اخواني هذا هو اخر تقرير
طلبتوووو ارجو اني ما اكون ضايقتكم
ComboFix 09-04-13.A2 - User 04/14/2009 2:03.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.1.1025.18.3061.1818 [GMT 3:00]
Running from: c:\users\User\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated)
FW: Kaspersky Internet Security *enabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.
2009-04-13 23:00 . 2006-03-02 20:42 73728 ----a-w C:\pv.exe
2009-04-13 00:42 . 2009-04-13 00:42 67 ----a-w c:\windows\swupdate.INI
2009-04-11 05:15 . 2009-04-11 05:15 680 ----a-w c:\users\User\AppData\Local\d3d9caps.dat
2009-03-18 13:24 . 2009-04-13 20:30 -------- d-----w c:\users\User\Tracing
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-13 22:59 . 2008-11-18 09:38 614432 --sha-w c:\windows\System32\drivers\fidbox2.dat
2009-04-13 22:59 . 2008-11-18 09:38 614432 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-13 22:59 . 2008-11-18 09:38 3180 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-13 22:55 . 2008-06-22 23:54 32768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2009-04-13 22:55 . 2008-06-22 23:54 32768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2009-04-13 22:55 . 2008-06-22 23:54 16384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2009-04-13 20:30 . 2008-11-18 09:38 -------- d-----w c:\programdata\Kaspersky Lab
2009-04-13 20:29 . 2009-04-13 20:29 2048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
2009-04-13 20:29 . 2009-04-13 20:29 2048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
2009-04-13 20:27 . 2008-11-18 09:38 4225568 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-13 20:27 . 2008-11-18 09:38 4225568 --sha-w c:\windows\System32\drivers\fidbox.dat
2009-04-13 20:27 . 2008-11-18 09:38 34092 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-13 00:42 . 2009-04-13 00:42 32768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012009041320090414\index.dat
2009-04-11 05:57 . 2008-11-18 09:38 -------- d-----w c:\program files\Kaspersky Lab
2009-04-11 05:41 . 2008-11-18 07:52 -------- d-----w c:\programdata\Kaspersky Lab Setup Files
2009-04-11 04:27 . 2008-09-02 19:29 -------- d-----w c:\program files\Paltalk Messenger
2009-04-11 04:21 . 2008-09-02 19:30 0 ----a-w C:\palsound.txt
2009-03-18 13:23 . 2008-11-14 18:06 -------- d-----w c:\program files\Windows Live
2009-03-18 13:22 . 2009-03-18 13:22 -------- d-----w c:\program files\Microsoft Sync Framework
2009-03-18 13:21 . 2009-03-18 13:21 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-03-18 13:19 . 2008-09-02 19:30 -------- d-----w c:\program files\MSN Messenger
2009-03-18 13:19 . 2009-03-18 13:19 -------- d-----w c:\program files\Microsoft
2009-03-18 13:18 . 2009-03-18 13:18 -------- d-----w c:\program files\Windows Live SkyDrive
2009-03-18 12:51 . 2009-03-18 12:51 -------- d-----w c:\program files\Common Files\Windows Live
2009-03-12 01:29 . 2006-11-02 11:18 -------- d-----w c:\program files\Windows Mail
2009-03-05 14:50 . 2009-03-05 14:50 -------- d-----w c:\program files\LtUcx
2009-03-05 12:30 . 2009-03-05 12:30 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-03-05 05:41 . 2009-01-22 02:18 -------- d-----w c:\program files\Hotspot_Shield
2009-02-14 06:11 . 2008-12-26 20:24 -------- d-----w c:\program files\Circle Developement
2009-02-13 19:48 . 2008-11-14 18:06 -------- d-----w c:\program files\Messenger Plus! Live
2009-02-09 03:10 . 2009-03-11 11:59 2033152 ----a-w c:\windows\System32\win32k.sys
2009-02-06 16:43 . 2009-02-06 16:43 307576 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\System32\sirenacm.dll
2009-01-22 02:18 . 2006-11-02 10:25 51200 ----a-w c:\windows\Inf\infpub.dat
2009-01-22 02:18 . 2006-11-02 10:25 143360 ----a-w c:\windows\Inf\infstrng.dat
2009-01-22 02:18 . 2006-11-02 10:25 86016 ----a-w c:\windows\Inf\infstor.dat
2009-01-15 06:11 . 2009-02-11 02:07 827392 ----a-w c:\windows\System32\wininet.dll
2008-11-14 15:53 . 2008-09-02 18:36 82720 ----a-w c:\users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2008-11-08 01:55 . 2008-11-08 01:55 0 ----a-w c:\users\User\AppData\Roaming\wklnhst.dat
2008-01-21 02:43 . 2006-11-02 12:50 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
02/06/2009 10:20 AM 204248 --a------ c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [02/06/2009 06:53 PM 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [02/10/2009 03:05 PM 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/14/2008 07:11 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [03/28/2007 01:58 AM 1744896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\
00TCrdMain]
--a------ 01/23/2008 12:25 AM 712704 c:\program files\TOSHIBA\FlashCards\TCrdMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
--a------ 02/10/2009 03:05 PM 206088 c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
--a------ 10/26/2007 03:41 AM 413696 c:\program files\Camera Assistant Software for Toshiba\traybar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 11/15/2008 03:43 AM 29744 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 02/05/2008 09:24 PM 154136 c:\windows\System32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HSON]
