عبدالحق سعد
زيزوومي نشيط
غير متصل
السلام عليكم ورحمه الله وبركاته
الساده الفنين والمتخصصين والخبراء ----- الاخوه والاخوات الكرام اعضاء المنتدي
سبق وطلبت مساعدتي في حل مشكله ترجوان ملوش حل وقام احد المتخصصين واعطاني ادوات الفحص وقال لي ارسل تقرير الفحص في ردك القادم وانتهي الامر ال هذا الحد ومر حوالي اسبوع بعد ارسالي التقارير ولم يفيدني احد والمشكله في زياده فقمت بتنزيل نسخه اخري وزادت المشكله واصبح لدي فيروس المن وترجوان بيعمل دون لود ويرسل من داخل الجهاز دون ان يوقفه اي شئ والاغرب ان جميع برامج الحمايه لا استطيع تنصيبها ابدا وان تم التنصيب وبداء عمليه الفحص يلتصق الموس ويثقل الجهاز وعند اغلاقه وفتحه يعمل رستارت كل شويه ارجوا المساعده العاجله
وده تقرير الفحص الاخير
ComboFix 08-11-23.02 - zezo 11/25/2008 0:12:28.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.325 [GMT 2:00]
Running from: c:\documents and settings\zezo\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\AppPatch\AcSpecf.sdb
.
((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 22:09 --------- d-----w c:\program files\microsoft frontpage
2008-11-24 22:04 --------- d-----w c:\program files\Internet Download Manager
2008-11-24 22:04 --------- d-----w c:\documents and settings\zezo\Application Data\IDM
2008-11-24 22:04 --------- d-----w c:\documents and settings\zezo\Application Data\DMCache
2008-11-24 21:48 --------- d-----w c:\program files\nLite
2008-11-24 21:40 24,625 ----a-w c:\windows\MSVB50CHS.dll
2008-11-24 21:40 20,480 ----a-w c:\windows\MPKrnl.dll
2008-11-24 21:40 10,240 ----a-w c:\windows\MKMKrnl.dll
2008-11-24 21:39 5,504 ----a-w c:\windows\system32\f35ee9e.sys
2008-11-24 21:38 5,504 ----a-w c:\windows\system32\b160485.sys
2008-11-24 21:37 5,504 ----a-w c:\windows\system32\d812a079.sys
2008-11-24 08:12 --------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2008-11-24 08:09 --------- d-----w c:\program files\CCleaner
2008-11-24 08:05 --------- d-----w c:\documents and settings\zezo\Application Data\BitDefender
2008-11-24 07:50 737,280 ----a-w c:\windows\iun6002.exe
2008-11-24 07:50 --------- d-----w c:\program files\No Trace
2008-11-24 07:10 --------- d-----w c:\program files\Google
2008-11-24 04:06 --------- d-----w c:\program files\PC Check-up
2008-11-24 03:58 --------- d-----w c:\program files\LClock
2008-11-24 03:58 --------- d-----w c:\program files\Core Temp
2008-11-24 03:53 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-09 13:31 192,512 ----a-w c:\windows\system32\txmlutil.dll
.
((((((((((((((((((((((((((((( snapshot@Tue 11-25-2008_ 0.09.41.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-24 03:57:20 86,327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
+ 2008-11-24 22:10:46 86,327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
- 2008-11-24 03:57:20 2,112 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-11-24 22:10:46 2,786 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
- 2008-11-24 21:48:08 58,596 ----a-w c:\windows\system32\perfc009.dat
+ 2008-11-24 22:13:42 58,596 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-24 21:48:08 392,296 ----a-w c:\windows\system32\perfh009.dat
+ 2008-11-24 22:13:42 392,296 ----a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [05/09/2008 08:52 AM 40448]
"LClock"="c:\program files\LClock\LClock.exe" [09/19/2004 08:27 PM 65536]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [11/24/2008 09:10 AM 171448]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [02/20/2008 04:13 PM 2594224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitDefender Antiphishing Helper"="e:\bitdefender 2009\IEShow.exe" [10/17/2008 05:02 PM 69632]
"PC-Checkup"="c:\program files\PC Check-up\PCCheckUp.exe" [03/18/2008 12:49 AM 4047360]
"MPKrnl"="c:\windows\MPKrnl.dll" [11/24/2008 11:40 PM 20480]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [05/09/2008 08:52 AM 40448]
"LClock"="c:\program files\LClock\LClock.exe" [09/19/2004 08:27 PM 65536]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [05/09/2008 07:43 AM 126464 c:\windows\system32\advpack.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"MPMKrnl"="c:\windows\MKMKrnl.dll" [11/24/2008 11:40 PM 10240]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceDelayLoad]
"Upnp"= {DE01DA19-A6A8-EB80-4D47-248DEB2A9399} - c:\windows\system32\upnpsrv.dll [04/14/2008 09:41 AM 20480]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
S2 BDVEDISK;BDVEDISK;\??\e:\bitdefender 2009\BDVEDISK.sys []
S3 b160485;b160485;\??\c:\windows\system32\b160485.sys [11/24/2008 11:38:01 PM 5504]
S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 11:09:12 AM 111112]
S3 d812a079;d812a079;\??\c:\windows\system32\d812a079.sys [11/24/2008 11:37:41 PM 5504]
S3 f35ee9e;f35ee9e;\??\c:\windows\system32\f35ee9e.sys [11/24/2008 11:39:27 PM 5504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Tapisrv
Themes
TrkWks
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
napagent
hkmsvc
BITS
ShellHWDetection
helpsvc
WmdmPmSN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
*Newly Created Service* - CATCHME
*Newly Created Service* - IPNAT
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-25 00:14:08
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(624)
c:\windows\system32\SETUPAPI.dll
.
