حصريا : حل مشكله gxgxy الفيرس الصينى وكل مشاكل autorun وكمان برنامج الفيرس يسطب

ComboFix 08-03-14.4 - The Ghost 2008-03-16 19:42:53.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1256.20.1033.18.82 [GMT 2:00]
Running from: I:\Documents and Settings\The Ghost\Desktop\1234.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\pagefile.pif
D:\Autorun.inf
D:\pagefile.pif
E:\Autorun.inf
E:\pagefile.pif
F:\Autorun.inf
F:\pagefile.pif
G:\Autorun.inf
G:\pagefile.pif
I:\037589.log
I:\Autorun.inf
I:\pagefile.pif
I:\WINDOWS\system32\21774641.log
I:\WINDOWS\system32\21831938.log
I:\WINDOWS\system32\43126.log
I:\WINDOWS\system32\com\lsass.exe
I:\WINDOWS\system32\com\netcfg.000
I:\WINDOWS\system32\com\netcfg.dll
I:\WINDOWS\system32\com\smss.exe
I:\WINDOWS\system32\dnsq.dll
I:\WINDOWS\system32\drivers\npf.sys
I:\WINDOWS\system32\packet.dll
I:\WINDOWS\system32\pthreadVC.dll
I:\WINDOWS\system32\wpcap.dll
J:\Autorun.inf
J:\pagefile.pif

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_NPF
-------\NPF


(((((((((((((((((((((((((   Files Created from 2008-02-16 to 2008-03-16  )))))))))))))))))))))))))))))))
.

2008-03-16 19:45 . 2008-03-16 19:45    <DIR>    d--------    I:\WINDOWS\system32\xircom
2008-03-16 19:45 . 2008-03-16 19:45    <DIR>    d--------    I:\WINDOWS\srchasst
2008-03-16 19:45 . 2008-03-16 19:45    <DIR>    d--------    I:\Program Files\microsoft frontpage
2008-03-16 15:21 . 2008-03-16 15:21    <DIR>    d--------    I:\Documents and Settings\All Users\Application Data\Yahoo!
2008-03-16 15:20 . 2008-03-16 15:20    <DIR>    d--------    I:\Program Files\Yahoo!
2008-03-16 14:10 . 2008-03-16 14:10    <DIR>    d--------    I:\WINDOWS\system32\Kaspersky Lab
2008-03-16 14:05 . 2008-03-16 14:05    <DIR>    d---s----    I:\Documents and Settings\The Ghost\UserData
2008-03-16 13:52 . 2008-03-16 13:52    <DIR>    d--------    I:\Program Files\McAfee.com
2008-03-16 13:52 . 2004-07-26 19:13    341,064    --a------    I:\WINDOWS\system32\mcinsctl.dll
2008-03-16 13:52 . 2004-07-22 11:57    279,624    --a------    I:\WINDOWS\system32\mcgdmgr.dll
2008-03-16 13:43 .     <DIR>        I:\WINDOWS\LastGood.Tmp
2008-03-15 21:16 . 2007-07-30 19:19    271,224    --a------    I:\WINDOWS\system32\mucltui.dll
2008-03-15 21:16 . 2007-07-30 19:19    30,072    --a------    I:\WINDOWS\system32\mucltui.dll.mui
2008-03-15 21:15 . 2007-07-30 19:18    34,136    --a------    I:\WINDOWS\system32\wucltui.dll.mui
2008-03-15 21:15 . 2007-07-30 19:19    25,944    --a------    I:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-15 21:15 . 2007-07-30 19:19    25,944    --a------    I:\WINDOWS\system32\wuapi.dll.mui
2008-03-15 21:15 . 2007-07-30 19:18    20,312    --a------    I:\WINDOWS\system32\wuaueng.dll.mui
2008-03-15 18:20 . 2008-03-15 18:20    <DIR>    d--------    I:\Program Files\Passware
2008-03-15 18:09 . 2001-08-17 22:36    8,704    --a------    I:\WINDOWS\system32\kbdjpn.dll
2008-03-15 18:09 . 2001-08-17 22:36    8,192    --a------    I:\WINDOWS\system32\kbdkor.dll
2008-03-15 18:09 . 2001-08-17 14:55    6,144    --a------    I:\WINDOWS\system32\kbd106.dll
2008-03-15 18:09 . 2001-08-17 14:55    6,144    --a------    I:\WINDOWS\system32\kbd101c.dll
2008-03-15 18:09 . 2001-08-17 14:55    6,144    --a------    I:\WINDOWS\system32\kbd101b.dll
2008-03-15 18:09 . 2001-08-17 14:55    5,632    --a------    I:\WINDOWS\system32\kbd103.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 17:45    432,160    --sha-w    I:\WINDOWS\system32\drivers\fidbox.dat
2008-03-16 17:45    2,336    --sha-w    I:\WINDOWS\system32\drivers\fidbox2.dat
2008-03-16 17:44    6,092    --sha-w    I:\WINDOWS\system32\drivers\fidbox.idx
2008-03-16 17:44    1,196    --sha-w    I:\WINDOWS\system32\drivers\fidbox2.idx
2008-03-16 17:42    18,829    ----a-w    I:\WINDOWS\system32\drivers\alg.exe
2008-03-16 17:39    ---------    d-----w    I:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-15 16:13    ---------    d-----w    I:\Documents and Settings\The Ghost\Application Data\Zoom Player
2008-03-15 15:54    ---------    d-----w    I:\Program Files\TechSmith
2008-03-15 15:54    ---------    d-----w    I:\Documents and Settings\All Users\Application Data\TechSmith
2008-03-15 15:51    ---------    d-----w    I:\Program Files\Common Files\Wise Installation Wizard
2008-03-15 15:47    ---------    d-----w    I:\Program Files\Zoom Player
2008-03-15 15:40    82,258    ----a-w    I:\WINDOWS\system32\drivers\klin.dat
2008-03-15 15:40    82,258    ----a-w    I:\WINDOWS\system32\drivers\klick.dat
2008-03-15 15:39    ---------    d-----w    I:\Program Files\Kaspersky Lab
2008-03-15 15:38    ---------    d-----w    I:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
.

------- Sigcheck -------

2006-09-09 03:02  2198144  ba08992ecfb4b23b9204add12ab385ea    I:\WINDOWS\system32\ntkrnlpa.exe

2006-09-09 01:01  2321024  ef63859e4fd9cb3ec31a111481f4b1b6    I:\WINDOWS\system32\ntoskrnl.exe

2006-09-09 02:48  1616896  7f9583eff8102bce8bd6716744018f83    I:\WINDOWS\explorer.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"Yahoo! Pager"="I:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-10-24 16:10 4662776]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2006-09-09 08:31 391680 I:\WINDOWS\system32\cmd.exe]
"tscuninstall"="I:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 23:59 44544]

[HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\run_CF]

[HKEY_USERS\s-1-5-21-1292428093-602609370-839522115-1003\software\microsoft\windows\currentversion\run_CF]
"CTFMON.EXE"="I:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"I:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"I:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

R3 klim5;Kaspersky Anti-Virus NDIS Filter;I:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-16 19:45:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: I:\WINDOWS\explorer.exe [6.00.2900.2649]
-> I:\Program Files\WinRAR\rarext.dll
.
------------------------ Other Running Processes ------------------------
.
I:\WINDOWS\system32\wscntfy.exe
I:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-03-16 19:47:16 - machine was rebooted [The Ghost]
ComboFix-quarantined-files.txt  2008-03-16 17:47:12