ممكن المساعده ارجوكم

في نهايه ا لتقريرين في خا نه مكتوب فيها


normar virus contro: found bat :autorun b.b



normar virus control: found vb5 :autorun.z




والباقي found nothing

طمنيني اظن ان في نوعين فيرس

غاليتي اسمحيلي انا مضطرة اطلع الحين

ان شاء الله اشوف التقارير وارد عليج بالليل

اوكي حبيبتي مع الف سلامه

الغالية حملي هالملف واحفظيه بالديسك توب
http://go.3roos.com/kduVwfZjWC7

هالملف غير الملف الاول ،، يعني لازم تحملين هالملف

ثم اقفلي جميع صفحات اﻻنترنت والبرامج

واعملي اﻻتي: اسحبي هالملف الى برنامج ComboFix كما هو موضح بالصورة


وبرنامج ComboFix راح يشتغل و يمكن بعدها يسوي ريستارت "اعادة تشغيل " للجهاز

بعدها بيظهر لج التقرير ارفقيه بردك القادم

ملاحظة هامة: عند عمل هالبرنامج فلا تضغطي على الفأرة ابدا لانه قد يسبب في تعليق البرنامج اتركيه حتى يكمل

--------------------------------------------------------

ثم بعد هالخطوة اعمل تقرير ببرنامج Hijackthis

وطريقة استخدامه ،،

دبل كليك عليه ثم Run ثم I Agree ثم Install ثم Do a system scan and save log

ثم بيسوي سكان وبيظهر لج التقرير ،، اعملي له نسخ ،،

وارفقيه بردج القادم

------------------------------------------------------

في انتظار التقارير

سوووري حبيبتي ازعاجناك تقارير ،، بس اللي بجهازج مب راضي ينحذف :mad:

