السلام عليكم ورحمة الله وبركاته
هذه صورة من تقرير combofix
ComboFix 09-04-25.A3 - Administrator 04/28/2009 10:30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.971.1033.18.382.159 [GMT 4:00]
Running from: d:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-28 )))))))))))))))))))))))))))))))
.
2009-04-28 02:35 . 2009-04-28 02:43 -------- d-----w d:\program files\FairStars Audio Converter
2009-04-28 02:19 . 2009-04-28 02:19 -------- d-----w d:\program files\Common Files\delet
2009-04-27 10:45 . 2009-04-27 10:45 -------- d-----w d:\program files\Common Files\xing shared
2009-04-27 07:55 . 2009-04-27 07:55 -------- d--h--w d:\windows\PIF
2009-04-27 05:54 . 2009-04-27 05:54 -------- d-----w d:\documents and settings\Administrator\Application Data\Ashampoo
2009-04-27 05:51 . 2009-04-27 05:51 -------- d-----w d:\documents and settings\Administrator\Local Settings\Application Data\ashampoo
2009-04-27 05:07 . 2009-04-27 05:33 101287 ----a-w d:\windows\system32\drivers\klin.dat
2009-04-27 05:07 . 2009-04-27 05:33 89601 ----a-w d:\windows\system32\drivers\klick.dat
2009-04-27 05:05 . 2009-04-28 03:41 -------- d-----w d:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-27 05:05 . 2009-04-28 03:37 3108 --sha-w d:\windows\system32\drivers\fidbox2.idx
2009-04-27 05:05 . 2009-04-28 03:37 286752 --sha-w d:\windows\system32\drivers\fidbox2.dat
2009-04-27 05:05 . 2009-04-27 05:05 -------- d-----w d:\program files\Kaspersky Lab
2009-04-27 04:19 . 2009-04-27 04:19 -------- d-----w d:\documents and settings\Administrator\Application Data\CyberScrub
2009-04-27 04:18 . 2009-04-27 04:18 -------- d-----w d:\documents and settings\Administrator\Application Data\cleaner
2009-04-26 11:52 . 2009-04-26 11:52 -------- d-----w d:\windows\Profiles
2009-04-26 11:52 . 2009-04-26 11:52 -------- d-----w d:\windows\system32\Adobe
2009-04-26 11:52 . 2009-04-26 11:54 -------- d-----w d:\program files\Common Files\Adobe
2009-04-26 11:52 . 2009-04-26 11:52 -------- d-----w d:\documents and settings\Administrator\Application Data\InterTrust
2009-04-26 11:50 . 1998-10-29 11:45 306688 ----a-w d:\windows\IsUninst.exe
2009-04-26 10:03 . 2009-04-26 10:03 -------- d--h--w D:\AUTORUN.INF
2009-04-26 09:33 . 2009-04-26 09:43 -------- d-----w d:\program files\USB Disk Security
2009-04-26 05:21 . 2009-04-26 05:21 -------- d-----w d:\documents and settings\Administrator\DoctorWeb
2009-04-26 04:47 . 2009-04-27 04:59 -------- d-----w d:\documents and settings\All Users\Application Data\Symantec
2009-04-26 04:47 . 2009-04-27 04:59 -------- d-----w d:\documents and settings\All Users\Application Data\Norton
2009-04-26 04:46 . 2009-04-26 04:47 -------- d-----w d:\documents and settings\All Users\Application Data\NortonInstaller
2009-04-26 04:40 . 2009-04-26 04:40 2 --shatr d:\windows\winstart.bat
2009-04-26 04:38 . 2009-04-26 04:38 -------- d-----w d:\program files\Greatis
2009-04-26 04:06 . 2009-04-26 04:46 -------- d-----w d:\documents and settings\Administrator\Application Data\GetRightToGo
2009-04-25 14:23 . 2009-04-26 06:08 -------- d-----w d:\program files\Real
2009-04-25 13:32 . 2009-04-25 13:32 -------- d-----w d:\windows\system32\scripting
2009-04-25 13:32 . 2009-04-25 13:32 -------- d-----w d:\windows\l2schemas
2009-04-25 13:32 . 2009-04-25 13:32 -------- d-----w d:\windows\system32\en
2009-04-25 13:32 . 2009-04-25 13:32 -------- d-----w d:\windows\system32\bits
2009-04-25 13:26 . 2009-04-25 13:33 -------- d-----w d:\windows\ServicePackFiles
2009-04-25 13:25 . 2008-07-08 10:54 148496 ----a-w d:\windows\system32\drivers\15674039.sys
2009-04-25 10:31 . 2009-04-25 10:32 -------- d-----w d:\program files\Kaspersky
2009-04-25 03:43 . 2009-04-27 13:30 153088 ----a-w d:\program files\UNWISE.EXE
2009-04-25 03:43 . 2009-04-25 03:43 -------- d-----w d:\program files\Acoustica Shared Effects
2009-04-25 03:43 . 2009-04-25 03:43 -------- d-----w d:\program files\Acoustica Mixcraft
