olhrwef.exe help.exe vamsoft.exe كيف اتخلص منها

[ReeNaa]

السلام عليكم

عندي مشكلة بدخل بها على طول دون مقدمات

olhrwef.exe

help.exe

vamsoft.exe

هذه مسميات لرسائل ( لقد صادف البرنامج مشكلة ويجب اغلاقه )

تطلع لي مع بداية تشغيل الجهاز اضافة الي التعليق المستمر

وابغى اعرف ايش تطلع بالزبط ؟ هل هي فايروسات ؟ اذن ايش البرنامج او الاداة الي بتخلصني منها

او انها تدخل على خلل في ملفات النظام ؟ بالتالي هل ينفع معاها الاصلاح ؟

للعلم الجهاز توه مفرمت الـ سي ماله كم يوم ومنزله عليه النود انتي فايروس

مالحل معاها بارك الله فيكم؟؟

علمونا مما علمكم الله

 

[MAAX]

الله يحييك اخوي
حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم

 

[ReeNaa]

يعطيك العافية اخي


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:51:34 م, on 20/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\WINDOWS\system32\ASUSTPE.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\P4P\P4P.exe
C:\WINDOWS\ASScrPro.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\ATK Hotkey\WDC.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\VIP\Desktop\Zyzoom_HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] "C:\Program Files\Wireless Console 2\wcourier.exe"
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ASUSTPE] C:\WINDOWS\system32\ASUSTPE.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ACMON] "C:\Program Files\ASUS\Splendid\ACMON.exe"
O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" update "Software\CyberLink\PowerProducer\4.0"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MultiFrame] C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
O4 - HKCU\..\Run: [Power2GoExpress] "C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 11033 bytes

 

[MAAX]

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة

 

[ReeNaa]

التقرير الجديد والذي ظهر بعد الانتعاء من الفحص واعادة التشغيل

ComboFix 09-04-21.A1 - VIP 04/21/2009 2:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1919.1406 [GMT -7:00]
Running from: c:\documents and settings\VIP\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\ej10fkdo.bat
c:\windows\AhnRpta.exe
c:\windows\system32\afmain0.dll
c:\windows\system32\ciuytr0.dll
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
C:\xcisvxl.com
D:\ej10fkdo.bat
D:\xcisvxl.com

.
((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 )))))))))))))))))))))))))))))))
.

