حملت الاداه وكأنها ماتشتغل والكاسبر شغال وسويت اكست للكاسبر واشتغلت الاداه
واعاد التشغيل
وهذا التقرير ComboFix 09-04-01.01 - Administrator 04/01/2009 2:09:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.1015.621 [GMT 3:00]
Running from: c:\documents and settings\Administrator\سطح المكتب\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Outdated)
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-31 23:14 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-03-31 23:12 811,040 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-03-31 23:12 5,948 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-03-31 23:12 32,028 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-03-31 23:12 3,558,944 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-03-31 22:32 --------- d-----w c:\program files\RogueRemover PRO
2009-03-31 22:27 2,015 ---h--r c:\windows\system32\drivers\hosts
2009-03-31 21:39 --------- d-----w c:\documents and settings\Administrator\Application Data\Delicious IE Extension
2009-03-31 21:16 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-31 21:04 --------- d-----w c:\program files\Trojan Remover
2009-03-31 21:00 --------- d-----w c:\documents and settings\All Users\Application Data\Simply Super Software
2009-03-31 21:00 --------- d-----w c:\documents and settings\Administrator\Application Data\Simply Super Software
2009-03-31 14:33 1,021,440 ----a-w c:\documents and settings\Administrator\Application Data\pcdefender.exe
2009-03-31 13:35 --------- d-----w c:\documents and settings\Administrator\Application Data\GetRightToGo
2009-03-30 11:53 --------- d-----w c:\documents and settings\Administrator\Application Data\cleaner
2009-03-23 22:10 --------- d-----w c:\documents and settings\Administrator\Application Data\DivX
2009-03-23 14:55 --------- d-----w c:\program files\onspeed_toolbar
2009-03-23 14:55 --------- d-----w c:\documents and settings\Administrator\Application Data\Uniblue
2009-03-23 14:55 --------- d-----w c:\documents and settings\Administrator\Application Data\SlipStream
2009-03-23 14:55 --------- d-----w c:\documents and settings\Administrator\Application Data\SBMAV Disk Cleaner
2009-03-23 14:55 --------- d-----w c:\documents and settings\Administrator\Application Data\Motive
2009-03-23 14:55 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2009-03-23 14:55 --------- d-----w c:\documents and settings\Administrator\Application Data\AdwareAlert
2009-03-23 13:48 --------- d-----w c:\documents and settings\Administrator\Application Data\Hide IP NG
2009-03-23 12:47 --------- d-----w c:\program files\Sonic.net Accelerator
2009-03-15 23:01 --------- d-----w c:\program files\Euler
2009-03-12 14:48 --------- d-----w c:\program files\Intel
2009-03-12 14:34 --------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-03-12 14:31 --------- dc-h--w c:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F}
2009-03-12 14:31 --------- d-----w c:\program files\Uniblue
2009-03-12 07:52 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-03-10 13:07 --------- d-----w c:\program files\Driver-Soft
2009-03-08 19:18 --------- d-----w c:\documents and settings\Guest\Application Data\Delicious IE Extension
2009-03-07 08:30 --------- d-----w c:\documents and settings\Guest\Application Data\HiYo
2009-03-07 00:45 --------- d-----w c:\documents and settings\Administrator\Application Data\HiYo
2009-03-05 22:00 --------- d-----w c:\program files\Google
2009-02-17 00:28 --------- d-----w c:\program files\Paltalk Messenger
2009-02-17 00:28 --------- d-----w c:\program files\moulin
2009-02-17 00:28 --------- d-----w c:\program files\Microsoft Visual Studio 8
2009-02-17 00:28 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-17 00:28 --------- d-----w c:\program files\Maxthon2
2009-02-17 00:28 --------- d-----w c:\program files\DivX
2009-02-17 00:28 --------- d-----w c:\program files\Avant Browser
2009-02-17 00:21 --------- d-----w c:\documents and settings\Administrator\Application Data\GlarySoft
2009-02-17 00:17 --------- d-----w c:\program files\Glary Utilities
2009-02-14 13:21 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-13 06:39 --------- d-----w c:\program files\Delicious Add-on for Internet Explorer
2009-02-12 13:15 --------- d-----w c:\program files\Bonjour
2009-02-12 13:12 --------- d-----w c:\program files\SBMAV Disk Cleaner 2009
