بـارك الله فيك على المداخلـه ..
وهذا التقـرير ,,
ComboFix 08-09-10.04 - ANB 09/11/2008 19:03:42.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1256.1.1033.18.3161 [GMT 3:00]
Running from: C:\Users\ANB\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Users\ANB\FAVORI~1\-a68d~1.url
C:\Users\ANB\Favorites\-a68d~1.url
C:\Windows\system32\kakle.dll
C:\Windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-11 16:01 483,360 --sha-w C:\Windows\system32\drivers\fidbox2.dat
2008-09-11 16:01 30,240 --sha-w C:\Windows\system32\drivers\fidbox.idx
2008-09-11 16:01 3,780 --sha-w C:\Windows\system32\drivers\fidbox2.idx
2008-09-11 16:01 3,598,368 --sha-w C:\Windows\system32\drivers\fidbox.dat
2008-09-11 07:04 --------- d-----w C:\Program Files\ThemeEditor6600
2008-09-11 03:46 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-09-10 11:43 --------- d-----w C:\Program Files\Kelk 2000
2008-09-08 05:46 --------- d-----w C:\Program Files\InterbankFXTrader
2008-09-08 05:44 --------- d-----w C:\Program Files\Real Trader 4
2008-09-08 05:43 --------- d---a-w C:\ProgramData\TEMP
2008-09-08 04:49 --------- d-----w C:\Program Files\Interbank FX Trader 4
2008-09-07 01:49 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-09-05 17:12 174 --sha-w C:\Program Files\desktop.ini
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Sidebar
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Mail
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Journal
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Defender
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Collaboration
2008-09-05 17:06 --------- d-----w C:\Program Files\Windows Calendar
2008-09-05 15:46 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-09-05 15:46 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-09-05 06:48 --------- d-----w C:\ProgramData\Boob This First
2008-09-03 09:04 --------- d-----w C:\ProgramData\zyz Kaspersky Lab setup files
2008-09-03 05:29 96,976 ----a-w C:\Windows\system32\drivers\klin.dat
2008-09-03 05:29 87,855 ----a-w C:\Windows\system32\drivers\klick.dat
2008-09-03 05:01 --------- d-----w C:\Program Files\Kaspersky Lab
2008-09-03 04:54 --------- d-----w C:\ProgramData\Avira
2008-09-03 04:52 --------- d-----w C:\Program Files\BearShare
2008-09-01 00:19 --------- d-----w C:\ProgramData\Browse Dent Win Base
2008-09-01 00:18 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-01 00:18 --------- d-----w C:\Program Files\Boob This First
2008-08-30 22:53 --------- d-----w C:\Program Files\MessengerDiscovery
2008-08-30 11:22 --------- d-----w C:\Users\ANB\AppData\Roaming\Products
2008-08-30 11:22 --------- d-----w C:\Program Files\Mass Downloader
2008-08-29 08:44 --------- d-----w C:\Program Files\abrViewer.NET
2008-08-15 02:50 --------- d-----w C:\Users\ANB\AppData\Roaming\BSplayer
2008-08-15 02:49 --------- d-----w C:\Users\ANB\AppData\Roaming\BSplayer Pro
2008-08-15 02:49 --------- d-----w C:\Program Files\Webteh
2008-08-14 14:05 --------- d-----w C:\Users\ANB\AppData\Roaming\ATViewer
2008-08-14 14:02 --------- d-----w C:\Program Files\Universal Viewer
2008-08-14 00:09 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-08-14 00:09 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-08-14 00:09 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-08-14 00:09 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-08-14 00:08 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-08-14 00:06 827,392 ----a-w C:\Windows\System32\wininet.dll
2008-08-14 00:06 269,312 ----a-w C:\Windows\System32\es.dll
2008-08-14 00:04 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-08-14 00:04 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-08-14 00:03 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-08-14 00:03 738,304 ----a-w C:\Windows\System32\inetcomm.dll
2008-08-12 00:03 988,216 ----a-w C:\Windows\System32\winload.exe
2008-08-12 00:03 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-08-12 00:03 615,992 ----a-w C:\Windows\System32\ci.dll
2008-08-12 00:03 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-08-12 00:03 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-08-12 00:03 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-08-12 00:03 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-08-12 00:03 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-08-12 00:03 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-08-12 00:03 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-08-11 00:08 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-08-11 00:08 5,791,232 ----a-w C:\Windows\System32\NlsLexicons0026.dll
2008-08-11 00:08 5,499,904 ----a-w C:\Windows\System32\NlsLexicons0022.dll
2008-08-11 00:08 2,136,064 ----a-w C:\Windows\System32\NlsLexicons0021.dll
2008-08-11 00:08 1,808,896 ----a-w C:\Windows\System32\NlsLexicons0046.dll
2008-08-11 00:08 1,793,536 ----a-w C:\Windows\System32\NlsLexicons0045.dll
2008-08-11 00:08 1,782,272 ----a-w C:\Windows\System32\NlsLexicons0039.dll
2008-08-11 00:08 1,558,016 ----a-w C:\Windows\System32\NlsLexicons0049.dll
2008-08-11 00:08 1,411,072 ----a-w C:\Windows\System32\NlsLexicons0047.dll
2008-08-11 00:08 1,236,992 ----a-w C:\Windows\System32\NlsLexicons0020.dll
2008-08-11 00:05 29,184 ----a-w C:\Windows\system32\drivers\BTHUSB.SYS
2008-08-11 00:05 220,160 ----a-w C:\Windows\system32\drivers\bthport.sys