2009-04-20 21:00 . 2009-04-20 21:00 118 ----a-w c:\windows\system32\MRT.INI
2009-04-20 20:49 . 2004-08-04 07:56 21504 -c--a-w c:\windows\system32\dllcache\hidserv.dll
2009-04-20 20:49 . 2004-08-04 07:56 21504 ----a-w c:\windows\system32\hidserv.dll
2009-04-20 20:48 . 2001-08-17 20:48 12160 -c--a-w c:\windows\system32\dllcache\mouhid.sys
2009-04-20 20:48 . 2001-08-17 20:48 12160 ----a-w c:\windows\system32\drivers\mouhid.sys
2009-04-20 20:48 . 2001-08-17 21:02 9600 -c--a-w c:\windows\system32\dllcache\hidusb.sys
2009-04-20 20:48 . 2001-08-17 21:02 9600 ----a-w c:\windows\system32\drivers\hidusb.sys
2009-04-19 21:04 . 2009-04-19 21:04 -------- d-----w c:\program files\Microsoft Sync Framework
2009-04-19 21:03 . 2006-11-29 20:06 3426072 ----a-w c:\windows\system32\d3dx9_32.dll
2009-04-19 21:03 . 2009-04-19 21:03 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-04-19 18:49 . 2009-04-19 18:49 -------- d-----w c:\windows\SxsCaPendDel
2009-04-17 17:48 . 2009-04-17 17:48 -------- d-----w c:\program files\GlobFX
2009-04-16 22:19 . 2009-04-16 22:19 -------- d-s---w c:\documents and settings\VIP\UserData
2009-04-16 20:55 . 2009-02-06 10:29 2142720 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-16 20:55 . 2009-02-06 10:32 2186112 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-16 20:55 . 2009-02-06 09:49 2020864 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-16 20:55 . 2009-02-06 09:49 2062976 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-04-16 19:54 . 2009-04-16 19:54 -------- d-----w c:\windows\Sun
2009-04-16 17:18 . 2008-10-24 11:10 453632 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-04-16 16:23 . 2009-04-17 20:30 108169 --sh--r C:\husyu8n.exe
2009-04-16 15:40 . 2008-06-13 13:10 272128 -c----w c:\windows\system32\dllcache\bthport.sys
2009-04-16 15:40 . 2008-06-13 13:10 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-04-16 15:19 . 2009-04-16 15:19 -------- d-----w c:\documents and settings\VIP\Application Data\Motive
2009-04-16 15:18 . 2009-04-16 15:19 -------- d-----w c:\program files\Fahess_Activation
2009-04-16 15:18 . 2009-04-16 15:18 -------- d-----w c:\program files\Common Files\Motive
2009-04-16 15:17 . 2009-04-16 15:17 -------- d-----w c:\documents and settings\All Users\Application Data\Motive
2009-04-16 09:40 . 2004-08-04 07:56 221184 ----a-w c:\windows\system32\wmpns.dll
2009-04-16 09:06 . 2009-04-21 04:28 98 ----a-w c:\windows\WirelessFTP.INI
2009-04-15 08:08 . 2009-04-15 08:08 -------- d-----w c:\documents and settings\VIP\Application Data\Apple Computer
2009-04-15 08:05 . 2009-04-15 08:05 -------- d-----w c:\documents and settings\All Users\Application Data\LightScribe
2009-04-15 08:02 . 2009-04-15 08:02 24 ----a-w c:\windows\ATKPF.ini
2009-04-15 07:58 . 2009-04-15 07:58 -------- d-----w c:\documents and settings\VIP\Application Data\CyberLink
2009-04-15 07:57 . 2008-10-16 21:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-04-15 07:57 . 2008-10-16 21:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-15 07:57 . 2008-10-16 21:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-04-15 07:56 . 2009-04-15 07:56 -------- d-----w c:\program files\Common Files\LightScribe
2009-04-15 07:55 . 2007-03-23 04:28 1053232 ------w c:\windows\system32\MFC71u.dll
2009-04-15 07:54 . 2007-03-23 04:28 1066544 ------w c:\windows\system32\MFC71.dll
2009-04-15 07:50 . 2007-01-09 05:17 27168 ------w c:\windows\system32\msxml3a.dll
2009-04-15 07:49 . 2009-04-15 07:49 -------- d-----w C:\MyWorks
2009-04-15 07:49 . 2009-04-15 07:55 -------- d-----w c:\program files\CyberLink
2009-04-15 07:47 . 2009-04-15 07:47 146650 ----a-w c:\windows\system32\BuzzingBee.wav
2009-04-15 07:47 . 2009-04-15 07:47 940794 ----a-w c:\windows\system32\LoopyMusic.wav
2009-04-15 07:47 . 2009-04-15 07:47 0 ----a-w c:\windows\tosOBEX.INI
2009-04-15 07:47 . 2004-08-04 06:07 6400 -c--a-w c:\windows\system32\dllcache\splitter.sys
2009-04-15 07:47 . 2004-08-04 06:07 6400 ----a-w c:\windows\system32\drivers\splitter.sys
2009-04-15 07:46 . 2009-04-15 07:46 -------- d-----w c:\documents and settings\VIP\Local Settings\Application Data\ATI
2009-04-15 07:46 . 2009-04-15 07:46 -------- d-----w c:\documents and settings\VIP\Application Data\ATI
2009-04-15 07:46 . 2009-04-15 07:46 -------- d-----w c:\documents and settings\VIP\Local Settings\Application Data\Toshiba
2009-04-15 07:46 . 2009-04-15 07:46 -------- d-----w c:\windows\system32\Lang
2009-04-15 07:46 . 2001-08-17 20:57 16128 -c--a-w c:\windows\system32\dllcache\modemcsa.sys
2009-04-15 07:46 . 2001-08-17 20:57 16128 ----a-w c:\windows\system32\drivers\MODEMCSA.sys
2009-04-15 07:42 . 2004-08-04 06:15 82944 ----a-w c:\windows\system32\drivers\wdmaud.sys