:) يللا في انتظار التقارير وان شاء الله خير

التقرير الاول


ComboFix 08-06-16.5 - ali 06/20/2008 21:54:00.4 - NTFSx86Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.281 [GMT 3:00]Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exeCommand switches used :: C:\Documents and Settings\ali\Desktop\CFScript.txt * Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).C:\WINDOWS\AppPatch\AcXtrnel.dllC:\WINDOWS\AppPatch\Jview.dllC:\WINDOWS\system32\ijsgajba.sysC:\WINDOWS\system32\ismhasrv.exeC:\WINDOWS\system32\mnmhgsrv.dllC:\WINDOWS\system32\smmhbsrv.sys.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_ETH8023-------\Service_eth8023((((((((((((((((((((((((( Files Created from 2008-05-20 to 2008-06-20 ))))))))))))))))))))))))))))))).No new files created in this timespan.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-06-20 15:07 30 ----a-w C:\MicroSoft.bat2008-06-20 15:07 186 ----a-w C:\MicroSoft.vbs2008-06-19 20:46 --------- d-----w C:\Documents and Settings\ali\Application Data\cleaner2008-06-18 16:22 --------- d-----w C:\Documents and Settings\ali\Application Data\CyberScrub2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX2008-06-13 19:58 --------- d-----w C:\Program Files\Google2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games2008-06-12 18:09 --------- d-----w C:\Program Files\TryMedia2008-06-12 17:42 --------- d-----w C:\Program Files\K-Lite Codec Pack2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files2008-06-07 16:11 --------- d-----w C:\Program Files\Real2008-06-07 15:30 --------- d-----w C:\Program Files\Avira2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys2008-06-06 20:42 --------- d-----w C:\Program Files\Intel2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage2004-08-08 07:17 16,734 --sh--w C:\WINDOWS\system32\agxyaloe.exe2004-08-08 20:49 537,608 --sh--w C:\WINDOWS\system32\apsgfjba.dll2004-08-08 20:49 535,560 --sh--w C:\WINDOWS\system32\arjrdler.dll2004-08-08 07:15 16,497 --sh--w C:\WINDOWS\system32\dazfajke.exe2004-08-08 07:15 15,873 --sh--w C:\WINDOWS\system32\dfqnabib.exe2004-08-08 07:15 1,040 --sh--w C:\WINDOWS\system32\dtzfajke.sys2004-08-08 07:17 536,584 --sh--w C:\WINDOWS\system32\erxybloe.dll2004-08-08 07:17 520 --sh--w C:\WINDOWS\system32\igxyaloe.sys2004-08-08 20:51 538,632 --sh--w C:\WINDOWS\system32\jke34kl32.dll2004-08-08 07:15 16,520 --sh--w C:\WINDOWS\system32\mkjraler.exe2004-08-08 20:51 534,024 --sh--w C:\WINDOWS\system32\mndsgsrv.dll2004-08-08 07:15 14,831 --sh--w C:\WINDOWS\system32\posqatyu.exe2004-08-08 20:49 536,072 --sh--w C:\WINDOWS\system32\pqzfajke.dll2004-08-08 20:48 536,584 --sh--w C:\WINDOWS\system32\rijxbkin.dll2004-08-08 07:15 16,602 --sh--w C:\WINDOWS\system32\stjxakin.exe2004-08-08 07:15 15,044 --sh--w C:\WINDOWS\system32\tjfyabyt.exe2004-08-08 18:46 520 --sh--w C:\WINDOWS\system32\xsdjbbmp.sys2004-08-08 18:46 537,608 --sh--w C:\WINDOWS\system32\ypdjgbmp.dll2004-08-08 20:48 536,072 --sh--w C:\WINDOWS\system32\yzztjmsn.dll2004-08-08 18:46 16,667 --sh--w C:\WINDOWS\system32\zsdjabmp.exe.((((((((((((((((((((((((((((( snapshot_Wed 06-18-2008_15.59.13.03 ))))))))))))))))))))))))))))))))))))))))).- 2008-06-18 12:57:11 2,048 --s-a-w C:\WINDOWS\bootstat.dat+ 2008-06-20 18:55:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\19-06-2008\ERDNT.EXE+ 2008-06-19 20:46:13 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\19-06-2008\Users\00000001\NTUSER.DAT+ 2008-06-19 20:46:13 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\19-06-2008\Users\00000002\UsrClass.dat+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\20-06-2008\ERDNT.EXE+ 2008-06-20 07:14:05 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\20-06-2008\Users\00000001\NTUSER.DAT+ 2008-06-20 07:14:05 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\20-06-2008\Users\00000002\UsrClass.dat+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-18\ERDNT.EXE+ 2008-06-18 12:58:20 1,929,216 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-18\Users\00000001\NTUSER.DAT+ 2008-06-18 12:58:20 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-18\Users\00000002\UsrClass.dat+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-20\ERDNT.EXE+ 2008-06-20 09:55:52 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-20\Users\00000001\NTUSER.DAT+ 2008-06-20 09:55:52 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-20\Users\00000002\UsrClass.dat- 2008-06-18 12:39:41 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat+ 2008-06-20 18:55:50 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat- 2008-06-18 12:39:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat+ 2008-06-20 18:55:50 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat- 2008-06-18 12:39:41 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat+ 2008-06-20 18:55:50 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat+ 2001-06-19 20:48:45 1,067,808 ----a-w C:\WINDOWS\system32\midimapyt2.dll+ 2008-06-20 07:15:53 229,376 ---ha-w C:\WINDOWS\system32\pedadt.dll+ 2008-06-20 07:15:40 218,624 ---ha-w C:\WINDOWS\system32\zdesfx.dll+ 2008-06-20 11:34:43 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91954FAC-1023-154F-895A-1458258AD819}]08/08/2004 09:46 PM 537608 ---hs---- C:\WINDOWS\System32\ypdjgbmp.dll[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM 4670704]"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [08/29/2002 03:00 PM 13312][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/09/2008 12:02 PM 185896]C:\Documents and Settings\ali\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912][hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]"{91954FAC-1023-154F-895A-1458258AD819}"= C:\WINDOWS\System32\ypdjgbmp.dll [08/08/2004 09:46 PM 537608][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]"JavaView"= {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll [ ][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"appinit_dlls"=arjrdler.dll,yzztjmsn.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"VIDC.YV12"= yv12vfw.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Authentication Packages REG_MULTI_SZ msv1_0 nwprovauR0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM].**************************************************************************catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7Rootkit scan 2008-06-20 21:57:06Windows 5.1.2600 Service Pack 1 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.------------------------ Other Running Processes ------------------------.C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe.**************************************************************************.Completion time: 06/20/2008 21:59:08 - machine was rebootedComboFix-quarantined-files.txt 2008-06-20 18:59:05ComboFix2.txt 2008-06-20 09:58:04ComboFix3.txt 2008-06-18 12:59:24ComboFix4.txt 2008-06-13 16:39:50Pre-Run: 9,992,818,688 bytes freePost-Run: 10,006,487,040 bytes free169 --- E O F --- 2008-06-16 16:58:27

