PM 258305]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;c:\program files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [05/09/2008 01:22 PM 41217]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe [08/04/2004 01:56 AM 14336]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [11/14/2008 08:06 AM 355584]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-11-14 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [06/20/2008 09:09 AM]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-ccleaner - c:\program files\CCleaner\CCleaner.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\P C\Application Data\Mozilla\Firefox\Profiles\l2wfaczj.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: c:\windows\system32\winlogon.exe
-> c:\windows\system32\guard32.dll
PROCESS: c:\windows\system32\lsass.exe
-> c:\windows\system32\guard32.dll
.
Completion time: 11/14/2008 22:56:04
ComboFix-quarantined-files.txt 2008-11-14 20:55:58
Pre-Run: 5,787,250,688 bytes free
Post-Run: 5,756,211,200 bytes free
179
_______________________________________________________________
ثانيا تقرير Hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:05 م, on 14/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Ela-Salaty\Salaty.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\avscan.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\P C\Desktop\موسوعة الأدوات والطرق المساعدة في حل المشاكل المطروحة في هذا القسم (متجدد بإذن الله)\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [KON] C:\PROGRA~1\KON\KON\KON.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Broadband Connection.lnk = ?
O4 - Startup: Ela-Salaty.lnk = C:\Program Files\Ela-Salaty\Salaty.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0B4816D-6D5F-4B01-A508-E576C7AAB79F}: NameServer = 163.121.128.134 163.121.128.135
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
--
End of file - 6515 bytes