اخوي انا ما عمل اعادة تشغيل
هل اعمل اعادة ذاتيه ؟؟
وهذ التقرير اللي طلع
ComboFix 08-11-13.02 - vip 11/16/2008 0:10:59.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.1.1033.18.265 [GMT 3:00]
Running from: c:\users\vip\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-15 to 2008-11-15 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-15 18:06 --------- d-----w c:\users\vip\AppData\Roaming\tor
2008-11-15 18:06 --------- d-----w c:\programdata\Kaspersky Lab
2008-11-15 17:54 --------- d-----w c:\users\vip\AppData\Roaming\Vidalia
2008-11-15 17:52 720,928 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-15 17:52 4,592 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-15 17:52 30,436 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-15 17:52 3,623,456 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-15 09:56 --------- d-----w c:\program files\Common Files\xing shared
2008-11-15 09:56 --------- d-----w c:\program files\Common Files\Real
2008-11-15 00:28 --------- d-----w c:\programdata\Symantec
2008-11-15 00:28 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-14 22:49 --------- d-----w c:\program files\Web Publish
2008-11-14 22:17 --------- d-----w c:\users\vip\AppData\Roaming\Talkback
2008-11-14 18:13 --------- d-----w c:\program files\SWiSHmax
2008-11-14 17:45 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-14 17:45 --------- d-----w c:\program files\CircuitMaker 2000
2008-11-13 00:07 --------- d-----w c:\programdata\Microsoft Help
2008-11-12 13:13 --------- d-----w c:\program files\Vidalia Bundle
2008-11-12 08:21 --------- d-----w c:\program files\c3c2
2008-11-09 21:01 --------- d-----w c:\program files\Acer Zone
2008-11-08 21:51 90,112 ----a-w c:\windows\System32\agsaami.dll
2008-11-08 21:51 610,304 ----a-w c:\windows\System32\agsaamg.dll
2008-11-08 21:51 372,736 ----a-w c:\windows\System32\agsaamc.dll
2008-11-08 21:51 2,535,424 ----a-w c:\windows\System32\agsaamj.dll
2008-11-08 21:51 1,986,560 ----a-w c:\windows\System32\akll.dll
2008-11-08 21:51 1,245,184 ----a-w c:\windows\System32\bkll.dll
2008-11-08 21:51 1,212,416 ----a-w c:\windows\System32\ckll.dll
2008-11-08 21:51 --------- d-----w c:\program files\Real_SC
2008-11-08 08:43 --------- d---a-w c:\programdata\TEMP
2008-11-08 06:56 --------- d-----w c:\program files\Google
2008-11-07 21:16 --------- d-----w c:\users\vip\AppData\Roaming\WNR
2008-11-07 20:20 --------- d-----w c:\program files\Macromedia Flash FX-Arabic
2008-11-07 20:19 286,720 ----a-w c:\windows\iun503.exe
2008-11-07 20:14 --------- d-----w c:\program files\Macromedia
2008-10-23 05:18 --------- d-----w c:\program files\Photoshop
2008-10-20 05:20 --------- d-----w c:\program files\iBizCard
2008-10-17 00:59 --------- d-----w c:\program files\Windows Mail
2008-10-14 18:21 6,907 ----a-w c:\users\vip\%B1ين كتاب القواعد للصف السادس.zip
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-09-30 13:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-09-10 03:40 1,334,272 ----a-w c:\windows\System32\msxml6.dll
2008-09-05 05:14 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-09-03 03:59 468,992 ----a-w c:\windows\System32\newdev.dll
2008-09-03 03:58 74,752 ----a-w c:\windows\System32\newdev.exe
2008-07-02 21:26 2,398,736 ----a-w c:\users\vip\WLinstaller.exe
2008-06-20 02:23 174 --sha-w c:\program files\desktop.ini
2006-12-20 19:23 1,981,380 ----a-w c:\users\vip\AFRB.exe
2006-12-19 19:25 1,806,792 ----a-w c:\users\vip\HSS.exe
2008-06-11 14:55 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-06-11 14:55 32,768 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat
2008-06-11 14:55 16,384 --sha-w c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\s\index.dat
.