2008-08-11 00:05 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-08-11 00:05 19,456 ----a-w C:\Windows\system32\drivers\bthenum.sys
2008-08-11 00:05 181,760 ----a-w C:\Windows\System32\fsquirt.exe
2008-08-11 00:04 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-08-11 00:01 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-08-11 00:01 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-08-10 23:59 1,695,744 ----a-w C:\Windows\System32\gameux.dll
2008-08-10 23:57 --------- d-----w C:\Program Files\Microsoft Works
2008-08-10 23:54 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-08-10 23:54 293,376 ----a-w C:\Windows\System32\psisdecd.dll
2008-08-10 23:54 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-08-10 23:52 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-09 16:08 --------- d-----w C:\Users\ANB\AppData\Roaming\NSeries
2008-08-09 16:07 --------- d-----w C:\ProgramData\PC Suite
2008-08-09 12:06 --------- d-----w C:\ProgramData\Nokia
2008-08-09 12:06 --------- d-----w C:\Program Files\Nokia
2008-08-09 12:06 --------- d-----w C:\Program Files\Common Files\Nokia
2008-08-09 12:05 --------- d-----w C:\Users\ANB\AppData\Roaming\PC Suite
2008-08-09 12:05 --------- d-----w C:\Users\ANB\AppData\Roaming\Nokia
2008-08-09 12:04 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-08-09 12:03 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-08-02 01:01 625,152 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-08-01 07:37 --------- d-----w C:\Program Files\MSN Messenger
2008-07-31 07:35 --------- d-----w C:\Program Files\SourceTec
2008-07-31 07:35 --------- d-----w C:\Program Files\Common Files\SourceTec
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/18/2008 11:33 PM 1233920]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]
"Google Update"="C:\Users\ANB\AppData\Local\Google\Update\GoogleUpdate.exe" [09/03/2008 06:49 AM 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Win Base 4 Download"="C:\ProgramData\pop gpl bib.8mku5" [X]
"FlapProxy"="C:\ProgramData\NounWaitWait.g6emwas" [X]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [03/20/2007 09:36 AM 36864]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/27/2008 09:17 PM 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM 144784]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [08/02/2007 05:30 PM 3096576]
"pdfFactory Pro Dispatcher v3"="C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [11/05/2007 01:05 PM 507904]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [04/12/2007 12:07 PM 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [04/12/2007 12:07 PM 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [04/12/2007 12:07 PM 81920]
"RtHDVCpl"="RtHDVCpl.exe" [09/19/2007 09:50 AM 4702208 C:\Windows\RtHDVCpl.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
C:\Users\ANB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1471693877-3151001744-3831768042-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7E39032D-EE4C-4A0B-834A-3971D5EFFE85}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{9040D85E-C41C-490D-B120-1593BBFA28E3}C:\\program files\\messengerdiscovery\\messengerdiscovery live.exe"= UDP:C:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon
"UDP Query User{F1B34BCC-BBF3-4FF2-84E5-75D707E28C11}C:\\program files\\messengerdiscovery\\messengerdiscovery live.exe"= TCP:C:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon
"TCP Query User{BBBA9320-95CD-4A80-A7B8-CFE12972A24C}C:\\program files\\bearshare\\bearshare.exe"= UDP:C:\program files\bearshare\bearshare.exe:BearShare
"UDP Query User{FB6B065C-F2C9-4FEF-AC96-41D162660C02}C:\\program files\\bearshare\\bearshare.exe"= TCP:C:\program files\bearshare\bearshare.exe:BearShare
"{65C754CE-F176-46A3-AF94-7469D5E4AFDA}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
S0 klbg;Kaspersky Lab Boot Guard Driver;C:\Windows\system32\drivers\klbg.sys [01/29/2008 06:29 PM 32784]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [07/27/2008 07:32 PM 240128]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [03/26/2008 01:10 PM 20496]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\Windows\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM 26640]
S3 VST_DPV;VST_DPV;C:\Windows\system32\DRIVERS\VSTDPV3.SYS [11/02/2006 10:41 AM 987648]
S3 VSTHWBS2;VSTHWBS2;C:\Windows\system32\DRIVERS\VSTBS23.SYS [11/02/2006 10:41 AM 251904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e641acd-5bf8-11dd-a304-806e6f6e6963}]
\shell\AutoRun\command - E:\Run.exe
*Newly Created Service* - ECACHE
.
s of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
HKLM-RunOnce-<NO NAME> - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\ANB\AppData\Roaming\Mozilla\Firefox\Profiles\mz8qd4yj.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.sa/
FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - C:\Users\ANB\AppData\Local\Google\Update\1.2.131.11\npGoogleOneClick5.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-11 19:07:16
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 09/11/2008 19:07:55
ComboFix-quarantined-files.txt 2008-09-11 16:07:48
Pre-Run: The system cannot find message text for message number 0x2379 in the message file for Application.
Post-Run: 69,464,727,552 bytes free
198 --- E O F --- 2008-09-10 21:35:45
وبـس ..
