هذا التقرير اخوي هشام
ابشركم بعد ما نفذت الخطوه لاولى لهشام واعاد التشغيل
انفتح المسنجرين بدون اي رساله
ان شاء الله تستمر وبكمل باقي الخطوات
ComboFix 09-02-25.02 - 200003779 2009-02-26 15:30:55.1 - NTFSx86
Running from: d:\documents and settings\200003779\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1utbfd.bat
C:\2aaxaiy.exe
C:\2fiy.bat
C:\8.bat
C:\autorun.inf
C:\cv22.cmd
C:\gfqgq.cmd
C:\j60osk9.cmd
C:\jeorels.cmd
C:\lsass.exe
C:\m0vnonh.bat
C:\pook.com
c:\program files\Internet Explorer\msimg32.dll
C:\qxty9be.cmd
C:\uvsqfgwd.cmd
c:\windows\IE4 Error Log.txt
c:\windows\system32\ckvo.exe
c:\windows\system32\ckvo0.dll
c:\windows\system32\ckvo1.dll
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\nmdfgds2.dll
c:\windows\system32\nsprs.dll
c:\windows\system32\olhrwef.exe
c:\windows\system32\serauth1.dll
c:\windows\system32\serauth2.dll
c:\windows\system32\ssprs.dll
c:\windows\system32\tmp.reg
C:\xih9.cmd
D:\1utbfd.bat
D:\2aaxaiy.exe
D:\2fiy.bat
D:\8.bat
D:\Autorun.inf
D:\cv22.cmd
d:\documents and settings\200003779\Application Data\.#
D:\gfqgq.cmd
D:\j60osk9.cmd
D:\jeorels.cmd
D:\lsass.exe
D:\m0vnonh.bat
D:\pook.com
D:\qxty9be.cmd
D:\uvsqfgwd.cmd
D:\xih9.cmd
E:\1utbfd.bat
E:\2aaxaiy.exe
E:\2fiy.bat
E:\8.bat
E:\Autorun.inf
E:\cv22.cmd
E:\gfqgq.cmd
E:\j60osk9.cmd
E:\jeorels.cmd
E:\lsass.exe
E:\m0vnonh.bat
E:\pook.com
E:\qxty9be.cmd
E:\uvsqfgwd.cmd
E:\xih9.cmd
.
((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 )))))))))))))))))))))))))))))))
.
2009-02-26 10:29 . 2009-02-26 11:03 103,663 -r-hs---- C:\wx8o0bt1.com
2009-02-26 01:55 . 2009-02-26 01:55 <DIR> d-------- d:\documents and settings\200003779\Application Data\Meridian93
2009-02-26 01:54 . 2009-02-26 11:04 <DIR> d-------- c:\program files\Magic Farm
2009-02-20 10:25 . 2009-02-21 09:29 106,970 -r-hs---- C:\w2.com
2009-02-19 21:06 . 2009-02-19 21:06 <DIR> d-------- d:\documents and settings\200003779\Application Data\Playrix Entertainment
2009-02-17 11:47 . 2009-02-17 19:30 107,564 -r-hs---- C:\hyetn1i.exe
2009-02-15 11:36 . 2009-02-16 13:23 106,803 -r-hs---- C:\qphdin.com
2009-02-12 23:51 . 2009-02-14 19:21 107,898 -r-hs---- C:\ur0.com
2009-02-10 19:02 . 2009-02-12 05:24 108,067 -r-hs---- C:\opgde.exe
2009-02-08 17:44 . 2009-02-08 17:44 <DIR> d-------- c:\program files\PowerQuest
2009-02-03 20:16 . 2009-02-03 20:16 <DIR> d-------- d:\documents and settings\200003779\Application Data\Home Sweet Home 2