التقرير الثاني


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:04:40, on 20/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: arjrdler.dll - {6C69034A-F45F-D34D-A33A-C33C4D324FC6} - C:\WINDOWS\System32\arjrdler.dll
O2 - BHO: ypdjgbmp.dll - {91954FAC-1023-154F-895A-1458258AD819} - C:\WINDOWS\System32\ypdjgbmp.dll
O2 - BHO: yzztjmsn.dll - {A490415F-65F8-B5C5-D8BA-9405FB12054A} - C:\WINDOWS\System32\yzztjmsn.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: arjrdler.dll,yzztjmsn.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
--
End of file - 2767 bytes

مشكوره حبيبتي الغاليه انا تعبتك كتير وضيعت وقتك كتير بس انا جبت الجهاز من الصيانه وكان اصعب من الاول

بتظهر كل شويه شاشه سوداء مثل شاشه الكمبفيكس لمجرض لحظات وبتختفي

طمنيني قي امل ولا لا

صبــــاح الخير

سوري حبيبتي ع التاخير

ابغي منج اتشوفين بالتاسك بار بجانب الساعة هل موجودة هذه الايقونه ولا هالايقونه ؟؟

صبا خ الخير حبيبتي انا مش ظاهر عندي شكل الايقونات ولكن ظاهر علامه اكس

هو علي العموم مفيش حاجه ظاهره غير وصله النت والمسنجر وصوره شبه الكره الارضيه وفوقها علامه الوندوز

اوكي عزيزتي راح اشوف التقارير وارجع لج ان شاء الله

مشكوررررره حبيبتي ما قصرتي

هلا الغالية


الغالية حملي هالملف جديد واحفظيه بالديسك توب

http://go.3roos.com/FhuBHcB5NYz

هالملف غير الملف الاول ،، يعني لازم تحملين هالملف

ثم اقفلي جميع صفحات اﻻنترنت والبرامج

واعملي اﻻتي: اسحبي هالملف الى برنامج ComboFix كما هو موضح بالصورة


وبرنامج ComboFix راح يشتغل و يمكن بعدها يسوي ريستارت "اعادة تشغيل " للجهاز

بعدها بيظهر لج التقرير ارفقيه بردك القادم

ملاحظة هامة: عند عمل هالبرنامج فلا تضغطي على الفأرة ابدا لانه قد يسبب في تعليق البرنامج اتركيه حتى يكمل