2009-04-25 03:37 . 2009-04-25 03:37 -------- d-----w d:\program files\VMware
2009-04-25 03:37 . 2009-04-25 03:37 -------- d-----w d:\documents and settings\Administrator\Local Settings\Application Data\Thinstall
2009-04-25 03:37 . 2009-04-25 03:37 -------- d-----w d:\documents and settings\Administrator\Application Data\Thinstall
2009-04-25 03:17 . 2009-04-25 03:17 -------- d-----w d:\program files\Typing Assistant (English) 4.2
2009-04-23 13:43 . 2009-04-23 13:43 133944 ----a-w d:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2009-04-23 08:18 . 2005-08-12 01:25 5376 ----a-w d:\windows\system32\antiwpa.dll
2009-04-23 07:20 . 2004-08-07 00:17 375519 -c----w d:\windows\system32\dllcache\nuskin.wmv
2009-04-23 07:19 . 2004-08-03 18:29 73216 ------w d:\windows\system32\drivers\atintuxx.sys
2009-04-23 04:50 . 2009-04-23 04:50 -------- d-----w d:\documents and settings\Administrator\Local Settings\Application Data\UInterface
2009-04-23 04:50 . 2009-04-25 03:20 -------- d-----w d:\program files\MouseLaunch
2009-04-23 04:48 . 2009-04-23 04:48 -------- d-----w d:\documents and settings\Administrator\Application Data\FairStars Recorder
2009-04-23 04:48 . 2009-04-27 13:19 -------- d-----w d:\program files\FairStars Recorder
2009-04-23 03:36 . 2009-04-23 03:36 -------- d-----w d:\documents and settings\Administrator\Local Settings\Application Data\DFX
2009-04-22 12:27 . 2009-04-28 06:37 49872928 --sha-w d:\windows\system32\drivers\fidbox.dat
2009-04-22 12:27 . 2009-04-28 03:37 143852 --sha-w d:\windows\system32\drivers\fidbox.idx
2009-04-22 09:19 . 2008-10-16 10:06 27496 ----a-w d:\windows\system32\mucltui.dll.mui
2009-04-22 09:19 . 2008-10-16 10:06 268648 ----a-w d:\windows\system32\mucltui.dll
2009-04-22 06:26 . 2009-04-22 06:26 -------- d-----w d:\documents and settings\All Users\Application Data\TEMP
2009-04-22 05:58 . 2009-04-22 05:59 -------- d-----w d:\program files\CCleaner
2009-04-22 05:11 . 2008-06-13 11:05 272128 -c----w d:\windows\system32\dllcache\bthport.sys
2009-04-22 05:11 . 2008-06-13 11:05 272128 ------w d:\windows\system32\drivers\bthport.sys
2009-04-22 05:06 . 2009-03-06 14:22 284160 -c----w d:\windows\system32\dllcache\pdh.dll
2009-04-22 05:06 . 2009-02-09 12:10 401408 -c----w d:\windows\system32\dllcache\rpcss.dll
2009-04-22 05:06 . 2009-02-06 11:11 110592 -c----w d:\windows\system32\dllcache\services.exe
2009-04-22 05:06 . 2009-02-09 12:10 473600 -c----w d:\windows\system32\dllcache\fastprox.dll
2009-04-22 05:06 . 2009-02-06 10:10 227840 -c----w d:\windows\system32\dllcache\wmiprvse.exe
2009-04-22 05:05 . 2009-02-09 12:10 453120 -c----w d:\windows\system32\dllcache\wmiprvsd.dll
2009-04-22 05:05 . 2009-02-09 12:10 729088 -c----w d:\windows\system32\dllcache\lsasrv.dll
2009-04-22 05:05 . 2009-02-09 12:10 617472 -c----w d:\windows\system32\dllcache\advapi32.dll
2009-04-22 05:05 . 2009-02-09 12:10 714752 -c----w d:\windows\system32\dllcache\ntdll.dll
2009-04-22 05:05 . 2009-02-06 11:06 2145280 -c----w d:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-22 05:05 . 2009-02-06 11:08 2189056 -c----w d:\windows\system32\dllcache\ntoskrnl.exe
2009-04-22 05:05 . 2009-02-06 10:32 2023936 -c----w d:\windows\system32\dllcache\ntkrpamp.exe
2009-04-22 04:55 . 2008-05-08 14:02 203136 -c----w d:\windows\system32\dllcache\rmcast.sys
2009-04-22 04:55 . 2008-10-24 11:21 455296 -c----w d:\windows\system32\dllcache\mrxsmb.sys
2009-04-22 04:54 . 2008-12-11 10:57 333952 -c----w d:\windows\system32\dllcache\srv.sys
2009-04-22 04:53 . 2008-04-11 19:04 691712 -c----w d:\windows\system32\dllcache\inetcomm.dll
2009-04-22 04:47 . 2008-05-03 11:55 2560 ------w d:\windows\system32\xpsp4res.dll
2009-04-22 04:46 . 2008-04-21 12:08 215552 -c----w d:\windows\system32\dllcache\wordpad.exe
2009-04-22 04:46 . 2008-06-24 16:43 74240 -c----w d:\windows\system32\dllcache\mscms.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-28 06:37 . 2009-04-21 13:32 -------- d-----w d:\documents and settings\Administrator\Application Data\DMCache
