عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
اعمل تقرير للهايجاك
اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات .. ويظهر لك تقرير اعمل تحديد الكل ==> انسخه والصقه بردك القادم
ComboFix 08-11-20.02 - العصر للكمبيوتر 11/21/2008 19:44:24.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.225 [GMT 3:00]
Running from: c:\documents and settings\لغة العصر للكمبيوتر\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\AntiSpywareGuard
c:\windows\regedit.com
c:\windows\system32\taskmgr.com
.
((((((((((((((((((((((((( Files Created from 2008-10-21 to 2008-11-21 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-21 16:48 870,944 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-21 16:48 6,944 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-21 16:48 5,900 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-21 16:48 20,048 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-21 11:31 --------- d-----w c:\documents and settings\لغة العصر للكمبيوتر\Application Data\AntiSpywareGuard
2008-10-25 18:34 4,757,295 ----a-w c:\windows\REGBK10.ZIP
2008-10-24 11:25 455,936 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:25 455,936 ------w c:\windows\system32\dllcache\mrxsmb.sys
2008-10-15 16:53 339,456 ------w c:\windows\system32\dllcache\netapi32.dll
2008-10-03 17:26 6,068,224 ------w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 13:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:17 1,846,912 ----a-w c:\windows\system32\win32k.sys
2008-09-15 12:17 1,846,912 ------w c:\windows\system32\dllcache\win32k.sys
2008-09-05 20:30 241,704 ------w c:\windows\system32\dllcache\wgaLogon.dll
2008-09-05 20:29 917,032 ------w c:\windows\system32\dllcache\WgaTray.exe
2008-09-04 16:32 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-09-04 16:32 1,106,944 ------w c:\windows\system32\dllcache\msxml3.dll
2008-08-29 17:06 1,350,664 ----a-w c:\windows\system32\msxml6.dll
2008-08-28 10:35 333,056 ------w c:\windows\system32\dllcache\srv.sys
2008-08-25 08:43 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-25 08:43 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
2007-12-31 11:02 14,478,958 ----a-w c:\program files\REAL11.zip
2007-12-07 20:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007120720071208\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
11/18/2008 10:05 PM 200192 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [09/02/2007 01:58 PM 495616]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [09/27/2007 04:10 PM 40448]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [11/29/2007 07:25 PM 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [02/21/2008 12:51 AM 185896]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [06/03/2008 08:04 PM 1817600]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [02/08/2008 06:36 PM 227856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [09/27/2007 04:10 PM 40448]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [09/02/2007 01:58 PM 495616]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 0 (0x0)
"NoShellSearchButto"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\(Default)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 09/27/2007 04:10 PM 40448 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 11/29/2007 07:25 PM 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RocketDock]
--a------ 09/02/2007 01:58 PM 495616 c:\program files\RocketDock\RocketDock.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 02/21/2008 12:51 AM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background
"Window Washer"=c:\program files\Webroot\Washer\wwDisp.exe
"RocketDock"="c:\program files\RocketDock\RocketDock.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"RTHDCPL"=RTHDCPL.EXE
"AzMixerSel"=c:\program files\Realtek\InstallShield\AzMixerSel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Documents and Settings\\لغة العصر للكمبيوتر\\Desktop\\WLM2008\\PFiles\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-06-03 141312]
R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe -k netsvcs [2004-08-03 14336]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2007-12-08 598856]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;c:\windows\System32\TuneUpDefragService.exe [2008-03-28 355584]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
s of the 'Scheduled Tasks' folder
2008-11-21 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [06/20/2008 09:09 AM]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://www.msn.com
uInternet Settings,ProxyServer = 212.102.0.103:8080
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {5534DB30-B210-46A1-98AF-8996A1358CBE} = 10.11.176.1
c:\windows\Downloaded Program Files\ewidoOnlineScan.dll - O16 -: {193C772A-87BE-4B19-A7BB-445B226FE9A1}
hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-21 19:50:39
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\docume~1\c:\docume~1\
scan completed successfully
hidden files: 2
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: c:\windows\explorer.exe
-> c:\program files\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\LAVASOFT\AD-AWARE 2007\AAWSERVICE.EXE
c:\program files\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE
c:\program files\HOTSPOT SHIELD\BIN\OPENVPNAS.EXE
c:\program files\SPYWARE TERMINATOR\SP_RSSER.EXE
c:\windows\system32\wscntfy.exe
c:\program files\internet explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 11/21/2008 19:54:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-21 16:53:46
Pre-Run: 14,232,780,800 bytes free
Post-Run: 14,165,884,928 bytes free
154 --- E O F --- 2008-11-12 22:22:12