2009-04-15 07:42 . 2004-08-04 06:07 52864 ----a-w c:\windows\system32\drivers\DMusic.sys
2009-04-15 07:42 . 2001-08-17 21:00 54272 ----a-w c:\windows\system32\drivers\swmidi.sys
2009-04-15 07:42 . 2004-08-04 05:39 142464 ----a-w c:\windows\system32\drivers\aec.sys
2009-04-15 07:42 . 2004-08-04 06:07 171776 ----a-w c:\windows\system32\drivers\kmixer.sys
2009-04-15 07:42 . 2004-08-04 06:07 2944 ----a-w c:\windows\system32\drivers\drmkaud.sys
2009-04-15 07:42 . 2004-08-04 06:15 60800 ----a-w c:\windows\system32\drivers\sysaudio.sys
2009-04-15 07:41 . 2009-04-15 07:41 37232 ----a-w c:\windows\ASScrProlog.exe
2009-04-15 07:41 . 2009-04-15 07:41 33136 ----a-w c:\windows\ASScrPro.exe
2009-04-15 07:41 . 2009-04-15 07:41 4499453 ----a-w c:\windows\ASUS Camera ScreenSaver.exe
2009-04-15 07:41 . 2009-04-15 07:41 274800 ----a-w c:\windows\ASUS Camera ScreenSaver Uninstaller.exe
2009-04-15 07:41 . 2009-04-15 07:41 503808 ----a-w c:\windows\Asus_Camera_ScreenSaver.scr
2009-04-15 07:41 . 2009-04-15 07:41 -------- d-----w c:\windows\Asus_Camera_ScreenSaver dir
2009-04-15 07:41 . 2009-04-15 07:41 606848 ----a-w c:\windows\flashax.exe
2009-04-15 07:41 . 2009-04-15 07:41 12288 ----a-w c:\windows\impborl.dll
2009-04-15 07:39 . 2009-04-14 13:52 100672 ----a-w c:\documents and settings\VIP\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-15 07:39 . 2009-04-15 07:39 -------- d-----w c:\program files\P4P
2009-04-15 07:38 . 2009-04-15 04:18 -------- d-----w c:\documents and settings\VIP\Local Settings\Application Data\Adobe
2009-04-15 07:37 . 2009-04-21 04:21 -------- d-----w c:\program files\Common Files\Adobe
2009-04-15 07:37 . 2005-07-06 22:43 155648 ----a-w c:\windows\system32\ACEngSvr.exe
2009-04-15 07:36 . 2006-08-16 22:56 32768 ----a-w c:\windows\system32\TPESetting.dll
2009-04-15 07:36 . 2007-01-16 23:13 106496 ----a-w c:\windows\system32\ASUSTPE.exe
2009-04-15 07:35 . 2009-04-15 07:40 -------- d-----w c:\program files\ASUS
2009-04-15 07:33 . 2007-10-29 20:47 23501 ----a-w c:\windows\system32\net5211.cat
2009-04-15 07:33 . 2007-10-26 09:20 549184 ----a-w c:\windows\system32\drivers\ar5211.sys
2009-04-15 07:33 . 2007-10-26 09:20 549184 ----a-w c:\windows\system32\ar5211.sys
2009-04-15 07:33 . 2007-10-26 09:20 100996 ----a-w c:\windows\system32\net5211.inf
2009-04-15 07:33 . 2009-04-15 07:33 -------- d-----w C:\temp
2009-04-15 07:33 . 2009-04-15 07:33 -------- d-----w c:\documents and settings\All Users\Application Data\Atheros
2009-04-15 07:31 . 2007-06-11 21:25 41856 ----a-w c:\windows\system32\drivers\tosrfusb.sys
2009-04-15 07:31 . 2007-04-24 20:20 113920 ----a-w c:\windows\system32\drivers\tosrfbd.sys
2009-04-15 07:31 . 2007-03-01 23:53 73728 ----a-w c:\windows\system32\drivers\Tosrfhid.sys
2009-04-15 07:31 . 2006-11-21 00:55 36480 ----a-w c:\windows\system32\drivers\tosrfbnp.sys
2009-04-15 07:31 . 2005-01-06 20:42 18612 ----a-w c:\windows\system32\drivers\tosrfnds.sys
2009-04-15 07:31 . 2009-04-15 07:31 -------- dc----w c:\windows\system32\DRVSTORE
2009-04-15 07:31 . 2007-05-24 21:27 64000 ----a-w c:\windows\system32\drivers\tosrfcom.sys
2009-04-15 07:31 . 2006-10-11 02:33 41600 ----a-w c:\windows\system32\drivers\tosporte.sys
2009-04-15 07:30 . 2009-04-15 07:30 -------- d-----w c:\program files\Toshiba
2009-04-15 07:30 . 2009-04-15 07:30 -------- d-----w c:\program files\Wireless Console 2
2009-04-15 07:29 . 2007-09-15 01:22 371 ----a-r c:\windows\Uninstvga.bat
2009-04-15 07:29 . 2007-09-15 01:22 372 ----a-r c:\windows\Uninstsxga.bat
2009-04-15 07:29 . 2007-09-15 01:01 386 ----a-r c:\windows\Uninstsxga.reg
2009-04-15 07:29 . 2007-09-15 01:01 384 ----a-r c:\windows\Uninstvga.reg
2009-04-15 07:29 . 2007-09-11 08:10 303104 ----a-r c:\windows\system32\vsnp2uvc.dll
2009-04-15 07:29 . 2007-10-01 06:59 1769984 ----a-r c:\windows\system32\drivers\snp2uvc.sys
2009-04-15 07:29 . 2007-05-09 07:16 28160 ----a-r c:\windows\system32\drivers\sncduvc.sys
2009-04-15 07:29 . 2006-11-23 14:20 11776 ----a-r c:\windows\DrvInst.exe
2009-04-15 07:29 . 2006-06-10 07:07 27520 ----a-w c:\windows\system32\drivers\RTSTOR.sys
2009-04-15 07:29 . 2004-07-06 04:07 83968 ----a-w c:\windows\system\DriveIcon.dll
2009-04-15 07:28 . 2006-05-25 12:03 69721 ----a-w c:\windows\system32\SynTPFcs.dll
2009-04-15 07:28 . 2006-05-25 12:06 81920 ----a-w c:\windows\system32\SynTPCo2.dll
2009-04-15 07:28 . 2006-05-25 11:46 94297 ----a-w c:\windows\system32\SynTPAPI.dll
2009-04-15 07:28 . 2006-05-25 11:45 114688 ----a-w c:\windows\system32\SynCtrl.dll
2009-04-15 07:28 . 2006-05-25 11:45 82012 ----a-w c:\windows\system32\SynCOM.dll
2009-04-15 07:28 . 2006-05-25 11:40 193088 ----a-w c:\windows\system32\drivers\SynTP.sys
2009-04-15 07:28 . 2009-04-15 07:28 -------- d-----w c:\program files\Synaptics