2009-04-27 10:44 . 2009-04-21 13:37 -------- d-----w d:\program files\Common Files\Real
2009-04-27 10:41 . 2009-04-21 13:37 499712 ----a-w d:\windows\system32\msvcp71.dll
2009-04-27 10:41 . 2009-04-21 13:37 348160 ----a-w d:\windows\system32\msvcr71.dll
2009-04-27 09:34 . 2009-04-21 13:32 -------- d-----w d:\documents and settings\Administrator\Application Data\IDM
2009-04-27 05:51 . 2009-04-21 11:41 -------- d-----w d:\documents and settings\All Users\Application Data\Ashampoo
2009-04-27 05:50 . 2009-04-21 11:40 -------- d-----w d:\program files\Ashampoo
2009-04-27 05:33 . 2008-01-29 13:29 33808 ----a-w d:\windows\system32\drivers\klbg.sys
2009-04-26 10:35 . 2009-04-21 13:23 -------- d-----w d:\program files\Allok Video to 3GP Converter
2009-04-26 10:34 . 2009-04-21 13:24 -------- d-----w d:\program files\Allok RM RMVB to AVI MPEG DVD Converter
2009-04-25 13:37 . 2009-04-21 10:34 86327 ----a-w d:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-25 03:24 . 2009-04-21 11:29 -------- d-----w d:\program files\Azkary
2009-04-25 02:22 . 2009-04-21 13:32 -------- d-----w d:\program files\Internet Download Manager
2009-04-25 02:22 . 2009-04-21 13:26 -------- d-----w d:\program files\Common Files\GuruNet Shared
2009-04-23 13:52 . 2009-04-21 13:44 208896 ----a-w d:\windows\system32\SSRemove.Exe
2009-04-23 13:52 . 2009-04-21 13:44 151552 ----a-w d:\windows\system32\SSCoInst.exe
2009-04-23 08:22 . 2009-04-21 11:41 133944 ----a-w d:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-23 04:24 . 2009-04-09 13:26 106496 ----a-w d:\windows\system32\hkcmd.exe
2009-04-23 04:24 . 2009-04-09 13:26 155648 ----a-w d:\windows\system32\igfxtray.exe
2009-04-23 04:24 . 2009-04-09 13:26 151552 ----a-w d:\windows\system32\igfxdiag.exe
2009-04-23 04:24 . 2009-04-09 13:26 475136 ----a-w d:\windows\system32\igfxcfg.exe
2009-04-23 03:45 . 2009-04-21 13:25 298496 ----a-w d:\windows\uninst.exe
2009-04-22 13:02 . 2009-04-21 11:31 -------- d-----w d:\program files\SIP Phone
2009-04-22 04:35 . 2009-04-21 12:55 -------- d-----w d:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-21 14:35 . 2009-04-21 14:35 -------- d-----w d:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-21 13:53 . 2009-04-21 13:52 -------- d-----w d:\program files\Ela-Salaty
2009-04-21 13:44 . 2009-04-21 13:44 -------- d-----w d:\program files\Common Files\InstallShield
2009-04-21 13:43 . 2009-04-21 13:43 0 --sha-r D:\khr
2009-04-21 13:40 . 2009-04-21 13:40 -------- d-----w d:\documents and settings\All Users\Application Data\DFX
2009-04-21 13:40 . 2009-04-21 13:40 -------- d-----w d:\program files\Common Files\Wise Installation Wizard
2009-04-21 13:28 . 2009-04-21 13:26 -------- d-----w d:\program files\QuickWiz
2009-04-21 13:26 . 2009-04-21 13:26 -------- d-----w d:\program files\Common Files\Accent Shared
2009-04-21 13:25 . 2009-04-21 13:25 -------- d-----w d:\program files\EasyLngo
2009-04-21 12:52 . 2009-04-21 12:52 -------- d-----w d:\program files\TheDictionary
2009-04-21 11:44 . 2009-04-21 11:44 -------- d-----w d:\program files\BandwidthMonitor
2009-04-21 11:44 . 2009-04-21 11:44 -------- d-----w d:\documents and settings\Administrator\Application Data\BWMonitor
2009-04-21 11:37 . 2009-04-21 11:37 -------- d-----w d:\documents and settings\Administrator\Application Data\Avant Profiles
2009-04-21 11:37 . 2009-04-21 11:37 -------- d-----w d:\program files\Avant Browser
2009-04-21 10:36 . 2009-04-21 10:36 -------- d-----w d:\program files\microsoft frontpage
2009-04-21 10:32 . 2009-04-21 10:32 21640 ----a-w d:\windows\system32\emptyregdb.dat
2009-03-06 14:22 . 2009-04-21 13:54 284160 ----a-w d:\windows\system32\pdh.dll
2009-02-20 08:10 . 2009-04-21 13:56 666112 ----a-w d:\windows\system32\wininet.dll