2009-02-03 16:28 . 2009-02-22 18:53 <DIR> d-------- c:\program files\Build A Lot 3 Passport To Europe
2009-02-03 15:04 . 2009-02-03 15:04 <DIR> d-------- d:\documents and settings\200003779\Application Data\Pogo Games
2009-02-03 14:57 . 2009-02-03 14:57 <DIR> d-------- c:\program files\GamesBar
2009-01-31 20:16 . 2009-02-03 17:47 109,930 -r-hs---- C:\a2h2.com
2009-01-31 10:25 . 2009-01-31 20:31 109,127 -r-hs---- C:\hl80c6b1.com
2009-01-30 01:32 . 2009-01-30 01:32 <DIR> d-------- d:\documents and settings\All Users\Application Data\eGames
2009-01-30 01:32 . 2009-01-30 01:32 <DIR> d-------- c:\program files\Common Files\SWF Studio
2009-01-29 14:13 . 2009-01-29 14:13 <DIR> d-------- d:\documents and settings\200003779\Application Data\World-LooM
2009-01-29 01:09 . 2009-01-29 13:06 <DIR> d-------- d:\documents and settings\All Users\Application Data\MumboJumbo
2009-01-29 01:09 . 2009-01-29 13:06 <DIR> d-------- c:\program files\MumboJumbo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 06:30 --------- d-----w d:\documents and settings\200003779\Application Data\Spyware Terminator
2009-02-26 06:29 --------- d-----w c:\program files\Spyware Terminator
2009-02-25 06:59 --------- d-----w d:\documents and settings\All Users\Application Data\Spyware Terminator
2009-02-19 09:45 --------- d-----w c:\program files\MSN Messenger
2009-02-08 13:45 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 08:35 --------- d-----w c:\program files\Paradise Pet Salon
2009-02-03 11:43 --------- d-----w c:\program files\Oberon Media
2009-02-03 11:12 --------- d---a-w d:\documents and settings\All Users\Application Data\TEMP
2009-02-03 10:27 --------- d-----w c:\program files\Patriot Games
2009-02-03 10:27 --------- d-----w c:\program files\GameHouse
2009-01-30 11:56 --------- d-----w d:\documents and settings\200003779\Application Data\U3
2009-01-30 11:46 --------- d-----w d:\documents and settings\200003779\Application Data\GameHouse
2009-01-26 21:20 --------- d-----w d:\documents and settings\200003779\Application Data\Boomzap
2009-01-26 19:39 --------- d-----w d:\documents and settings\All Users\Application Data\Sandlot Games
2009-01-23 18:32 107,882 --sh--r C:\w98.com
2009-01-21 16:07 108,869 --sh--r C:\gy.exe
2009-01-17 07:16 110,003 --sh--r C:\x2csvg.exe
2009-01-11 07:11 --------- d-----w c:\program files\Google
2009-01-09 14:20 --------- d-----w d:\documents and settings\All Users\Application Data\Intenium
2009-01-07 06:44 --------- d-----w c:\program files\Yahoo!
