سويت هذا الشي مرتين المره الاولى طلع تقرير وماعاد تشغيل الكمبيوتر
وبالمره الثانيه عاد التشغيل بس ماعطاني تقرير
المهم التقرير اللي عطاني اياه هو هذا
ComboFix 08-07-12.2 - main 07/13/2008 7:51:34.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1256.1.1033.18.119 [GMT 3:00]
Running from: C:\Users\main\AppData\Local\Temp\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\Users\hook.dl_
C:\Users\main\AppData\Roaming\tazebama
C:\Users\main\AppData\Roaming\tazebama\tazebama.log
C:\Users\main\AppData\Roaming\tazebama\zPharaoh.dat
C:\Users\tazebama.dl_
C:\Users\tazebama.dll
C:\Windows\system32\ACER.exe
C:\Windows\system32\kakle.dll
C:\Windows\system32\Ultra.dll
C:\Windows\system32\winitn.dll
C:\zPharaoh.exe
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-13 to 2008-07-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 04:50 29,912,096 --sha-w C:\Windows\system32\drivers\fidbox.dat
2008-07-13 04:10 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-07-13 04:06 399,776 --sha-w C:\Windows\system32\drivers\fidbox.idx
2008-07-11 05:13 --------- d-----w C:\Program Files\GRETECH
2008-07-11 05:06 --------- d-----w C:\Users\main\AppData\Roaming\Template
2008-07-11 05:05 0 ----a-w C:\Users\main\AppData\Roaming\wklnhst.dat
2008-07-08 19:52 --------- d-----w C:\Users\main\AppData\Roaming\Babylon
2008-07-08 19:51 --------- d-----w C:\ProgramData\Babylon
2008-07-08 19:42 --------- d-----w C:\Program Files\Babylon
2008-07-08 19:35 --------- d-----w C:\Program Files\Karaoke5
2008-07-07 22:41 --------- d-----w C:\Program Files\Real_SC
2008-07-07 22:38 90,112 ----a-w C:\Windows\System32\agsaami.dll
2008-07-07 22:38 610,304 ----a-w C:\Windows\System32\agsaamg.dll
2008-07-07 22:38 372,736 ----a-w C:\Windows\System32\agsaamc.dll
2008-07-07 22:38 2,535,424 ----a-w C:\Windows\System32\agsaamj.dll
2008-07-07 22:38 196,608 ----a-w C:\Windows\System32\maag.dll
2008-07-07 22:38 1,986,560 ----a-w C:\Windows\System32\akll.dll
2008-07-07 22:38 1,245,184 ----a-w C:\Windows\System32\bkll.dll
2008-07-07 22:38 1,212,416 ----a-w C:\Windows\System32\ckll.dll
2008-07-07 22:11 --------- d-----w C:\Program Files\Video Convert Master
2008-07-07 22:02 --------- d-----w C:\Users\main\AppData\Roaming\Vso
2008-07-07 22:01 81,920 ----a-w C:\Users\main\AppData\Roaming\ezpinst.exe
2008-07-07 22:01 47,360 ----a-w C:\Windows\system32\drivers\pcouffin.sys
2008-07-07 22:01 47,360 ----a-w C:\Users\main\AppData\Roaming\pcouffin.sys
2008-07-07 19:03 --------- d-----w C:\Program Files\Microsoft Works
2008-07-07 19:00 --------- d-----w C:\Program Files\Launch Manager
2008-07-07 18:46 --------- d-----w C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2008-07-07 18:41 --------- d-----w C:\Program Files\Acer GameZone
2008-07-07 18:41 --------- d-----w C:\Program Files\ACER Crystal Eye webcam
2008-07-05 21:43 --------- d-----w C:\Program Files\Driver Magician
2008-07-02 17:07 --------- d-----w C:\Program Files\Cartoon Maker
2008-07-02 16:57 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-09 10:28 --------- d-----w C:\Program Files\MSN Messenger
2008-06-02 05:07 96,966 ----a-w C:\Windows\system32\drivers\klin.dat
2008-06-02 05:07 88,774 ----a-w C:\Windows\system32\drivers\klick.dat
2008-06-02 05:07 112,144 ----a-w C:\Windows\system32\drivers\kl1.sys
2008-05-29 00:05 944,184 ----a-w C:\Windows\System32\winload.exe
2008-05-29 00:05 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-05-29 00:05 620,088 ----a-w C:\Windows\System32\ci.dll
2008-05-29 00:05 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-05-29 00:05 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-05-29 00:05 371,712 ----a-w C:\Windows\System32\srcore.dll
2008-05-29 00:05 313,856 ----a-w C:\Windows\System32\rstrui.exe
2008-05-29 00:05 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-05-29 00:05 16,384 ----a-w C:\Windows\System32\srdelayed.exe
2008-05-15 12:55 --------- d-----w C:\Program Files\USB GATE