(((((((((((((((((((((((((((((
snapshot@Sat 11-15-2008_23.59.36.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-11-15 20:58:40 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-15 21:12:18 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-15 21:12:18 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{6688a66b-9676-458f-887b-cdd10d251eef}]
06/24/2008 11:17 PM 1569304 --a------ c:\program files\c3c2\tbc3c0.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{6688a66b-9676-458f-887b-cdd10d251eef}"= "c:\program files\c3c2\tbc3c0.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{6688A66B-9676-458F-887B-CDD10D251EEF}"= "c:\program files\c3c2\tbc3c0.dll" [06/24/2008 11:17 PM 1569304]
[HKEY_CLASSES_ROOT\clsid\{6688a66b-9676-458f-887b-cdd10d251eef}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"="" [?]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [01/19/2008 10:33 AM 1233920]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [11/22/2004 07:18 PM 307200]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [08/11/2005 03:30 PM 249856]
"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [03/25/2008 06:04 AM 3878980]
"AFProg"="c:\program files\AnchorFree\bin\ctrl\AFController.exe" [11/20/2006 11:19 AM 81920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [01/19/2008 10:33 AM 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 10:33 AM 202240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [11/08/2008 09:56 AM 171448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [11/24/2006 02:24 AM 319488]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM 33648]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [07/09/2001 10:50 AM 155648]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [04/25/2008 06:21 PM 201992]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/15/2008 12:56 PM 185872]
"RtHDVCpl"="RtHDVCpl.exe" [11/09/2006 05:57 AM 3784704 c:\windows\RtHDVCpl.exe]
c:\users\vip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-11 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2006-12-13 528384]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll,c:\progra~1\KASPER~1\KASPER~1\adialhk.dll,c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\?????????]
??????????????e [?]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{77903AD6-5ACF-421D-A535-A1E13B102458}"= UDP:c:\program files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{681CD731-8E13-4A90-8D99-3D2624D5B65B}"= TCP:c:\program files\Acer Zone\Acer Picture Slide DVD\Component\CLSLDVD.exe:Cyberlink Picture Slide DVD workprocess
"{D6B57FAA-03F4-40C5-828F-299B57E5F37B}"= UDP:c:\program files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{B0466DFE-7F35-4850-B317-983CB27BCA64}"= TCP:c:\program files\Acer Zone\Acer Plug and Record\Component\ARAWP.exe:Cyberlink Plug and Record ARA workprocess
"{8884B6A2-6563-4B90-8DF8-8DF85206E85F}"= UDP:c:\program files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{ED194098-E784-4C30-B4E2-663B0143CB34}"= TCP:c:\program files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe:Cyberlink Plug and Record AVAX workprocess
"{5C1089CF-FE6D-4404-BFE8-1D2257D9E601}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{88FD3023-5F41-4899-B6CE-DDD3DDBD3B9C}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{B03115A1-EF5B-4146-B474-0C06DD70EBB9}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{2BDBDE70-87A5-4EB5-8CC9-A71A1A0BF041}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{07B5668B-36AF-459D-A6F4-6AFB4E659965}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2942A4B1-57A8-4287-9611-40481CABCC44}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{04D7848A-B65C-428A-8FAE-FBA3F806C45C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{FF684E91-D375-4471-8756-DA489E32106B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C4AE02CD-6FA6-4548-AEE1-CB0609222E55}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{880E56E8-4CD3-4EF1-B65A-51F182CBDA76}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9F9B00F4-B19F-4F3F-9C43-C1E3DA19A198}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{63DBFC54-1FCB-44C9-B2D2-A18E4F7F93B6}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{F28CFB9E-6C7A-4359-9933-A635A1D0A69D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-03-26 20496]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S2 is-2OM3F;is-2OM3F;"c:\users\vip\Downloads\Kaspersky Lab Tool\is-2OM3F\is-2OM3F.exe" -r []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0a7c4d1-3763-11dd-8aea-806e6f6e6963}]
\shell\AutoRun\command - E:\SETUP.EXE /AUTORUN
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\users\vip\AppData\Roaming\Mozilla\Firefox\Profiles\ds236nbt.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-16 00:12:40
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 11/16/2008 0:14:26
ComboFix-quarantined-files.txt 2008-11-15 21:14:03
ComboFix2.txt 2008-11-15 21:07:49
ComboFix3.txt 2008-11-15 21:00:45
Pre-Run: 156,274,978,816 bytes free
Post-Run: 155,798,052,864 bytes free
189 --- E O F --- 2008-11-13 00:07:50