Completion time: 11/25/2008 0:14:36
ComboFix-quarantined-files.txt 2008-11-24 22:14:36
ComboFix2.txt 2008-11-24 22:10:24
Pre-Run: 5,151,137,792 bytes free
Post-Run: 5,144,834,048 bytes free
158
=================================================
وده فحص الهيجات
-------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18:24 ص, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\PC Check-up\PCCheckUp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\explorer.exe
E:\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "E:\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PC Check-up\PCCheckUp.exe" -mini
O4 - HKLM\..\Run: [MPKrnl] rundll32 "C:\WINDOWS\MPKrnl.dll",KrnlMsgProc
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKLM\..\Policies\Explorer\Run: [MPMKrnl] rundll32 "C:\WINDOWS\MKMKrnl.dll",KMainProc
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) -
O21 - SSODL: Upnp - {DE01DA19-A6A8-EB80-4D47-248DEB2A9399} - C:\WINDOWS\system32\upnpsrv.dll
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
--
End of file - 4780 bytes
الساده الفنين والمتخصصين والخبراء ----- الاخوه والاخوات الكرام اعضاء المنتدي
سبق وطلبت مساعدتي في حل مشكله ترجوان ملوش حل وقام احد المتخصصين واعطاني ادوات الفحص وقال لي ارسل تقرير الفحص في ردك القادم وانتهي الامر ال هذا الحد ومر حوالي اسبوع بعد ارسالي التقارير ولم يفيدني احد والمشكله في زياده فقمت بتنزيل نسخه اخري وزادت المشكله واصبح لدي فيروس المن وترجوان بيعمل دون لود ويرسل من داخل الجهاز دون ان يوقفه اي شئ والاغرب ان جميع برامج الحمايه لا استطيع تنصيبها ابدا وان تم التنصيب وبداء عمليه الفحص يلتصق الموس ويثقل الجهاز وعند اغلاقه وفتحه يعمل رستارت كل شويه ارجوا المساعده العاجله
وده تقرير الفحص الاخير
ComboFix 08-11-23.02 - zezo 11/25/2008 0:12:28.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.325 [GMT 2:00]
Running from: c:\documents and settings\zezo\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\AppPatch\AcSpecf.sdb
.
((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 22:09 --------- d-----w c:\program files\microsoft frontpage
2008-11-24 22:04 --------- d-----w c:\program files\Internet Download Manager
2008-11-24 22:04 --------- d-----w c:\documents and settings\zezo\Application Data\IDM
2008-11-24 22:04 --------- d-----w c:\documents and settings\zezo\Application Data\DMCache
2008-11-24 21:48 --------- d-----w c:\program files\nLite
2008-11-24 21:40 24,625 ----a-w c:\windows\MSVB50CHS.dll
2008-11-24 21:40 20,480 ----a-w c:\windows\MPKrnl.dll
2008-11-24 21:40 10,240 ----a-w c:\windows\MKMKrnl.dll
2008-11-24 21:39 5,504 ----a-w c:\windows\system32\f35ee9e.sys
2008-11-24 21:38 5,504 ----a-w c:\windows\system32\b160485.sys
2008-11-24 21:37 5,504 ----a-w c:\windows\system32\d812a079.sys
2008-11-24 08:12 --------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2008-11-24 08:09 --------- d-----w c:\program files\CCleaner
2008-11-24 08:05 --------- d-----w c:\documents and settings\zezo\Application Data\BitDefender
2008-11-24 07:50 737,280 ----a-w c:\windows\iun6002.exe
2008-11-24 07:50 --------- d-----w c:\program files\No Trace
2008-11-24 07:10 --------- d-----w c:\program files\Google
2008-11-24 04:06 --------- d-----w c:\program files\PC Check-up
2008-11-24 03:58 --------- d-----w c:\program files\LClock
2008-11-24 03:58 --------- d-----w c:\program files\Core Temp
2008-11-24 03:53 --------- d-----w c:\program files\Windows Media Connect 2
2008-10-09 13:31 192,512 ----a-w c:\windows\system32\txmlutil.dll
.
