تفضل اخي تقرير ComboFix.exe
ComboFix 08-11-18.03 - Abt computer 11/19/2008 4:08:26.6 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.1.1025.18.351 [GMT 3:00]
Running from: c:\users\Abt computer\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Abt computer\AppData\Roaming\.#
c:\users\Abt computer\AppData\Roaming\inst.exe
c:\windows\system32\micr0st.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-19 to 2008-11-19 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-19 01:05 --------- d-----w c:\program files\Common Files\delet
2008-11-19 00:14 --------- d---a-w c:\programdata\TEMP
2008-11-18 04:59 --------- d-----w c:\users\Abt computer\AppData\Roaming\AviDvdBurner
2008-11-18 04:53 --------- d-----w c:\users\Abt computer\AppData\Roaming\Vso
2008-11-17 23:59 --------- d-----w c:\programdata\f-secure
2008-11-17 06:27 --------- d-----w c:\users\Abt computer\AppData\Roaming\uTorrent
2008-11-17 01:51 --------- d-----w c:\program files\TechSmith
2008-11-17 01:48 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-11-16 22:59 --------- d-----w c:\users\Abt computer\AppData\Roaming\F-Secure
2008-11-16 22:47 --------- d-----w c:\programdata\Avira
2008-11-16 22:39 --------- d-----w c:\programdata\fssg
2008-11-16 03:59 --------- d-----w c:\program files\Gabest
2008-11-15 00:00 --------- d-----w c:\users\Abt computer\AppData\Roaming\Uniblue
2008-11-15 00:00 --------- d-----w c:\program files\RegistryBooster 2
2008-11-14 19:18 --------- d-----w c:\programdata\vsosdk
2008-11-14 03:19 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2008-11-14 03:19 47,360 ----a-w c:\users\Abt computer\AppData\Roaming\pcouffin.sys
2008-11-14 03:19 --------- d-----w c:\program files\VSO
2008-11-12 23:26 --------- d-----w c:\users\Abt computer\AppData\Roaming\vlc
2008-11-12 20:24 --------- d-----w c:\program files\Folder Lock
2008-11-12 02:15 --------- d-----w c:\users\Abt computer\AppData\Roaming\Skype
2008-11-11 23:28 --------- d-----w c:\users\Abt computer\AppData\Roaming\skypePM
2008-11-11 20:20 --------- d-----w c:\programdata\Microsoft Help
2008-11-11 05:30 --------- d-----w c:\program files\MSECACHE
2008-11-09 03:16 --------- d-----w c:\program files\Ashampoo
2008-11-07 04:32 410,976 ----a-w c:\windows\System32\deploytk.dll
2008-11-06 03:14 --------- d-----w c:\users\Abt computer\AppData\Roaming\Sunbelt
2008-11-06 03:14 --------- d-----w c:\programdata\Sunbelt
2008-11-06 03:13 --------- d-----w c:\program files\Sunbelt Software
2008-11-05 05:08 --------- d-----w c:\program files\LtUcx
2008-11-04 23:48 --------- d-----w c:\users\Abt computer\AppData\Roaming\dvdcss
2008-11-04 22:05 --------- d-----w c:\program files\MSXML 4.0
2008-11-02 23:36 --------- d-----w c:\program files\Opera
2008-11-02 22:13 --------- d-----w c:\program files\uTorrent
2008-11-02 18:30 --------- d-----w c:\users\Abt computer\AppData\Roaming\cleaner
2008-10-31 00:10 --------- d-----w c:\users\Abt computer\AppData\Roaming\BitSpirit
2008-10-30 01:40 --------- d-----w c:\program files\Hotspot Shield
2008-10-30 00:19 1,700,352 ----a-w c:\windows\System32\gdiplus.dll
2008-10-26 22:00 --------- d-----w c:\users\Abt computer\AppData\Roaming\ESET
2008-10-26 21:57 --------- d-----w c:\programdata\ESET
2008-10-26 03:52 --------- d-----w c:\program files\S3
2008-10-26 03:49 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-25 23:44 --------- d-----w c:\program files\Java
2008-10-25 03:18 --------- d-----w c:\program files\Proxy Switcher Standard
2008-10-24 22:23 --------- d-----w c:\program files\Common Files\SWF Studio
2008-10-24 04:36 --------- d-----w c:\users\Abt computer\AppData\Roaming\SlipStream
2008-10-24 03:35 35,363 ----a-w c:\windows\System32\windrvNT.sys
2008-10-23 04:17 --------- d-----w c:\users\Abt computer\AppData\Roaming\WNR
2008-10-22 22:54 --------- d-----w c:\programdata\avg8
2008-10-22 19:42 --------- d-----w c:\program files\Windows Doctor
2008-10-21 19:27 --------- d-----w c:\program files\Total Video Converter
2008-10-21 03:12 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-19 19:21 --------- d-----w c:\programdata\Iomatic
2008-10-19 18:59 --------- d-----w c:\users\Abt computer\AppData\Roaming\Iomatic
2008-10-19 18:58 --------- d-----w c:\programdata\Kaspersky Lab
2008-10-18 03:13 --------- d-----w c:\users\Abt computer\AppData\Roaming\MyProxy
2008-10-18 01:57 --------- d-----w c:\programdata\Yahoo!