2009-02-20 08:10 . 2009-04-21 13:53 81920 ----a-w d:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2009-04-21 13:53 729088 ----a-w d:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2009-04-21 13:55 401408 ----a-w d:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2009-04-21 13:54 714752 ----a-w d:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2009-04-21 13:51 617472 ----a-w d:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2009-04-21 13:56 1846784 ----a-w d:\windows\system32\win32k.sys
2009-02-07 15:02 . 2004-08-03 22:59 2066048 ----a-w d:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2009-04-21 13:55 110592 ----a-w d:\windows\system32\services.exe
2009-02-06 11:08 . 2009-04-21 13:54 2189056 ----a-w d:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2009-04-21 13:55 35328 ----a-w d:\windows\system32\sc.exe
2009-02-03 19:59 . 2009-04-21 13:55 56832 ----a-w d:\windows\system32\secur32.dll
2004-03-17 13:13 . 2004-03-17 13:13 1028368 ----a-w d:\program files\vbrun60sp6.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BandwidthMonitor"="d:\program files\BandwidthMonitor\BWMonitor.exe" [2008-10-09 224256]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IDMan"="d:\program files\Internet Download Manager\IDMan.exe" [2009-04-26 2676144]
"UIWatcher"="d:\program files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exe" [2008-05-05 3508568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MouseLaunch"="d:\program files\MouseLaunch\Launcher.exe" [2008-08-04 819200]
"AVP"="d:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-27 206088]
"USB Antivirus"="d:\program files\USB Disk Security\USBGuard.exe" [2008-07-13 753664]
"TkBellExe"="d:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-27 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
d:\documents and settings\Administrator\Start Menu\Programs\Startup\
delxp.exe [2007-11-26 130982]
EasyLingo.lnk - d:\program files\QuickWiz\EasyLingo\ELINGO.EXE [2009-4-21 622592]
Ela-Salaty.lnk - d:\program files\Ela-Salaty\Salaty.exe [2007-3-5 5205504]
is-FBPGS.lnk - d:\documents and settings\Administrator\Desktop\Virus Removal Tool\is-FBPGS\startup.exe [2009-4-25 65536]
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll
[HKLM\~\startupfolder\D:^Documents and Settings^Administrator^Start Menu^Programs^Startup^is-9MDO7.lnk]
path=d:\documents and settings\Administrator\Start Menu\Programs\Startup\is-9MDO7.lnk
backup=d:\windows\pss\is-9MDO7.lnkStartup
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^FairStars Record Schedule.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\FairStars Record Schedule.lnk
backup=d:\windows\pss\FairStars Record Schedule.lnkCommon Startup
[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=d:\windows\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\WINDOWS\\system32\\igfxtray.exe"=
"d:\\Program Files\\Internet Download Manager\\IEMonitor.exe"=
"d:\\Program Files\\Avant Browser\\avant.exe"=
"d:\\Program Files\\SIP Phone\\SIP Phone.exe"=
"d:\\Program Files\\Microsoft Office\\Office10\\EXCEL.EXE"=
"e:\\برامج تشغيل\\برامج حماية\\Kasper Sky 2009\\Kaspersky Internet Security-2009\\kis8.0.0.357en.exe"=
"e:\\مؤقت\\New Folder\\New Folder\\1.exe"=
"d:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 2009\\avp.exe"=
"d:\\Program Files\\MouseLaunch\\Launcher.exe"=
"d:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"d:\\Program Files\\Common Files\\GuruNet Shared\\agtserv.exe"=
"e:\\برامج تشغيل\\برامج اساسية\\مساعد الكتابة للغة الانجليزية\\TypingAssistant_English_setup.exe"=
"d:\\Program Files\\QuickWiz\\EasyLingo\\wdtspeak.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
S0 klbg;Kaspersky Lab Boot Guard Driver;d:\windows\system32\drivers\klbg.sys [2009-04-27 33808]
S1 is-FBPGSdrv;is-FBPGSdrv;d:\windows\system32\DRIVERS\15674039.sys [2008-07-08 148496]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;d:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d656000-5ac7-11dd-ad67-000ae67e79a0}]
\ShEll\aUToPlAy\coMmanD - H:\dklenw.exe
\ShEll\AutoRun\command - H:\dklenw.exe
\ShEll\ExPLore\ComMand - H:\dklenw.exe