((((((((((((((((((((((((((((( snapshot@Tue 11-25-2008_ 0.09.41.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-24 03:57:20 86,327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
+ 2008-11-24 22:10:46 86,327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
- 2008-11-24 03:57:20 2,112 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
+ 2008-11-24 22:10:46 2,786 ----a-w c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
- 2008-11-24 21:48:08 58,596 ----a-w c:\windows\system32\perfc009.dat
+ 2008-11-24 22:13:42 58,596 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-24 21:48:08 392,296 ----a-w c:\windows\system32\perfh009.dat
+ 2008-11-24 22:13:42 392,296 ----a-w c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [05/09/2008 08:52 AM 40448]
"LClock"="c:\program files\LClock\LClock.exe" [09/19/2004 08:27 PM 65536]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [11/24/2008 09:10 AM 171448]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [02/20/2008 04:13 PM 2594224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitDefender Antiphishing Helper"="e:\bitdefender 2009\IEShow.exe" [10/17/2008 05:02 PM 69632]
"PC-Checkup"="c:\program files\PC Check-up\PCCheckUp.exe" [03/18/2008 12:49 AM 4047360]
"MPKrnl"="c:\windows\MPKrnl.dll" [11/24/2008 11:40 PM 20480]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [05/09/2008 08:52 AM 40448]
"LClock"="c:\program files\LClock\LClock.exe" [09/19/2004 08:27 PM 65536]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [05/09/2008 07:43 AM 126464 c:\windows\system32\advpack.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"MPMKrnl"="c:\windows\MKMKrnl.dll" [11/24/2008 11:40 PM 10240]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceDelayLoad]
"Upnp"= {DE01DA19-A6A8-EB80-4D47-248DEB2A9399} - c:\windows\system32\upnpsrv.dll [04/14/2008 09:41 AM 20480]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
S2 BDVEDISK;BDVEDISK;\??\e:\bitdefender 2009\BDVEDISK.sys []
S3 b160485;b160485;\??\c:\windows\system32\b160485.sys [11/24/2008 11:38:01 PM 5504]
S3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [9/18/2008 11:09:12 AM 111112]
S3 d812a079;d812a079;\??\c:\windows\system32\d812a079.sys [11/24/2008 11:37:41 PM 5504]
S3 f35ee9e;f35ee9e;\??\c:\windows\system32\f35ee9e.sys [11/24/2008 11:39:27 PM 5504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Tapisrv
Themes
TrkWks
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
napagent
hkmsvc
BITS
ShellHWDetection
helpsvc
WmdmPmSN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
*Newly Created Service* - CATCHME
*Newly Created Service* - IPNAT
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2008-11-25 00:14:08
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(568)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(624)
c:\windows\system32\SETUPAPI.dll
.
Completion time: 11/25/2008 0:14:36
ComboFix-quarantined-files.txt 2008-11-24 22:14:36
ComboFix2.txt 2008-11-24 22:10:24
Pre-Run: 5,151,137,792 bytes free
Post-Run: 5,144,834,048 bytes free
158
=================================================
وده فحص الهيجات
-------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:18:24 ص, on 25/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\PC Check-up\PCCheckUp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\explorer.exe
E:\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "E:\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [PC-Checkup] "C:\Program Files\PC Check-up\PCCheckUp.exe" -mini
O4 - HKLM\..\Run: [MPKrnl] rundll32 "C:\WINDOWS\MPKrnl.dll",KrnlMsgProc
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKLM\..\Policies\Explorer\Run: [MPMKrnl] rundll32 "C:\WINDOWS\MKMKrnl.dll",KMainProc
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O21 - SSODL: Upnp - {DE01DA19-A6A8-EB80-4D47-248DEB2A9399} - C:\WINDOWS\system32\upnpsrv.dll
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
--
End of file - 4780 bytes