2009-02-10 00:50 33,808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-02-03 06:06 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-02-03 06:06 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2008-12-26 13:20 18,081,280 ----a-w c:\windows\RTHDCPL.EXE
2006-12-12 08:13 32,768 ----a-w c:\documents and settings\All Users\Application Data\EBLib.dll
2006-07-28 13:25 19,456 ----a-w c:\documents and settings\All Users\Application Data\LPCFilter.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [08/05/2008 02:13 AM 1610264]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [04/23/2008 10:29 PM 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/04/2004 02:56 AM 15360]
"sysav"="c:\documents and settings\Administrator\Application Data\pcdefender.exe" [03/31/2009 05:33 PM 1021440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [02/10/2009 03:50 AM 206088]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [02/15/2009 04:53 PM 1214856]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^قائمة ابدأ^البرامج^بدء التشغيل^WinMySQLadmin.lnk]
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^قائمة ابدأ^البرامج^بدء التشغيل^خادم الجمل.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^SnagIt 8.lnk]
backup=c:\windows\pss\SnagIt 8.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AFProg]
--a------ 11/20/2006 11:19 AM 81920 c:\program files\AnchorFree\bin\ctrl\AFController.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/04/2004 02:56 AM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 10/27/2006 12:47 AM 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 11/03/2008 09:20 AM 166912 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 11/03/2008 09:20 AM 134656 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 10/13/2004 07:24 PM 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 04/23/2008 10:29 PM 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 11/03/2008 09:18 AM 134656 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 12/16/2008 04:14 AM 114688 c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeePassword]
--a------ 06/25/2005 06:18 PM 1347584 c:\program files\SeePassword\SeePassword.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 02/25/2008 09:41 AM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 06/19/2008 04:20 PM 57344 c:\windows\ALCMTR.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 08/04/2004 02:56 AM 110592 c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 12/26/2008 04:20 PM 18081280 c:\windows\RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Avant Browser\\avant.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
"56479:TCP"= 56479:TCP
ando P2P TCP Listening Port
"56479:UDP"= 56479:UDP
ando P2P UDP Listening Port
"56668:TCP"= 56668:TCP
ando P2P TCP Listening Port
"56668:UDP"= 56668:UDP
ando P2P UDP Listening Port
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808]
R1 GhPciScan;GhostPciScanner;c:\program files\Symantec\Norton Ghost 2003\GhPciScan.sys [2002-08-14 5632]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [2008-06-03 87264]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2008-03-03 264576]
S2 CamelApache;CamelApache;c:\camel\Apache\Apache.exe [2004-10-28 20545]
S2 gupdate1c939a82e5c88b8;Google Update Service (gupdate1c939a82e5c88b8);c:\program files\Google\Update\GoogleUpdate.exe [2008-10-29 133104]
S3 Asushwio;Asushwio;\??\g:\bin\Asushwio.sys --> g:\bin\Asushwio.sys [?]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [2008-09-05 100096]
S3 CAM1690;USB 2.0 Compliance JPEG Video Camera;c:\windows\system32\drivers\cam1690.sys [2006-11-15 103936]
S3 CamelMysql;CamelMysql;c:\camel\mysql\bin\mysqld-nt.exe --defaults-file="c:\camel\mysql\ini\my.ini" CamelMysql --> c:\camel\mysql\bin\mysqld-nt.exe --defaults-file=c:\camel\mysql\ini\my.ini [?]
S3 DCamUSBIntel;207 Video Camera;c:\windows\system32\drivers\TP6800.sys [2008-03-30 199004]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39e421bc-17f3-11de-b2f8-001644980fff}]
\Shell\AutoRun\command - H:\WDSetup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b76d38f5-f4b8-11dd-b208-001644980fff}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe Sgt.sys.vbs
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c24a6914-e313-11dc-b5fc-001e8cfd0a36}]
\Shell\AutoRun\command - G:\oufddh.exe
\Shell\explore\Command - G:\oufddh.exe
\Shell\open\Command - G:\oufddh.exe
.