2009-01-07 06:38 --------- d-----w d:\documents and settings\200003779\Application Data\cleaner
2009-01-06 13:48 --------- d-----w c:\program files\Trend Micro
2009-01-04 17:34 --------- d-----w d:\documents and settings\All Users\Application Data\Shockwave
2009-01-01 09:08 138,752 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2008-12-30 06:24 --------- d-----w d:\documents and settings\200003779\Application Data\ErrorSmart
2008-12-30 06:24 --------- d-----w c:\program files\ErrorSmart
2008-09-17 16:45 774,144 -c--a-w c:\program files\RngInterstitial.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2009-02-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-06-26 151597]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-01-01 2957824]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-06-26 98304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain1.dll" [2007-06-13 78848]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1390067357-2052111302-682003330-4342\Scripts\Logon\
0\
0]
"Script"=admin.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1390067357-2052111302-682003330-4350\Scripts\Logon\
0\
0]
"Script"=admin.vbs
[HKLM\~\startupfolder\D:^Documents and Settings^200003779^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
path=d:\documents and settings\200003779\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
backup=c:\windows\pss\RollerCoaster Tycoon 3 Registration.lnkStartup
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
c:\windows\system32\WLTRAY [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a--c--- 2007-05-11 03:06 40048 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a--c--- 2006-11-16 19:04 139264 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 04:56 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
--a--c--- 2004-08-13 01:05 122939 c:\windows\system32\dla\tfswctrl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ErrorSmart]
--a--c--- 2008-09-17 22:11 18244856 c:\program files\ErrorSmart\ErrorSmart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a--c--- 2007-08-24 07:00 33648 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a--c--- 2004-10-08 15:27 126976 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a--c--- 2004-10-08 15:31 155648 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
--a------ 2008-11-05 21:59 4347120 c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
-----c--- 2004-10-13 20:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2009-02-19 13:45 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 2005-06-26 16:44 98304 c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
--a------ 2009-01-01 13:08 2957824 c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2005-11-10 13:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2005-06-26 16:17 151597 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
--a--c--- 2004-01-07 01:01 110592 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2008-11-05 21:59 4347120 c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a--c--- 2004-08-04 04:56 110592 c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AVP"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-11-08 30728]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-01-01 138752]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2004-05-03 80384]
S2 ekrn;Eset Service; [x]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{278607ae-61df-11dc-bab0-0010c6ec90ea}]
\Shell\AutoRun\command - G:\8.bat
\Shell\open\Command - G:\8.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{761faf61-9a1d-11dd-b800-0010c6ec90ea}]
\Shell\AutoRun\command - G:\lsass.exe
\Shell\open\Command - G:\lsass.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76ee2e3b-a116-11dd-b815-0010c6ec90ea}]
\Shell\AutoRun\command - G:\2fiji.com
\Shell\explore\Command - G:\2fiji.com
\Shell\open\Command - G:\2fiji.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76ee2e3c-a116-11dd-b815-0010c6ec90ea}]
\Shell\AutoRun\command - G:\SCVHSOT.exe
\Shell\Open\command - G:\SCVHSOT.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9641fb0e-746c-11dc-bae8-0010c6ec90ea}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9641fb0f-746c-11dc-bae8-0010c6ec90ea}]
\Shell\AutoRun\command - H:\xih9.cmd
\Shell\explore\Command - H:\xih9.cmd
\Shell\open\Command - H:\xih9.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ad82d203-6611-11dc-bac2-0014a5549780}]
\Shell\AutoRun\command - G:\pook.com
\Shell\open\Command - G:\pook.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da9a609f-7f38-11dc-bafd-0014a5549780}]
\Shell\AutoRun\command - G:\fooool.exe
\Shell\explore\Command - G:\fooool.exe
\Shell\open\Command - G:\fooool.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef1b93c1-e4d1-11d9-a546-806d6172696f}]
\Shell\AutoRun\command - f:\autorun\MediaMenu.exe
\Shell\Explore\command - explorer.exe \
.
*******s of the 'Scheduled Tasks' folder
2009-02-26 c:\windows\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart\ErrorSmart.exe [2008-09-17 22:11]
2009-02-26 c:\windows\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart [2008-12-30 10:24]
2009-02-16 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart\RegistrySmart.exe []
2009-02-16 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart []
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-cdoosoft - c:\windows\system32\olhrwef.exe
Notify-NavLogon - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.oberon-media.com/istart.html
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - d:\documents and settings\200003779\Application Data\Mozilla\Firefox\Profiles\tshfm4bg.default\
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.
.
------- File Associations -------
.
inifile=%SystemRoot%\System32\NOTEPAD.EXE %1"
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-02-26 15:34:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\klogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\windows\AhnRpta.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\windows\SoftwareDistribution\Download\963193362d99ddbedffb21408a40248b\update\update.exe
.
**************************************************************************
.
Completion time: 2009-02-26 15:39:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-26 11:39:05
Pre-Run: 6,328,049,664 bytes free
Post-Run: 6,267,551,744 bytes free
312 --- E O F --- 2008-10-25 06:41:10