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-08 16:38 234,351 ----a-w C:\Users\main\wkplmstp.exe
2008-05-01 00:11 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-05-01 00:09 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-05-01 00:05 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-05-01 00:05 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-05-01 00:04 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-05-01 00:04 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-30 15:57 27,240 ----a-w C:\Users\main\AppData\Roaming\nvModes.dat
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-22 19:46 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-04-22 19:46 249,856 ------w C:\Windows\Setup1.exe
2008-04-22 19:39 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-04-22 19:39 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2006-11-02 12:48 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [02/29/2008 01:12 AM 1232896]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" [02/14/2008 04:16 PM 155896]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [01/15/2007 04:14 PM 147456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe" [06/22/2007 04:25 AM 155648]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [03/08/2007 02:38 PM 40048]
"PLFSet"="C:\Windows\PLFSet.dll" [04/25/2007 01:47 PM 45056]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [11/05/2006 09:48 PM 57344]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/22/2008 09:37 PM 185896]
"USB GATE"="C:\Program Files\USB GATE\USB GATE.exe" [05/15/2008 03:55 PM 925696]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [05/07/2007 09:15 AM 857648]
"RtHDVCpl"="RtHDVCpl.exe" [05/17/2007 09:28 PM 4468736 C:\Windows\RtHDVCpl.exe]
C:\Users\main\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Orion.lnk - C:\Convesoft\Orion\Messenger.exe [2007-08-31 19:42:22 2482176]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~2.0\r3hook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1ECEDE30-6108-46F6-A776-9D098FF8A6C4}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7800C013-8C20-420A-B145-F67197CA3CDB}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{000C23A7-1ECF-4470-939D-9713637E9093}"= C:\Program Files\Acer\Acer Arcade\PowerCinema.exe:CyberLink PowerCinema
"{A24327C1-B899-4809-B49F-1E4F2BB1070D}"= C:\Program Files\Acer\Acer Arcade\PCMService.exe:CyberLink PowerCinema Resident Program
"{141CEE7C-7D7A-45BF-A24B-D5AD58526FA5}"= C:\Program Files\Acer\Acer Arcade\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{CCAE20CB-1D57-4834-A710-5E3EE81B811B}"= C:\Program Files\Acer\Acer Arcade\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{44805E04-68F8-4252-8FCF-B5D47B7937C1}"= C:\Program Files\Acer\HomeMedia\HomeMedia.exe:HomeMedia
"{B6B5C9E5-C560-443D-957B-5DE377426F25}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [10/16/2007 11:05 AM]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [01/27/2007 12:24 AM]
R3 winbondcir;Winbond IR Transceiver;C:\Windows\system32\DRIVERS\winbondcir.sys [03/15/2007 08:25 PM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43f411f9-e600-11dc-a362-001b24d494d8}]
\shell\AutoRun\command - RavMon.exe
\shell\explore\Command - RavMon.exe -e
\shell\open\Command - RavMon.exe
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
"2008-07-13 01:25:19 C:\Windows\Tasks\User_Feed_Synchronization-{97561DE8-8C20-4A5D-AA1C-572F66A4C3E0}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-13 07:56:58
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\Windows\explorer.exe
-> ?:\Windows\system32\Normaliz.dll
-> ?:\Windows\system32\imagehlp.dll
.
Completion time: 07/13/2008 7:59:00
ComboFix-quarantined-files.txt 2008-07-13 04:58:49
Pre-Run: 14,184,116,224 bytes free
Post-Run: 14,352,773,120 bytes free
165 --- E O F --- 2008-07-13 01:22:33
وأنا مستغربه هالفايلات اللي طلعت لي المخفيه خصوصا معلومات الديسكتوب القاه بأغلب المجلدات
