مايعيد تشغيل الكمبيوتر على طول يطلع الـ تقرير وخلاص يهجد ... مايكمل فحص
بس تطور قلت الفيروسات خخخخخ
ComboFix 08-07-12.2 - main 07/14/2008 8:22:13.3 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1256.1.1033.18.211 [GMT 3:00]
Running from: C:\Users\main\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Autorun.inf
C:\Users\hook.dl_
C:\Users\tazebama.dl_
C:\zPharaoh.exe
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-14 to 2008-07-14 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-14 05:03 34,266,656 --sha-w C:\Windows\system32\drivers\fidbox.dat
2008-07-14 04:41 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-07-14 04:36 460,520 --sha-w C:\Windows\system32\drivers\fidbox.idx
2008-07-13 23:14 --------- d-----w C:\Program Files\Absolute MP3 Splitter
2008-07-13 22:30 --------- d-----w C:\Program Files\Karaoke5
2008-07-13 05:37 77,824 ----a-w C:\Users\main\wkplmstp.exe
2008-07-11 05:13 --------- d-----w C:\Program Files\GRETECH
2008-07-11 05:06 --------- d-----w C:\Users\main\AppData\Roaming\Template
2008-07-11 05:05 0 ----a-w C:\Users\main\AppData\Roaming\wklnhst.dat
2008-07-08 19:52 --------- d-----w C:\Users\main\AppData\Roaming\Babylon
2008-07-08 19:51 --------- d-----w C:\ProgramData\Babylon
2008-07-08 19:42 --------- d-----w C:\Program Files\Babylon
2008-07-07 22:41 --------- d-----w C:\Program Files\Real_SC
2008-07-07 22:38 90,112 ----a-w C:\Windows\System32\agsaami.dll
2008-07-07 22:38 610,304 ----a-w C:\Windows\System32\agsaamg.dll
2008-07-07 22:38 372,736 ----a-w C:\Windows\System32\agsaamc.dll
2008-07-07 22:38 2,535,424 ----a-w C:\Windows\System32\agsaamj.dll
2008-07-07 22:38 196,608 ----a-w C:\Windows\System32\maag.dll
2008-07-07 22:38 1,986,560 ----a-w C:\Windows\System32\akll.dll
2008-07-07 22:38 1,245,184 ----a-w C:\Windows\System32\bkll.dll
2008-07-07 22:38 1,212,416 ----a-w C:\Windows\System32\ckll.dll
2008-07-07 22:11 --------- d-----w C:\Program Files\Video Convert Master
2008-07-07 22:02 --------- d-----w C:\Users\main\AppData\Roaming\Vso
2008-07-07 22:01 81,920 ----a-w C:\Users\main\AppData\Roaming\ezpinst.exe
2008-07-07 22:01 47,360 ----a-w C:\Windows\system32\drivers\pcouffin.sys
2008-07-07 22:01 47,360 ----a-w C:\Users\main\AppData\Roaming\pcouffin.sys
2008-07-07 19:03 --------- d-----w C:\Program Files\Microsoft Works
2008-07-07 19:00 --------- d-----w C:\Program Files\Launch Manager
2008-07-07 18:46 --------- d-----w C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
2008-07-07 18:41 --------- d-----w C:\Program Files\Acer GameZone
2008-07-07 18:41 --------- d-----w C:\Program Files\ACER Crystal Eye webcam
2008-07-05 21:43 --------- d-----w C:\Program Files\Driver Magician
2008-07-02 17:07 --------- d-----w C:\Program Files\Cartoon Maker
2008-07-02 16:57 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-09 10:28 --------- d-----w C:\Program Files\MSN Messenger
2008-06-02 05:07 96,966 ----a-w C:\Windows\system32\drivers\klin.dat
2008-06-02 05:07 88,774 ----a-w C:\Windows\system32\drivers\klick.dat
2008-06-02 05:07 112,144 ----a-w C:\Windows\system32\drivers\kl1.sys
2008-05-29 00:05 944,184 ----a-w C:\Windows\System32\winload.exe
2008-05-29 00:05 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-05-29 00:05 620,088 ----a-w C:\Windows\System32\ci.dll
2008-05-29 00:05 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-05-29 00:05 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-05-29 00:05 371,712 ----a-w C:\Windows\System32\srcore.dll
2008-05-29 00:05 313,856 ----a-w C:\Windows\System32\rstrui.exe
2008-05-29 00:05 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-05-29 00:05 16,384 ----a-w C:\Windows\System32\srdelayed.exe
2008-05-15 12:55 --------- d-----w C:\Program Files\USB GATE
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-01 00:11 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-05-01 00:09 296,448 ----a-w C:\Windows\System32\gdi32.dll
2008-05-01 00:05 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-05-01 00:05 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-05-01 00:04 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-05-01 00:04 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-30 15:57 27,240 ----a-w C:\Users\main\AppData\Roaming\nvModes.dat
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-22 19:46 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-04-22 19:46 249,856 ------w C:\Windows\Setup1.exe
2008-04-22 19:39 83,968 ----a-w C:\Windows\System32\dnsrslvr.dll
2008-04-22 19:39 24,576 ----a-w C:\Windows\System32\dnscacheugc.exe
2006-11-02 12:48 174 --sha-w C:\Program Files\desktop.ini
.