--------------------------------------------------------

ثم بعد هالخطوة اعمل تقرير ببرنامج Hijackthis

وطريقة استخدامه ،،

دبل كليك عليه ثم Run ثم I Agree ثم Install ثم Do a system scan and save log

ثم بيسوي سكان وبيظهر لج التقرير ،، اعملي له نسخ ،،

وارفقيه بردج القادم

------------------------------------------------------

حبيبتي انا حملت الماف ده وبعت التقرير في صفحه 13

عزيزتي هذا ملف اخر


انا كل مرة اعطيج ملف غير الملف اللي عطيتك قبل

احذفي اللي بجهازج وحملي هالملف الجديد

فقط حملي واتبعي ماكتب في ردي السابق

عذرا غاليتي علي التاخير
التقرير

ComboFix 08-06-16.5 - ali 06/24/2008 11:16:14.6 - NTFSx86Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.274 [GMT 3:00]Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exeCommand switches used :: C:\Documents and Settings\ali\Desktop\CFScript.txt * Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!FILE ::C:\MicroSoft.batC:\MicroSoft.pifC:\MicroSoft.vbsC:\WINDOWS\system32\agxyaloe.exeC:\WINDOWS\system32\apsgfjba.dllC:\WINDOWS\system32\arjrdler.dllC:\WINDOWS\system32\dazfajke.exeC:\WINDOWS\system32\dfqnabib.exeC:\WINDOWS\System32\drivers\eth802 3.sysC:\WINDOWS\system32\dtzfajke.sysC:\WINDOWS\system32\erxybloe.dllC:\WINDOWS\system32\igxyaloe.sysC:\WINDOWS\system32\jke34kl32.dllC:\WINDOWS\system32\midimapyt2.dllC:\WINDOWS\system32\mkjraler.exeC:\WINDOWS\system32\mndsgsrv.dllC:\WINDOWS\system32\pedadt.dllC:\WINDOWS\system32\posqatyu.exeC:\WINDOWS\system32\pqzfajke.dllC:\WINDOWS\system32\rijxbkin.dllC:\WINDOWS\system32\stjxakin.exeC:\WINDOWS\system32\tjfyabyt.exeC:\WINDOWS\System32\ypdjgbmp.dllC:\WINDOWS\system32\yzztjmsn.dllC:\WINDOWS\system32\zdesfx.dll.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).C:\WINDOWS\AppPatch\AcXtrnel.dllC:\WINDOWS\AppPatch\Jview.dllC:\WINDOWS\system32\ismhasrv.exeC:\WINDOWS\system32\mnmhgsrv.dllC:\WINDOWS\system32\smmhbsrv.sys.((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 ))))))))))))))))))))))))))))))).No new files created in this timespan.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-06-23 20:48 9,728 ----a-w C:\WINDOWS\AppPatch\AcSpecf.dll2008-06-23 20:44 18,048 ----a-w C:\WINDOWS\system32\drivers\eth8023.sys2008-06-21 12:22 27,136 ----a-w C:\WINDOWS\AppPatch\AcPlugin.dll2008-06-19 20:46 --------- d-----w C:\Documents and Settings\ali\Application Data\cleaner2008-06-18 16:22 --------- d-----w C:\Documents and Settings\ali\Application Data\CyberScrub2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX2008-06-13 19:58 --------- d-----w C:\Program Files\Google2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games2008-06-12 18:09 --------- d-----w C:\Program Files\TryMedia2008-06-12 17:42 --------- d-----w C:\Program Files\K-Lite Codec Pack2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files2008-06-07 16:11 --------- d-----w C:\Program Files\Real2008-06-07 15:30 --------- d-----w C:\Program Files\Avira2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys2008-06-06 20:42 --------- d-----w C:\Program Files\Intel2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage2004-08-08 19:34 535,560 --sh--w C:\WINDOWS\system32\arjreler.dll2004-08-08 19:32 1,040 --sh--w C:\WINDOWS\system32\cgsqatyu.sys2004-08-08 19:33 16,582 --sh--w C:\WINDOWS\system32\dsdyapaw.exe2004-08-08 19:33 536,584 --sh--w C:\WINDOWS\system32\ijdyapaw.dll2004-08-08 19:34 1,040 --sh--w C:\WINDOWS\system32\iujraler.sys2004-08-08 19:35 16,317 --sh--w C:\WINDOWS\system32\lpmxajkl.exe2004-08-08 13:17 536,072 --sh--w C:\WINDOWS\system32\nhmxcjkl.dll2004-08-08 19:33 16,421 --sh--w C:\WINDOWS\system32\pusqakol.exe2004-08-08 19:33 520 --sh--w C:\WINDOWS\system32\pzdyapaw.sys2004-08-08 19:35 520 --sh--w C:\WINDOWS\system32\rnmxajkl.sys2004-08-08 07:25 538,632 --sh--w C:\WINDOWS\system32\s2da2f323.dll2004-08-08 19:33 520 --sh--w C:\WINDOWS\system32\sbsqakol.sys2004-08-08 19:36 520 --sh--w C:\WINDOWS\system32\smdsbsrv.sys2004-08-08 19:34 520 --sh--w C:\WINDOWS\system32\snfybbyt.sys2004-08-08 19:33 535,560 --sh--w C:\WINDOWS\system32\tysqbkol.dll2004-08-08 07:24 1,040 --sh--w C:\WINDOWS\system32\xsdjbbmp.sys2004-08-08 21:25 536,584 --sh--w C:\WINDOWS\system32\yzztkmsn.dll2004-08-08 07:24 16,667 --sh--w C:\WINDOWS\system32\zsdjabmp.exe.((((((((((((((((((((((((((((( snapshot_Mon 06-23-2008_23.54.04.34 ))))))))))))))))))))))))))))))))))))))))).