2008-10-16 22:36 --------- d-----w c:\programdata\Messenger Plus!
2008-10-16 04:23 --------- d-----w c:\program files\Windows Mail
2008-10-16 02:34 --------- d-----w c:\programdata\ma-config.com
2008-10-16 02:34 --------- d-----w c:\program files\ma-config.com
2008-10-15 01:59 --------- d-----w c:\users\Abt computer\AppData\Roaming\Hide IP NG
2008-10-14 13:04 572,512 ----a-w c:\windows\System32\msvcp50.dll
2008-10-04 04:27 --------- d-----w c:\program files\Ares
2008-10-02 19:31 --------- d-----w c:\users\Abt computer\AppData\Roaming\Nokia
2008-10-02 19:31 --------- d-----w c:\programdata\PC Suite
2008-10-02 19:23 --------- d-----w c:\users\Abt computer\AppData\Roaming\PC Suite
2008-10-02 19:00 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-02 02:07 --------- d-----w c:\users\Abt computer\AppData\Roaming\TERMINAL Studio
2008-10-02 02:06 --------- d-----w c:\users\Abt computer\AppData\Roaming\Astro Gemini Software
2008-09-30 13:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-27 16:31 --------- d-----w c:\programdata\PC Tools
2008-09-23 23:45 --------- d-----w c:\programdata\Kaspersky Lab Setup Files
2008-09-23 20:52 --------- d-----w c:\programdata\Norton
2008-09-22 00:20 43,520 ----a-w c:\windows\system32\drivers\fetnd6v.sys
2008-09-21 17:21 --------- d-----w c:\program files\Messenger Plus! Live
2008-09-21 17:10 --------- d-----w c:\programdata\WLInstaller
2008-09-21 17:05 --------- d-----w c:\program files\Windows Live
2008-09-21 00:31 --------- d-----w c:\program files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-09-20 23:03 --------- d-----w c:\programdata\NortonInstaller
2008-09-19 19:44 --------- d-----w c:\program files\Microsoft
2008-09-19 19:33 --------- d-----w c:\program files\Common Files\Windows Live
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-09-10 03:40 1,334,272 ----a-w c:\windows\System32\msxml6.dll
2008-09-05 05:14 1,191,936 ----a-w c:\windows\System32\msxml3.dll
2008-09-03 03:59 468,992 ----a-w c:\windows\System32\newdev.dll
2008-09-03 03:58 74,752 ----a-w c:\windows\System32\newdev.exe
2008-08-28 03:48 30,615 ----a-w c:\windows\Java\x.exe
2008-08-22 03:38 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-08-22 03:38 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-08-22 03:38 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-08-22 03:38 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-08-21 04:52 203,776 ----a-w c:\windows\System32\clrviddc.dll
2008-08-15 01:07 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [01/19/2008 10:33 AM 1233920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [08/14/2008 10:52 PM 185896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\startupfolder\C:^Users^Abt computer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^SBAMTray.exe]
backup=c:\windows\pss\SBAMTray.exe.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2741432412-2879953277-1256014084-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0E4E85D8-6226-44B4-BC1F-E279A3A1C876}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{E8D4CE3A-207F-480F-9DE4-25EF549A0022}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{B48DDE3E-C237-4A47-B241-C1F50F1322E6}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{98AE031C-B9DA-4FAC-9F1D-711C49A09A3F}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E67B1265-99F7-4065-AC9D-91B4104313E0}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{2652742C-3148-4580-8716-514BED65EF4C}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{A73561D1-B9E3-454F-9FC9-AC296C5B81DA}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"{0C60B9DF-5FB3-4A7A-AA02-542EBCBB1A60}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1B9112ED-933C-43FE-A067-08404BF64765}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{9B242958-05D5-40ED-B3B6-0687459300F5}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{81901D79-E88B-4FF8-A09C-622234E8BBFE}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{40468653-5B18-4E79-BCEA-BA859A176B9F}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"TCP Query User{5DC37869-6F09-46D0-A24F-E3A43811056D}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{1E06BF4D-326E-41C2-9BE4-A788EB18D7D7}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