((((((((((((((((((((((((((((( snapshot_Sun 07-13-2008_ 8.50.28.28 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-13 05:28:33 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-07-14 04:37:24 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-07-13 05:28:35 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-07-14 04:37:26 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-07-13 05:28:35 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-07-14 04:37:26 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-07-13 05:43:42 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-07-14 05:09:06 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-07-13 05:37:17 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-07-14 04:41:13 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
- 2008-07-13 05:38:11 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
+ 2008-07-14 04:39:49 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat
- 2008-07-13 05:31:08 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
+ 2008-07-14 04:41:08 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat
- 2008-07-13 05:32:36 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-14 04:41:21 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-07-13 05:32:36 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
+ 2008-07-14 04:41:21 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
- 2008-07-13 05:32:36 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
+ 2008-07-14 04:41:21 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\s\index.dat
- 2008-07-08 21:26:12 374,096 ----a-w C:\Windows\System32\FNTCACHE.DAT
+ 2008-07-13 22:37:25 374,096 ----a-w C:\Windows\System32\FNTCACHE.DAT
- 2008-07-13 05:37:06 103,924 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-07-14 05:10:02 103,924 ----a-w C:\Windows\System32\perfc009.dat
- 2008-07-13 05:37:06 610,142 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-07-14 05:10:02 610,142 ----a-w C:\Windows\System32\perfh009.dat
- 2008-07-13 03:18:26 7,077,888 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat
+ 2008-07-14 01:53:11 7,864,320 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat
- 2008-07-13 05:31:36 13,586 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1155549537-2040561288-3383001941-1000_UserData.bin
+ 2008-07-14 04:42:18 13,706 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1155549537-2040561288-3383001941-1000_UserData.bin
- 2008-07-13 05:31:35 75,192 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-07-14 04:42:15 75,714 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-07-12 03:48:14 2,642 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-07-13 21:09:10 2,642 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-07-13 05:31:24 55,504 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-07-14 04:42:04 55,718 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-07-13 05:44:48 16,384 --sha-w C:\Windows\Temp\s\index.dat
+ 2008-07-14 05:24:26 16,384 --sha-w C:\Windows\Temp\s\index.dat
- 2008-07-13 05:44:48 16,384 --sha-w C:\Windows\Temp\History\History.IE5\index.dat
+ 2008-07-14 05:24:26 16,384 --sha-w C:\Windows\Temp\History\History.IE5\index.dat
- 2008-07-13 05:44:48 16,384 --sha-w C:\Windows\Temp\Temporary Internet Files\.IE5\index.dat
+ 2008-07-14 05:24:26 16,384 --sha-w C:\Windows\Temp\Temporary Internet Files\.IE5\index.dat
- 2008-04-29 19:37:20 791,919 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.0.6000.16386_none_563b039e9fefbb1f\FreeCell.exe
+ 2008-07-14 03:51:24 635,392 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.0.6000.16386_none_563b039e9fefbb1f\FreeCell.exe
- 2008-04-29 19:37:21 788,847 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.0.6000.16386_none_f1d33c3366edbce0\Hearts.exe
+ 2008-07-14 03:51:26 632,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.0.6000.16386_none_f1d33c3366edbce0\Hearts.exe
- 2008-04-29 19:37:22 803,183 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.0.6000.16386_none_8081726a786413f8\SpiderSolitaire.exe