Contents of the 'Scheduled Tasks' folder
2009-03-31 c:\windows\Tasks\AdwareAlert Scheduled Scan.job
- c:\program files\AdwareAlert\AdwareAlert.exe []
2009-03-31 c:\windows\Tasks\AdwareAlert Scheduled Scan.job
- c:\program files\AdwareAlert []
2009-03-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [08/29/2007 02:57 PM]
2009-03-31 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [02/12/2009 05:10 PM]
2009-03-31 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [10/29/2008 12:24 PM]
2009-02-12 c:\windows\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-1stopinst - (no file)
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = plimus.com;
uInternet Settings,ProxyServer = 212.116.219.52:80
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Download all links with IDM - c:\docume~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\docume~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\docume~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\Internet Download Manager\IEExt.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
TCP: {FDF4A9A9-0D34-4AE1-8BF8-EDF0F752F5DC} = 84.235.7.55,84.235.6.55
DPF: Microsoft XML Parser for Java -
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3cj3g58y.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://mystart.hiyo.com/?loc=ff_address&search=
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3cj3g58y.default\extensions\fotofox@mozilla.com\platform\WINNT_x86-msvc\components\mozFotofox.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Opera\program\plugins\NP_IDM1.dll
FF - plugin: c:\program files\Opera\program\plugins\NP_IDM2.dll
FF - plugin: c:\program files\Opera\program\plugins\NP_IDM3.dll
FF - plugin: c:\program files\Opera\program\plugins\NP_IDM4.dll
FF - plugin: c:\program files\Opera\program\plugins\NP_IDM5.dll
FF - plugin: c:\program files\Opera\program\plugins\NP_IDM6.dll
---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
FF - user.js: network.proxy.http_port - 0
FF - user.js: network.proxy.ssl -
FF - user.js: network.proxy.ssl_port - 0
FF - user.js: network.proxy.ftp -
FF - user.js: network.proxy.ftp_port - 0
FF - user.js: network.proxy.gopher -
FF - user.js: network.proxy.gopher_port - 0
FF - user.js: network.proxy.socks_version - 5
FF - user.js: network.proxy.socks -
FF - user.js: network.proxy.socks_port - 0
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFE0BD779-44EE-4A4B-AA2E-743C63F2E5E6", "AllAccess");
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
vbefile\shell\edit\command=c:\windows\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-01 02:15:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b7,0e,e7,a3,85,6a,89,00,15,e3,51,2c,69,b4,0f,45,b9,b8,65,c3,d6,
26,fa,c9,1b,92,59,a7,e6,4e,43,7e,d9,b7,cc,96,d2,eb,9a,a5,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):45,7a,38,98,fe,d0,74,7c,a4,28,92,cd,8c,e6,c3,9c,4e,05,0b,eb,1b,
25,47,75,00,89,c9,c0,b5,7d,d5,b7,b6,5b,73,b8,eb,c2,66,5c,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{8d5aaac9-4d23-4924-932b-d14f7d6f4709}]
@Denied: (Full) (Everyone)
"Model"=dword:000000d6
"Therad"=dword:00000002
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{e0fd2c45-9238-47b5-8341-a340ce570349}]
@Denied: (Full) (Everyone)
"Model"=dword:000000a4
"Therad"=dword:0000000f
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\agrsmsvc.exe
c:\appserv\apache\Apache.exe
c:\appserv\apache\Apache.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Symantec\Norton Ghost 2003\GhostStartService.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\appserv\mysql\bin\mysqld-nt.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 04/01/2009 2:18:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-31 23:18:08
ComboFix2.txt 2008-10-16 01:37:16
Pre-Run: 24,402,796,544 bytes free
Post-Run: 24,584,851,456 bytes free
310
مشكوور على تعبك معي