2009-04-15 07:27 . 2006-11-22 09:31 196608 ----a-r c:\windows\system32\sm56co6a.dll
2009-04-15 07:27 . 2006-11-22 09:35 982272 ----a-r c:\windows\system32\drivers\smserial.sys
2009-04-15 07:27 . 2009-04-15 07:27 -------- d-----w c:\program files\Motorola
2009-04-15 07:27 . 2007-08-21 08:50 30208 ----a-r c:\windows\system32\drivers\l251x86.sys
2009-04-15 07:27 . 2009-04-15 07:27 -------- d-----w c:\windows\system32\Atheros_L2
2009-04-15 07:26 . 2006-08-01 07:02 49152 ------r c:\windows\system32\ChCfg.exe
2009-04-15 07:26 . 2009-04-15 07:26 -------- d-----w c:\program files\Realtek
2009-04-15 07:26 . 2006-09-12 06:34 499712 ------r c:\windows\RtlExUpd.dll
2009-04-15 07:16 . 2009-04-15 07:16 -------- d-----w c:\program files\ATKOSD2
2009-04-15 07:14 . 2008-07-09 07:38 26488 ----a-w c:\windows\system32\spupdsvc.exe
2009-04-15 07:14 . 2009-04-15 07:14 -------- d-----w c:\program files\ATK Hotkey
2009-04-15 07:14 . 2009-04-14 20:14 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-15 07:14 . 2009-04-15 07:14 -------- d-----w c:\documents and settings\VIP\Application Data\InstallShield
2009-04-15 07:14 . 2007-08-24 03:46 5760 ----a-r c:\windows\system32\drivers\ATKACPI.sys
2009-04-15 07:05 . 2001-08-23 04:59 57344 ----a-w c:\windows\system32\WMErrAra.dll
2009-04-15 07:05 . 2001-08-19 00:58 34356 ----a-w c:\windows\WMPrfAra.prx
2009-04-15 07:03 . 2009-04-15 07:03 -------- d-s---w c:\windows\system32\Microsoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-19 21:04 . 2009-04-14 13:56 -------- d-----w c:\program files\Windows Live
2009-04-19 18:09 . 2009-04-14 14:02 -------- d-----w c:\documents and settings\All Users\Application Data\save time iso data
2009-04-17 08:56 . 2009-04-14 13:29 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-15 07:40 . 2009-04-15 07:14 90 ----a-w C:\setup.log
2009-04-15 07:34 . 2009-04-15 07:34 -------- d-----w c:\program files\Atheros
2009-04-15 07:26 . 2009-04-15 07:26 398 ----a-w C:\RHDSetup.log
2009-04-15 07:23 . 2009-04-15 07:16 -------- d-----w c:\program files\ATI Technologies
2009-04-15 07:17 . 2009-04-15 07:16 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-15 07:13 . 2004-08-04 05:59 250048 --sha-r C:\ntldr
2009-04-15 07:10 . 2009-04-15 07:10 286720 ----a-w C:\Debug.txt
2009-04-15 07:07 . 2009-04-15 06:58 166455 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-15 06:59 . 2009-04-15 06:59 -------- d-----w c:\program files\microsoft frontpage
2009-04-15 06:55 . 2009-04-15 06:55 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-15 04:17 . 2009-04-15 04:17 -------- d-----w c:\documents and settings\All Users\Application Data\IM
2009-04-15 04:17 . 2009-04-15 04:16 -------- d-----w c:\program files\IncrediMail
2009-04-15 04:16 . 2009-04-15 04:16 -------- d-----w c:\documents and settings\All Users\Application Data\IncrediMail
2009-04-15 04:06 . 2009-04-15 04:06 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-04-15 03:01 . 2009-04-15 03:01 -------- d-----w c:\program files\Common Files\Java
2009-04-15 02:49 . 2009-04-15 02:49 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-15 02:43 . 2009-04-15 02:43 -------- d-----w c:\program files\Common Files\xing shared
2009-04-15 02:42 . 2009-04-15 02:36 -------- d-----w c:\program files\Common Files\Real
2009-04-15 02:42 . 2009-04-15 02:42 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-15 02:42 . 2009-04-15 02:42 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-15 02:37 . 2009-04-15 02:36 -------- d-----w c:\program files\Real
2009-04-15 02:34 . 2009-04-15 02:34 -------- d-----w c:\documents and settings\VIP\Application Data\Media Player Classic
2009-04-15 02:34 . 2009-04-15 02:32 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-15 02:29 . 2009-04-15 02:29 -------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-04-15 02:29 . 2009-04-15 02:29 -------- d-----w c:\program files\Google
2009-04-15 02:23 . 2009-04-15 02:23 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-04-14 23:59 . 2009-04-14 23:59 -------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-04-14 13:57 . 2009-04-14 13:57 -------- d-----w c:\program files\Microsoft
2009-04-14 13:56 . 2009-04-14 13:56 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-14 13:34 . 2009-04-14 13:34 -------- d-----w c:\program files\Microsoft Works
2009-04-14 13:34 . 2009-04-14 13:34 -------- d-----w c:\program files\MSBuild
2009-04-14 13:33 . 2009-04-14 13:33 -------- d-----w c:\program files\Microsoft.NET
2009-04-14 13:31 . 2009-04-14 13:31 -------- d-----w c:\program files\Microsoft Visual Studio 8
2009-04-14 13:26 . 2009-04-14 13:25 -------- d-----w c:\program files\QuickTime
2009-04-14 13:25 . 2009-04-14 13:25 -------- d-----w c:\program files\Common Files\Apple