\ShEll\OpeN\cOMmanD - H:\dklenw.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82853e84-2736-11de-adf6-000ae67e79a0}]
\ShElL\AuTopLAy\COMmaND - H:\ocfrde.pif
\ShElL\AutoRun\command - H:\ocfrde.pif
\ShElL\Explore\CommanD - H:\ocfrde.pif
\ShElL\open\CommANd - H:\ocfrde.pif
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.microsoft.com
mStart Page = hxxp://www.microsoft.com
mWindow Title = Microsoft Internet Explorer
IE: &تصدير إلى Microsoft Excel - d:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - d:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - d:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - d:\program files\Internet Download Manager\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-04-28 10:37
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\.Default\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Ding.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\AppGPFault\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\CCSelect\,E'D0*صw]
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\Close\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\DeviceConnect\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Hardware Insert.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Hardware Remove.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\DeviceFail\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Hardware Fail.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Battery Low.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\MailBeep\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Notify.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\Maximize\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\MenuCommand\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\MenuPopup\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\Minimize\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\Open\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\PrintComplete\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\RestoreDown\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\RestoreUp\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\ShowBand\,E'D0*صw]
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemAsterisk\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Error.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemExclamation\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Exclamation.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemExit\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="f:\\d hard\\اصوات ويندوز\\الحمد لله.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemHand\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Critical Stop.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemNotification\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Balloon.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemQuestion\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\SystemStart\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="f:\\d hard\\اصوات ويندوز\\بسم الله.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\WindowsLogoff\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Logoff Sound.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\.Default\WindowsLogon\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Logon Sound.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Conf\Person Joins\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="d:\\Program Files\\NetMeeting\\Blip.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Conf\Person Leaves\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="d:\\Program Files\\NetMeeting\\Blip.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Conf\Receive Call\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="RingIn.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Conf\Receive Request to Join\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="RingIn.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Explorer\ActivatingDocument\,E'D0*صw]