- 2008-06-23 20:51:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat+ 2008-06-24 08:18:07 2,048 --s-a-w C:\WINDOWS\bootstat.dat+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\ERDNT.EXE+ 2008-06-24 08:18:21 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000001\NTUSER.DAT+ 2008-06-24 08:18:21 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\2008-06-24\Users\00000002\UsrClass.dat+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\ERDNT.EXE+ 2008-06-24 08:12:49 2,195,456 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000001\NTUSER.DAT+ 2008-06-24 08:12:50 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\24-06-2008\Users\00000002\UsrClass.dat- 2008-06-23 20:51:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat+ 2008-06-24 08:18:08 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat- 2008-06-23 20:51:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat+ 2008-06-24 08:18:08 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat- 2008-06-23 20:51:20 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat+ 2008-06-24 08:18:08 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat+ 2008-06-24 08:14:07 28,672 ----a-w C:\WINDOWS\system32\wpuplder.dll+ 2008-06-24 08:14:07 11,776 ----a-w C:\WINDOWS\system32\wpuplderk.exe.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A698452-C5D8-C584-C256-C264C987C5A1}]08/08/2004 10:33 PM 536584 ---hs---- C:\WINDOWS\System32\ijdyapaw.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5D098345-6785-1098-5413-678067AE03D5}]08/08/2004 10:33 PM 535560 ---hs---- C:\WINDOWS\System32\tysqbkol.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7C69034A-F45F-D34D-A33A-C33C4D324FC7}]08/08/2004 10:34 PM 535560 ---hs---- C:\WINDOWS\System32\arjreler.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97421D0D-E07F-40DF-8F07-99597B9585AD}]06/21/2008 10:27 AM 45056 --a------ C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A629FF4F-ACDB-5C90-A098-FACB3456A26A}]08/08/2004 10:25 AM 538632 ---hs---- C:\WINDOWS\System32\s2da2f323.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B490415F-65F8-B5C5-D8BA-9405FB12054B}]08/09/2004 12:25 AM 536584 ---hs---- C:\WINDOWS\System32\yzztkmsn.dll[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [08/29/2002 03:00 PM 13312][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/09/2008 12:02 PM 185896]C:\Documents and Settings\ali\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912][hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]"{B490415F-65F8-B5C5-D8BA-9405FB12054B}"= C:\WINDOWS\System32\yzztkmsn.dll [08/09/2004 12:25 AM 536584]"{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}"= C:\WINDOWS\System32\jfdses.dll [06/23/2008 10:33 PM 218624]"{A629FF4F-ACDB-5C90-A098-FACB3456A26A}"= C:\WINDOWS\System32\s2da2f323.dll [08/08/2004 10:25 AM 538632]"{1A698452-C5D8-C584-C256-C264C987C5A1}"= C:\WINDOWS\System32\ijdyapaw.dll [08/08/2004 10:33 PM 536584]"{5D098345-6785-1098-5413-678067AE03D5}"= C:\WINDOWS\System32\tysqbkol.dll [08/08/2004 10:33 PM 535560]"{7C69034A-F45F-D34D-A33A-C33C4D324FC7}"= C:\WINDOWS\System32\arjreler.dll [08/08/2004 10:34 PM 535560]"{00180018-0018-0018-0018-00180018BB15}"= C:\WINDOWS\System32\mstimewd.dll [06/23/2001 10:36 PM 1059476][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]"JavaView"= {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll [ ]"ThunderAdvise"= {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll [06/21/2008 10:27 AM 45056]"mstimewd"= {00180018-0018-0018-0018-00180018BB15} - C:\WINDOWS\System32\mstimewd.dll [06/23/2001 10:36 PM 1059476][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"appinit_dlls"=yzztkmsn.dll,arjreler.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"VIDC.YV12"= yv12vfw.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Authentication Packages REG_MULTI_SZ msv1_0 nwprovauR0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM].**************************************************************************catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7Rootkit scan 2008-06-24 11:18:31Windows 5.1.2600 Service Pack 1 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.------------------------ Other Running Processes ------------------------.C:\WINDOWS\system32\WgaTray.exeC:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe.**************************************************************************.Completion time: 06/24/2008 11:20:48 - machine was rebootedComboFix-quarantined-files.txt 2008-06-24 08:20:45ComboFix2.txt 2008-06-23 20:54:16ComboFix3.txt 2008-06-20 18:59:09ComboFix4.txt 2008-06-20 09:58:04ComboFix5.txt 2008-06-18 12:59:24Pre-Run: 8,826,052,608 bytes freePost-Run: 8,802,680,832 bytes free201 --- E O F --- 2008-06-16 16:58:27

الجهاز اصبح ثقيل مع ان امكانياته عاليه