2009-04-14 13:25 . 2009-04-14 13:25 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-14 13:25 . 2009-04-14 13:25 -------- d-----w c:\program files\Apple Software Update
2009-04-14 13:25 . 2009-04-14 13:25 -------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-04-14 13:18 . 2009-04-14 13:18 -------- d-----w c:\program files\Java
2009-03-06 14:00 . 2004-08-04 07:56 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-20 08:30 . 2004-08-04 07:56 659456 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:30 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 10:19 . 2004-08-04 06:17 1846272 ----a-w c:\windows\system32\win32k.sys
2009-02-09 10:01 . 2004-08-04 07:56 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:01 . 2004-08-04 07:56 728576 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:01 . 2004-08-04 07:56 617984 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:01 . 2004-08-04 07:56 715264 ----a-w c:\windows\system32\ntdll.dll
2009-02-07 02:43 . 2009-02-07 02:43 307576 ----a-w c:\windows\WLXPGSS.SCR
2009-02-07 01:52 . 2009-02-07 01:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 10:29 . 2004-08-04 06:18 2142720 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:22 . 2004-08-04 07:56 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 09:54 . 2001-10-05 00:16 35328 ----a-w c:\windows\system32\sc.exe
2009-02-06 09:49 . 2004-08-03 22:59 2020864 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 20:08 . 2004-08-04 07:56 55808 ----a-w c:\windows\system32\secur32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"MultiFrame"="c:\program files\ASUS\Asus MultiFrame\MultiFrame.exe" [2007-06-21 999792]
"Power2GoExpress"="c:\program files\CyberLink\Power2Go\Power2GoExpress.exe" [2008-03-18 2508072]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-19 68856]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-03-31 251264]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-07-12 225280]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-10-18 7737344]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"ACU"="c:\program files\Atheros\ACU.exe" [2007-10-24 376921]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2007-01-16 106496]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-27 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-07-10 851968]
"PowerForPhone"="c:\program files\P4P\P4P.exe" [2007-07-19 778240]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2009-04-15 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-04-15 33136]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2008-04-03 87336]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2008-02-22 62760]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-15 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-10-30 16269312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\VIP\Start Menu\Programs\Startup\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-22 2756608]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-4-14 389120]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-15 226656]
S3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\DRIVERS\l251x86.sys [2007-08-21 30208]
S3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2007-07-04 57344]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6eb529da-2a64-11de-9c3a-0022154c4b9d}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96f191aa-2b71-11de-9c46-0022154c4b9d}]
\Shell\AutoRun\command - G:\husyu8n.exe
\Shell\open\Command - G:\husyu8n.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Supplementary Scan -------
.
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\VIP\Application Data\Mozilla\Firefox\Profiles\ayjs7nzx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-04-21 02:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1328)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1292)
c:\program files\ASUS\Asus MultiFrame\HookTitle.dll
c:\windows\system32\msi.dll
c:\program files\IncrediMail\bin\B4ImApp.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\acs.exe
c:\windows\system32\ACEngSvr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\progra~1\WinZip\WZQKPICK.EXE
c:\program files\ATK Hotkey\ATKOSD.exe
c:\program files\IncrediMail\bin\ImApp.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ATK Hotkey\KBFiltr.exe
c:\program files\ATK Hotkey\WDC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
c:\windows\system32\wscntfy.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
.
**************************************************************************
.
Completion time: 2009-04-21 3:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-21 10:03

Pre-Run: 118,902,747,136 bytes free
Post-Run: 119,358,033,920 bytes free

342 --- E O F --- 2009-04-20 21:00


للعلم قمت بتثبيت احد التحديثات التلقائية الخاصة بوندوز (اداة .... لازالة البرامج الضارة)
وبعد عمل اعادة تشغيل للجهاز اختفت رسائل الخطا الثلاثة تماما
لكن بقيت رسالة واحدة تظهر عند غلق الجهاز : (فشل في تطبيق النظام .... )

 

[فارس الملاك]

ممكن تقرير هايجاك جديد

 

[ReeNaa]

تقرير هايجاك جديد ..

بس ايش السالفة ،لهالدرجة المشكلة مو واضحة !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:53:39 ص, on 21/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
C:\WINDOWS\system32\ASUSTPE.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\P4P\P4P.exe
C:\WINDOWS\ASScrPro.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\ATK Hotkey\WDC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\VIP\Desktop\Zyzoom_HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] "C:\Program Files\Wireless Console 2\wcourier.exe"
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [ASUSTPE] C:\WINDOWS\system32\ASUSTPE.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ACMON] "C:\Program Files\ASUS\Splendid\ACMON.exe"
O4 - HKLM\..\Run: [PowerForPhone] "C:\Program Files\P4P\P4P.exe"
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" update "Software\CyberLink\PowerProducer\4.0"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [MultiFrame] C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
O4 - HKCU\..\Run: [Power2GoExpress] "C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe" /Startup
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 10150 bytes

 

[LINEZERO]

عساك على القوه اخوي فارس