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Explorer\BlockedPopup\,E'D0*صw]
@="Windows XP Pop-up Blocked.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=expand:"%SystemRoot%\\media\\Windows XP Recycle.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Explorer\MoveMenuItem\,E'D0*صw]
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Explorer\Navigating\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@=""
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\Explorer\SecurityBand\,E'D0*صw]
@="Windows XP Information Bar.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_ContactOnline\,E'D0*صw]
@="d:\\Program Files\\Messenger\\online.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_NewAlert\,E'D0*صw]
@="d:\\Program Files\\Messenger\\newalert.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_NewMail\,E'D0*صw]
@="d:\\Program Files\\Messenger\\newemail.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Apps\MSMSGS\MSMSGS_NewMessage\,E'D0*صw]
@="d:\\Program Files\\Messenger\\type.wav"
[HKEY_USERS\S-1-5-21-1417001333-706699826-1957994488-500\AppEvents\Schemes\Names\,E'D0*صw]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
@="جمال"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e2,e9,68,3a,33,ec,e0,9b,4e,e0,af,29,f1,9c,3b,e3,92,ba,e1,6c,57,
cb,7e,ef,e5,b8,92,06,16,f8,03,29,7d,f2,84,e2,9a,26,a8,04,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{ee0a3c97-876a-452b-9e54-f82c5d3de5d9}]
@Denied: (Full) (Everyone)
"Model"=dword:00000075
"Therad"=dword:00000008
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2160)
d:\program files\Common Files\GuruNet Shared\agthook.dll
d:\program files\Common Files\GuruNet Shared\agtctrl.dll
d:\program files\Common Files\GuruNet Shared\agtthook.dll
d:\program files\Common Files\GuruNet Shared\agtpchnt.dll
d:\program files\Common Files\GuruNet Shared\agtcmpnt.dll
d:\program files\Common Files\GuruNet Shared\agtproc.dll
d:\program files\MouseLaunch\LauncherDLL.dll
d:\program files\Internet Download Manager\IDMIECC.dll
d:\program files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
d:\program files\Internet Download Manager\idmmkb.dll
d:\program files\Microsoft Office\Office10\msohev.dll
.
Completion time: 2009-04-28 10:40
ComboFix-quarantined-files.txt 2009-04-28 06:40
ComboFix2.txt 2009-04-28 03:51
Pre-Run: 1,119,531,008 bytes free
Post-Run: 1,110,740,992 bytes free
417 --- E O F --- 2009-04-28 02:34
=======================================================لا ادرى لماذا الموضوع يأتي بهذا الشكل رغم اني منسق الكتابة عند كتابة الموضوع وكذلك لاحظت ان الادوات في الموضوع مثل الخط واللون وادراج الصورة كل الادوات لاتعمل معي افيدوني جزاكم الله خيرا</p>
:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\system32\ctfmon.exeD:\Program Files\Azkary\Azkary.exeD:\Program Files\MouseLaunch\Launcher.exeD:\Program Files\BandwidthMonitor\BWMonitor.exeD:\Program Files\Typing Assistant (English) 4.2\Typing Assistant (English).exeD:\Program Files\Internet Download Manager\IDMan.exeD:\Program Files\Ashampoo\Ashampoo UnInstaller 3\UIWatcher.exeD:\Program Files\QuickWiz\EasyLingo\ELINGO.EXED:\Program Files\Ela-Salaty\Salaty.exeD:\Program Files\Common Files\GuruNet Shared\agtserv.exeD:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeD:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exeD:\Program Files\QuickWiz\EasyLingo\wdtspeak.exeD:\Program Files\Internet Download Manager\IEMonitor.exeD:\Program Files\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exeD:\WINDOWS\system32\wuauclt.exeE:\مؤقت\مكافحة الفيروسات\Dr. Web\launch.exeD:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\_start.exeD:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\setup.exeD:\Program Files\Avant Browser\avant.exeD:\WINDOWS\system32\svchost.exeE:\مؤقت\HiJackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