+ 2008-07-14 03:51:29 646,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.0.6000.16386_none_8081726a786413f8\SpiderSolitaire.exe
- 2008-04-29 19:37:22 799,599 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.0.6000.16386_none_72e6985cfec1e599\Solitaire.exe
+ 2008-07-14 03:51:32 643,072 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.0.6000.16386_none_72e6985cfec1e599\Solitaire.exe
- 2008-04-29 19:37:21 1,023,343 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.0.6000.16386_none_a02a5b603c4437cd\MineSweeper.exe
+ 2008-07-14 03:51:35 866,816 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.0.6000.16386_none_a02a5b603c4437cd\MineSweeper.exe
- 2008-04-29 19:37:22 1,147,247 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.0.6000.16386_none_03f4bc7f0186d3be\PurblePlace.exe
+ 2008-07-14 03:51:38 990,720 ----a-w C:\Windows\winsxs\x86_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.0.6000.16386_none_03f4bc7f0186d3be\PurblePlace.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [02/29/2008 01:12 AM 1232896]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" [02/14/2008 04:16 PM 155896]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [01/15/2007 04:14 PM 147456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="C:\Program Files\Acer\Acer Arcade\PCMService.exe" [06/22/2007 04:25 AM 155648]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [03/08/2007 02:38 PM 40048]
"PLFSet"="C:\Windows\PLFSet.dll" [04/25/2007 01:47 PM 45056]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [11/05/2006 09:48 PM 57344]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [03/22/2008 09:37 PM 185896]
"USB GATE"="C:\Program Files\USB GATE\USB GATE.exe" [05/15/2008 03:55 PM 925696]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [05/07/2007 09:15 AM 857648]
"RtHDVCpl"="RtHDVCpl.exe" [05/17/2007 09:28 PM 4468736 C:\Windows\RtHDVCpl.exe]
C:\Users\main\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Orion.lnk - C:\Convesoft\Orion\Messenger.exe [2007-08-31 19:42:22 2482176]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~2.0\r3hook.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1ECEDE30-6108-46F6-A776-9D098FF8A6C4}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7800C013-8C20-420A-B145-F67197CA3CDB}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{000C23A7-1ECF-4470-939D-9713637E9093}"= C:\Program Files\Acer\Acer Arcade\PowerCinema.exe:CyberLink PowerCinema
"{A24327C1-B899-4809-B49F-1E4F2BB1070D}"= C:\Program Files\Acer\Acer Arcade\PCMService.exe:CyberLink PowerCinema Resident Program
"{141CEE7C-7D7A-45BF-A24B-D5AD58526FA5}"= C:\Program Files\Acer\Acer Arcade\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{CCAE20CB-1D57-4834-A710-5E3EE81B811B}"= C:\Program Files\Acer\Acer Arcade\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{44805E04-68F8-4252-8FCF-B5D47B7937C1}"= C:\Program Files\Acer\HomeMedia\HomeMedia.exe:HomeMedia
"{B6B5C9E5-C560-443D-957B-5DE377426F25}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [10/16/2007 11:05 AM]
R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [01/27/2007 12:24 AM]
R3 winbondcir;Winbond IR Transceiver;C:\Windows\system32\DRIVERS\winbondcir.sys [03/15/2007 08:25 PM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43f411f9-e600-11dc-a362-001b24d494d8}]
\shell\AutoRun\command - RavMon.exe
\shell\explore\Command - RavMon.exe -e
\shell\open\Command - RavMon.exe
.
s of the 'Scheduled Tasks' folder
"2008-07-14 04:24:55 C:\Windows\Tasks\User_Feed_Synchronization-{97561DE8-8C20-4A5D-AA1C-572F66A4C3E0}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-14 08:25:54
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\Windows\Explorer.exe
-> ?:\Windows\system32\urlmon.dll
-> ?:\Windows\system32\Normaliz.dll
.
Completion time: 07/14/2008 8:27:19
ComboFix-quarantined-files.txt 2008-07-14 05:27:10
ComboFix2.txt 2008-07-13 04:59:01
Pre-Run: 13,681,274,880 bytes free
Post-Run: 13,643,386,880 bytes free
219 --- E O F --- 2008-07-14 00:04:40