"TCP Query User{E333D9F2-0BA5-4519-A4AB-C85D369C9BBD}c:\\program files\\rockstar games\\grand theft auto vice city\\gtatclient.exe"= UDP:c:\program files\rockstar games\grand theft auto vice city\gtatclient.exe:gtatclient
"UDP Query User{8754E2CD-D044-4486-9047-CB7D24D65E8D}c:\\program files\\rockstar games\\grand theft auto vice city\\gtatclient.exe"= TCP:c:\program files\rockstar games\grand theft auto vice city\gtatclient.exe:gtatclient
"TCP Query User{C8567A83-9B31-4E76-A430-9813F56AB781}c:\\program files\\rockstar games\\grand theft auto vice city\\gtat\\server\\gtatserver.exe"= UDP:c:\program files\rockstar games\grand theft auto vice city\gtat\server\gtatserver.exe:gtatserver
"UDP Query User{F7AC7784-A4B2-4595-839D-85C3A0034754}c:\\program files\\rockstar games\\grand theft auto vice city\\gtat\\server\\gtatserver.exe"= TCP:c:\program files\rockstar games\grand theft auto vice city\gtat\server\gtatserver.exe:gtatserver
"TCP Query User{5B64916D-5F58-4AFB-87E1-AC5F81FB35C9}c:\\windows\\system32\\jview.exe"= UDP:c:\windows\system32\jview.exe:Microsoft® VM Command Line Interpreter
"UDP Query User{90C3D0B0-307A-4121-A1B7-D1D9C45CA24E}c:\\windows\\system32\\jview.exe"= TCP:c:\windows\system32\jview.exe:Microsoft® VM Command Line Interpreter
"{0F722AF9-5637-4BD3-B268-09B3C8065BFE}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{940355EE-9D10-4EF0-B149-A92E70288DFC}"= UDP:c:\program files\MyProxy\MyProxy.exe:MyProxy
"{345ECADC-766C-49DC-8A59-3DB427A6AE56}"= TCP:c:\program files\MyProxy\MyProxy.exe:MyProxy
"{B5A8A966-9908-43A1-A774-54EB8B42F3C3}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{9E59C128-E46D-47EA-AFE1-B4AB3E1A1125}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{A6E42FE8-FE59-4591-B9BF-83A6F086988A}c:\\program files\\ares\\ares.exe"= UDP:c:\program files\ares\ares.exe:Ares p2p for windows
"UDP Query User{EBE31550-996B-4B8E-8742-2C4589F5D288}c:\\program files\\ares\\ares.exe"= TCP:c:\program files\ares\ares.exe:Ares p2p for windows
"TCP Query User{0BAAC193-348D-454D-85EF-243463B2E26F}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{D1AAC518-AD5C-4B42-A11F-8C2640FD2C48}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
R0 ViBus;ViBus;c:\windows\system32\DRIVERS\ViBus.sys [2008-08-14 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\DRIVERS\ViPrt.sys [2008-08-14 52224]
R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\system32\DRIVERS\fetnd6v.sys [2008-09-22 43520]
R3 S3GIGP;S3GIGP;c:\windows\system32\DRIVERS\VTGKModeDX32.sys [2008-10-26 791040]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-08-15 230912]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\system32\drivers\royal.sys [2008-08-17 240128]
.
s of the 'Scheduled Tasks' folder
2008-10-30 c:\windows\Tasks\User_Feed_Synchronization-{E7349B1D-7057-421F-BA56-EA29EB4FA43C}.job
- c:\windows\system32\msfeedssync.exe [01/19/2008 10:33 AM]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com.sa/
uInternet Settings,ProxyOverride = <local>
O16 -: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - hxxp://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_3_0.cab
c:\windows\Downloaded Program Files\hardwaredetection.inf
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-19 04:13:40
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\windows\System32\conime.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Photodex\ProShowGold\scsiaccess.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 11/19/2008 4:16:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-19 01:16:38
Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 5,966,389,248 bytes free
215 --- E O F --- 2008-11-17 23:47:44
k: