وهاي تقرير الكوم فيكس
ComboFix 09-04-22.A23 - ahmad 04/23/2009 10:56.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.239.79 [GMT 2:00]
Running from: c:\documents and settings\ahmad\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
c:\windows\system32\logondll.dll
.
((((((((((((((((((((((((( Files Created from 2009-03-23 to 2009-04-23 )))))))))))))))))))))))))))))))
.
2009-04-22 12:18 . 2009-04-22 12:18 -------- d-----w c:\documents and settings\Administrator\Application Data\URSoft
2009-04-22 12:09 . 2009-04-22 12:09 -------- d-----w c:\documents and settings\system
2009-04-22 05:43 . 2007-01-18 09:51 11136 ----a-r c:\windows\system32\drivers\88XAxbar.sys
2009-04-22 05:43 . 2008-04-10 06:01 41856 ----a-r c:\windows\system32\drivers\88xBDATune.sys
2009-04-22 05:43 . 2007-01-18 09:39 17408 ----a-r c:\windows\system32\drivers\88XBDAIR.sys
2009-04-22 05:42 . 2007-01-18 09:42 22784 ----a-r c:\windows\system32\drivers\88xBDACap.sys
2009-04-22 05:42 . 2007-01-18 09:57 169344 ----a-r c:\windows\system32\drivers\88xAStream.sys
2009-04-22 05:33 . 2003-03-21 11:37 16056 ----a-w c:\windows\system32\owcstp16.dll
2009-04-22 05:24 . 2009-04-22 05:24 -------- d-----w c:\documents and settings\ahmad\Application Data\URSoft
2009-04-19 11:43 . 2009-04-19 11:43 50176 ----a-w c:\windows\uninstyler.exe
2009-04-17 09:53 . 2009-04-17 09:53 -------- d-----w c:\documents and settings\ahmad\Local Settings\Application Data\Ahead
2009-04-16 07:56 . 2009-04-16 07:56 -------- d-----w c:\documents and settings\system\system
2009-04-14 14:17 . 2009-04-14 14:17 7372189 ----a-w C:\Persi0.sys
2009-04-14 11:23 . 2009-04-14 11:23 -------- d-----w c:\documents and settings\ahmad\Application Data\CyberLink
2009-04-12 11:02 . 2009-04-12 11:01 720896 ----a-w c:\windows\iun6002.exe
2009-04-11 13:49 . 2009-04-11 13:49 75 ----a-w c:\windows\WININIT.INI
2009-04-11 10:48 . 2002-12-27 01:27 241664 ----a-r c:\windows\system32\OLD3.tmp
2009-04-10 16:58 . 2009-04-10 16:58 -------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-04-10 16:58 . 2009-04-10 16:58 -------- d-----w c:\documents and settings\ahmad\Application Data\GRETECH
2009-04-10 15:28 . 2009-04-10 15:28 -------- d-----w c:\documents and settings\ahmad\Application Data\COWON
2009-04-10 14:58 . 2009-04-10 14:58 -------- d--h--w C:\AUTORUN.INF
2009-04-09 20:35 . 2009-04-09 20:35 -------- d-----w c:\documents and settings\ahmad\Contacts
2009-04-09 20:34 . 2009-04-09 20:34 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-09 20:03 . 2009-04-09 20:03 -------- d-----w c:\documents and settings\ahmad\Application Data\ESET
2009-04-09 20:01 . 2009-04-09 20:01 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-04-09 16:49 . 2009-04-09 16:49 -------- d-sh--w C:\Recycled
2009-04-09 16:40 . 2009-04-17 09:50 69 ----a-w c:\windows\NeroDigital.ini
2009-04-09 15:47 . 2004-08-03 22:55 21504 ----a-w c:\windows\system32\hidserv.dll
2009-04-09 15:44 . 1998-05-31 00:00 72704 ----a-w c:\windows\system32\ODBCTL32.dll
2009-04-09 15:39 . 2009-04-09 15:42 615 ----a-w c:\windows\eReg.dat
2009-04-09 15:32 . 1979-12-31 22:00 10298 ----a-w c:\windows\CODER.DAT
2009-04-09 15:28 . 2009-04-09 15:28 -------- d-----w c:\documents and settings\ahmad\Application Data\Media Player Classic
2009-04-09 15:27 . 2009-04-09 15:27 -------- d-----w C:\earab
2009-04-09 15:23 . 2009-04-09 15:23 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-09 15:23 . 2009-04-09 15:23 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-09 15:17 . 2009-04-09 15:17 -------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-04-09 15:16 . 2004-03-02 15:37 125184 ------w c:\windows\system32\drivers\imagesrv.sys
2009-04-09 15:16 . 2004-03-02 15:37 5504 ------w c:\windows\system32\drivers\imagedrv.sys
2009-04-09 15:16 . 2000-06-26 09:45 106496 ----a-w c:\windows\system32\TwnLib20.dll
2009-04-09 15:16 . 2004-07-26 15:16 476320 ------w c:\windows\system32\ImagXpr7.dll
2009-04-09 15:16 . 2004-07-26 15:16 471040 ------w c:\windows\system32\ImagXRA7.dll
2009-04-09 15:16 . 2004-07-26 15:16 262144 ------w c:\windows\system32\ImagXR7.dll
2009-04-09 15:16 . 2004-07-26 15:16 1568768 ------w c:\windows\system32\ImagX7.dll
2009-04-09 15:16 . 2001-07-09 09:50 217088 ----a-w c:\windows\system32\NeroCheck.exe
2009-04-09 15:10 . 2009-04-09 15:10 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-09 15:08 . 2009-04-09 15:08 172 ---ha-w C:\sqmnoopt02.sqm
2009-04-09 15:08 . 2009-04-09 15:08 172 ---ha-w C:\sqmdata02.sqm
2009-04-09 15:08 . 2009-04-09 15:08 172 ---ha-w C:\sqmnoopt01.sqm
2009-04-09 15:08 . 2009-04-09 15:08 172 ---ha-w C:\sqmdata01.sqm
2009-04-09 15:08 . 2009-04-09 15:08 268 ---ha-w C:\sqmdata00.sqm
2009-04-09 15:08 . 2009-04-09 15:08 244 ---ha-w C:\sqmnoopt00.sqm
2009-04-09 15:05 . 2009-04-09 15:05 -------- d-----w c:\windows\system32\DRVSTORE
2009-04-09 14:56 . 2005-05-25 08:56 507904 ----a-w c:\windows\system32\JetMPVx.dll
2009-04-09 14:51 . 2009-04-09 14:51 -------- d-----w c:\windows\system32\embedded
2009-04-09 14:46 . 2009-04-09 14:46 123 ----a-w c:\windows\GAMEGEN.INI
2009-04-09 14:43 . 2009-04-09 14:43 -------- d-----w c:\documents and settings\ahmad\Local Settings\Application Data\Adobe
2009-04-09 14:42 . 2009-04-09 14:42 43 ----a-w c:\windows\LTNHELP.INI
2009-04-09 14:38 . 2009-04-14 13:59 1555 ----a-w c:\windows\ata live update.ini
2009-04-09 14:36 . 2009-04-09 14:36 -------- d-----w c:\windows\speech
2009-04-09 14:08 . 2004-08-03 21:08 26496 ----a-w c:\windows\system32\dllcache\usbstor.sys
2009-04-09 14:06 . 1997-11-19 13:49 303616 ----a-w c:\windows\IsUninst.exe
2009-04-09 14:05 . 2009-04-09 14:05 7056 ----a-w c:\windows\system\SPEAKER.DRV
2009-04-09 14:05 . 2009-04-09 14:05 15600 ----a-w c:\windows\system\MSADPCM.ACM
2009-04-09 14:05 . 2009-04-09 14:05 143 ----a-w c:\windows\QURAN.INI
2009-04-09 14:05 . 2009-04-09 14:05 10320 ----a-w c:\windows\system\IMAADPCM.ACM
2009-04-09 14:04 . 2009-04-09 14:42 967 ----a-w c:\windows\hadith.ini
2009-04-09 14:04 . 2009-04-09 14:05 45 ----a-w c:\windows\minipad.ini
2009-04-09 14:04 . 2009-04-09 14:05 -------- d-----w C:\MINIPAD
2009-04-09 14:04 . 2009-04-09 14:05 -------- d-----w C:\HADITH
2009-04-09 14:04 . 2009-04-09 14:05 -------- d-----w c:\documents and settings\ahmad\WINDOWS
2009-04-09 14:01 . 2000-04-29 16:43 90112 ----a-w c:\windows\system32\MBLink.ocx
2009-04-09 14:00 . 2009-04-09 14:00 7168 --sha-w c:\windows\Thumbs.db
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 08:57 . 2001-09-19 10:00 40118 ----a-w c:\windows\system32\perfc001.dat
2009-04-23 08:57 . 2001-09-19 10:00 251674 ----a-w c:\windows\system32\perfh001.dat
2009-04-22 12:40 . 2009-04-09 15:13 196608 ----a-w c:\windows\system32\maag.dll
2009-04-22 12:40 . 2009-04-09 15:13 1245184 ----a-w c:\windows\system32\bkll.dll
2009-04-22 12:40 . 2009-04-09 15:13 1212416 ----a-w c:\windows\system32\ckll.dll
2009-04-22 12:40 . 2009-04-09 15:13 90112 ----a-w c:\windows\system32\agsaami.dll
2009-04-22 12:40 . 2009-04-09 15:13 610304 ----a-w c:\windows\system32\agsaamg.dll
2009-04-22 12:40 . 2009-04-09 15:13 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-04-22 12:40 . 2009-04-09 15:13 2535424 ----a-w c:\windows\system32\agsaamj.dll
2009-04-22 12:40 . 2009-04-09 15:13 1986560 ----a-w c:\windows\system32\akll.dll
2009-04-22 12:40 . 2009-04-22 12:40 -------- d-----w c:\program files\Real_SC
2009-04-22 12:06 . 2009-04-22 12:06 -------- d-----w c:\program files\Unlocker
2009-04-22 05:58 . 2009-04-22 05:57 -------- d-----w c:\program files\Vista Drive Icon
2009-04-22 05:46 . 2009-04-22 05:46 -------- d-----w c:\program files\GTA_Myriad_Islands.CPR
2009-04-22 05:24 . 2009-04-22 05:24 -------- d-----w c:\program files\Your Uninstaller! 2006 PRO
2009-04-19 11:43 . 2009-04-19 11:43 -------- d-----w c:\program files\منبه الذاكرين
2009-04-16 13:16 . 2009-04-09 13:33 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-15 14:39 . 2009-04-15 14:39 -------- d-----w c:\program files\PC-TV
2009-04-14 14:17 . 2009-04-14 14:17 -------- d-----w c:\program files\HyperTechnologies
2009-04-14 14:17 . 2009-04-09 17:30 0 ----a-w C:\dfinstall.log
2009-04-14 14:13 . 2009-04-09 13:38 2048 --s-a-w c:\windows\bootstet.dat
2009-04-14 14:11 . 2009-04-14 14:11 -------- d-----w c:\program files\Common Files\Panda Security
2009-04-12 11:01 . 2009-04-12 11:01 -------- d-----w c:\program files\الدليل الفلسطيني 2007
2009-04-11 11:01 . 2009-04-11 11:01 -------- d-----w c:\program files\ProgDVB
2009-04-11 09:15 . 2009-04-11 09:15 74760 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-10 17:04 . 2009-04-10 17:03 -------- d-----w c:\program files\Common Files\xing shared
2009-04-10 17:03 . 2009-04-10 17:03 -------- d-----w c:\program files\Real
2009-04-10 16:52 . 2009-04-10 16:52 -------- d-----w c:\program files\Media Player Classic
2009-04-10 15:04 . 2009-04-10 15:04 -------- d-----w c:\program files\USB Disk Security
2009-04-10 14:48 . 2009-04-10 14:48 -------- d-----w c:\program files\MobiusWare
2009-04-10 13:17 . 2009-04-10 13:17 -------- d-----w c:\program files\Common Files\Adobe
2009-04-09 20:14 . 2009-04-09 15:37 1536 ----a-w c:\windows\system32\TrueSoft.dat
2009-04-09 17:27 . 2009-04-09 17:27 -------- d-----w c:\program files\The KMPlayer
2009-04-09 16:31 . 2009-04-09 16:31 -------- d-----w c:\program files\Valve
2009-04-09 15:44 . 2009-04-09 15:44 -------- d-----w c:\program files\tel
2009-04-09 15:42 . 2009-04-09 15:42 -------- d-----w c:\program files\EA Games
2009-04-09 15:39 . 2004-07-17 07:36 12464 ----a-w c:\windows\system32\drivers\secdrv.sys
2009-04-09 15:23 . 2009-04-09 15:23 -------- d-----w c:\program files\Common Files\Real
2009-04-09 15:21 . 2009-04-09 15:21 -------- d-----w c:\program files\Nokia
2009-04-09 15:21 . 2009-04-09 15:21 -------- d-----w c:\program files\Common Files\Nokia
2009-04-09 15:17 . 2009-04-09 15:17 -------- d-----w c:\program files\CyberLink
2009-04-09 15:16 . 2009-04-09 15:16 -------- d-----w c:\program files\Common Files\Ahead
2009-04-09 15:16 . 2009-04-09 15:16 -------- d-----w c:\program files\Ahead
2009-04-09 15:14 . 2009-04-09 15:14 -------- d-----w c:\program files\Power Mp3 Cutter(Mp3 Sound Cutter)
2009-04-09 15:10 . 2009-04-09 15:10 146 ----a-w C:\YServer.txt
2009-04-09 15:09 . 2009-04-09 15:09 -------- d-----w c:\program files\Yahoo!
2009-04-09 15:09 . 2009-04-09 15:09 -------- d-----w c:\program files\Adverts
2009-04-09 15:09 . 2009-04-09 15:09 -------- d-----w c:\program files\Windows Live
2009-04-09 15:09 . 2009-04-09 15:09 -------- d-----w c:\program files\Messenger Plus! Live
2009-04-09 15:05 . 2009-04-09 15:05 -------- d-----w c:\program files\MSN Messenger
2009-04-09 15:04 . 2009-04-09 15:04 2232 ----a-w c:\windows\java\Packages\Data\JFZPBPNB.DAT
2009-04-09 15:04 . 2009-04-09 15:04 155995 ----a-w c:\windows\java\Packages\S8V9ZDRF.ZIP
2009-04-09 15:04 . 2009-04-09 15:04 2678 ----a-w c:\windows\java\Packages\Data\G6WU8GVF.DAT
2009-04-09 15:04 . 2009-04-09 15:04 2678 ----a-w c:\windows\java\Packages\Data\R3NRNH37.DAT
2009-04-09 15:04 . 2009-04-09 15:04 2678 ----a-w c:\windows\java\Packages\Data\ON5R53JN.DAT
2009-04-09 15:04 . 2009-04-09 15:04 2678 ----a-w c:\windows\java\Packages\Data\HJ1Z7H7H.DAT
2009-04-09 15:04 . 2009-04-09 15:04 2678 ----a-w c:\windows\java\Packages\Data\RP7HJVFB.DAT
2009-04-09 15:02 . 2009-04-09 15:02 -------- d-----w c:\program files\Project1
2009-04-09 14:59 . 2009-04-09 14:59 -------- d-----w c:\program files\Virtua Fighter 1
2009-04-09 14:58 . 2009-04-09 14:58 -------- d-----w c:\program files\Infogrames Interactive
2009-04-09 14:58 . 2009-04-09 14:57 -------- d-----w c:\program files\Chicken Invaders 2 V2.55
2009-04-09 14:56 . 2009-04-09 14:56 -------- d-----w c:\program files\JetAudio
2009-04-09 14:55 . 2009-04-09 14:55 -------- d-----w c:\program files\GRETECH
2009-04-09 14:54 . 2009-04-09 14:54 -------- d-----w c:\program files\AAQ
2009-04-09 14:51 . 2009-04-09 14:51 -------- d-----w c:\program files\Total Video Converter
2009-04-09 14:37 . 2009-04-09 13:50 74760 ----a-w c:\documents and settings\ahmad\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-09 14:36 . 2009-04-09 14:36 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-04-09 14:36 . 2009-04-09 14:02 73216 ------w c:\windows\ST6UNST.EXE
2009-04-09 14:36 . 2009-04-09 14:36 -------- d-----w c:\program files\Al-Wafi
2009-04-09 14:06 . 2009-04-09 14:06 -------- d-----w c:\program files\Islamic Encyclopedia
2009-04-09 14:04 . 2009-04-09 14:04 -------- d-----w c:\program files\Mawsoaat Hadeeth
2009-04-09 14:03 . 2009-04-09 14:03 -------- d-----w c:\program files\Awkaf
2009-04-09 14:02 . 2009-04-09 14:02 -------- d-----w c:\program files\DEVELOPER EXPRESS INC
2009-04-09 14:02 . 2009-04-09 14:02 -------- d-----w c:\program files\Albani_new
2009-04-09 14:02 . 2009-04-09 14:02 -------- d-----w c:\program files\Mawarith
2009-04-09 14:02 . 2009-04-09 14:02 -------- d-----w c:\program files\Documents Expert
2009-04-09 14:01 . 2009-04-09 14:01 -------- d-----w c:\program files\Quranzu1
2009-04-09 14:01 . 2009-04-09 14:01 -------- d-----w c:\program files\أحكام التجويد
2009-04-09 13:55 . 2009-04-09 13:55 -------- d-----w c:\program files\Microsoft.NET
2009-04-09 13:48 . 2009-04-09 13:48 90 ----a-w C:\setup.log
2009-04-09 13:45 . 2009-04-09 13:44 193 ----a-w C:\audio.log
2009-04-09 13:43 . 2009-04-09 13:43 -------- d-----w c:\program files\Intel
2009-04-09 13:42 . 2009-04-09 13:42 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-09 13:42 . 2009-04-09 13:42 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-09 13:34 . 2009-04-09 13:34 -------- d-----w c:\program files\microsoft frontpage
2009-04-09 13:30 . 2009-04-09 13:30 22144 ----a-w c:\windows\system32\emptyregdb.dat
2003-03-21 11:37 . 2003-03-21 11:37 16056 ----a-w c:\program files\owcstp16.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-04-06 217088]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-04-06 176128]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 77312]
"Clock"="d:\ahmad ahmad\وزنك ذهب+ألعاب\الألعاب\Clock.exe" [2006-09-23 648192]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 217088]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 94208]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-05-23 851968]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-10 247336]
"DrvIcon"="c:\program files\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-01-08 126976]
"PCTVOICE"="pctspk.exe" - c:\windows\system32\pctspk.exe [2001-09-18 86016]
"PV92TRAY"="PV92Tray.exe" - c:\windows\system32\PV92Tray.exe [2002-12-27 385024]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 91136]
WinManager.lnk - c:\program files\PC-TV\WinManager\WinManager.exe [2009-4-21 61440]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinManager.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinManager.lnk
backup=c:\windows\pss\WinManager.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SOUNDMAN.EXE"=
"c:\\WINDOWS\\system32\\wscntfy.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\system32\\ntvdm.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\ymsgr_tray.exe"=
"c:\\WINDOWS\\system32\\NeroCheck.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe"=
"c:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=
"c:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Ahead\\Nero StartSmart\\NeroStartSmart.exe"=
"c:\\WINDOWS\\system32\\igfxext.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE"=
"c:\\Program Files\\USB Disk Security\\USBGuard.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Unlocker\\UnlockerAssistant.exe"=
"c:\\Program Files\\Media Player Classic\\mplayerc.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
S0 DepFrzHi;DepFrzHi; [x]
S0 DepFrzLo;DepFrzLo; [x]
S2 CX88IR;DTV_DVB 1027 IR Decoder;c:\windows\system32\drivers\88XBDAIR.sys [2007-01-18 17408]
S2 DFServEx;DFServEx;c:\program files\HyperTechnologies\Deep Freeze\DfServEx.exe [2002-08-26 288256]
S3 aic32p;aic32p; [x]
S3 AVXBAR;DTV-DVB 1027 Analog AVStream Crossbar;c:\windows\system32\drivers\88XAxbar.sys [2007-01-18 11136]
S3 BDATUNE;DTV-DVB 1027 DVBS BDA Tuner;c:\windows\system32\drivers\88xBDATune.sys [2008-04-10 41856]
S3 CXAVSTS;DTV-DVB 1027 DVBS BDA Capture;c:\windows\system32\drivers\88xBDACap.sys [2007-01-18 22784]
.
- - - - ORPHANS REMOVED - - - -
Notify-DfLogon - LogonDll.dll
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.microsoft.com
mStart Page = hxxp://www.microsoft.com
mWindow Title = Microsoft Internet Explorer
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-23 10:59
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\WDFMGR.EXE
c:\program files\HyperTechnologies\Deep Freeze\_$Df\FrzState.exe
d:\ahmad ahmad\c:\program files\CYBERLINK\POWERDVD\PDVDSERV.EXE
.
**************************************************************************
.
Completion time: 2009-04-23 11:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-23 09:00
Pre-Run: 2,339,274,752 bytes free
Post-Run: 2,354,298,880 bytes free
277