--a------ 11/01/2007 08:01 AM 54608 c:\program files\TOSHIBA\TBS\HSON.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 02/05/2008 09:24 PM 141848 c:\windows\System32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 12/05/2006 10:55 PM 54832 c:\program files\CyberLink\PowerDVD\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 02/06/2009 06:53 PM 3885408 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 03/23/2007 11:20 PM 227328 c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 02/05/2008 09:24 PM 129560 c:\windows\System32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 12/06/2006 06:37 PM 69216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
--a------ 06/16/2007 07:01 AM 448080 c:\program files\TOSHIBA\SmoothView\SmoothView.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StormCodec_Helper]
--a------ 11/26/2006 09:30 PM 97357 c:\program files\Ringz Studio\Storm Codec\StormSet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
--a------ 01/30/2008 03:38 AM 583048 c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 12/07/2007 04:12 AM 1029416 c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 11/14/2008 07:11 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]
--a------ 01/18/2008 02:27 AM 431456 c:\program files\TOSHIBA\Power Saver\TPwrMain.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 01/21/2008 05:23 AM 1008184 c:\program files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
--a------ 01/30/2008 04:51 AM 4911104 c:\windows\RtHDVCpl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-771492675-3648702646-1731262982-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{92F783FD-C622-4774-9E19-18A90739D683}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D8D9F61A-6376-469D-B023-1AD016BD9654}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{365A762E-21CF-4465-9FF6-45026B0EC949}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\english\setup.exe:Kaspersky Internet Security 2009 Setup
"UDP Query User{5D9E2F83-5E7B-433A-9C95-C315F1E884D6}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\english\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\english\setup.exe:Kaspersky Internet Security 2009 Setup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"= c:\toshiba\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\toshiba\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/15/2008 03:43 AM 29744]
R3 IO_Memory;IO_Memory; [x]
R3 SVRPEDRV;SVRPEDRV; [x]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [02/10/2009 03:05 PM 33808]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [07/09/2008 06:28 PM 20496]
S2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\CyberLink\PowerDVD\
000.fcl [11/02/2006 04:51 PM 13560]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [12/26/2007 12:07 AM 40960]
S2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [02/06/2009 12:56 AM 117208]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [01/14/2009 05:53 PM 226656]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [12/04/2007 03:03 AM 126976]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys [11/21/2006 01:11 AM 7168]
S3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\DRIVERS\HssDrv.sys [02/06/2009 12:55 AM 31704]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM 26640]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21ba3123-f464-11dd-beff-001e33468d0e}]
\shell\AutoRun\command - E:\pook.com
\shell\open\Command - E:\pook.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{379ebc5d-0c89-11de-a2b6-001e33468d0e}]
\shell\AutoRun\command - E:\pook.com
\shell\open\Command - E:\pook.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5cdd61a4-2773-11de-b800-001e33468d0e}]
\shell\AutoRun\command - E:\qphdin.com
\shell\open\Command - E:\qphdin.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0dceb43-d9b9-11dd-a058-001f3c79c56b}]
\shell\AutoRun\command - pook.com
\shell\open\Command - pook.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9f87b24-d05a-11dd-a2d5-001f3c79c56b}]
\shell\AutoRun\command - E:\m9ma.exe
\shell\explore\Command - E:\m9ma.exe
\shell\open\Command - E:\m9ma.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4D0D5672-AD6D-FB35-AB93-76A462C1960D}]
c:\users\User\AppData\Local\Temp\Rar$EX00.085\أهداء خاص.exe
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - (no file)
MSConfigStartUp-fffffffffff - c:\users\User\AppData\Local\Temp\Rar$EX00.085\أهداء خاص.exe
MSConfigStartUp-NDSTray - NDSTray.exe
MSConfigStartUp-TOSCDSPD - TOSCDSPD.EXE
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-14 02:07
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-771492675-3648702646-1731262982-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):9c,72,6c,cf,d2,58,5e,ca,17,7b,05,26,8e,b8,98,82,6a,aa,df,50,80,
88,4b,fe,3e,d2,63,57,e4,2a,b2,b4,c3,54,3d,3b,a2,7a,70,28,00,00,00,00,00,00,\
[HKEY_USERS\S-1-5-21-771492675-3648702646-1731262982-1000_Classes\CLSID\{9ba3bdb3-8a70-479c-ace0-a016c940a0d4}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000009
"Therad"=dword:00000001
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,6f,ef,ea,af,53,
75,5b,75,04,a3,b7,bd,5b,11,77,40,eb,e7,cf,e9,e1,3e,c9,2c,98,7a,d2,4e,a5,fe,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(11800)
c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_ara.nlr
c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
.
Completion time: 04/14/2009 2:09
ComboFix-quarantined-files.txt 2009-04-13 23:09
Pre-Run: 152,915,267,584 bytes free
Post-Run: 153,435,865,088 bytes free
233 --- E O F --- 2009-04-13 18:38
