تلميذ العباقره
زيزوومى فعال
- إنضم
- 31 يناير 2009
- المشاركات
- 248
- مستوى التفاعل
- 21
- النقاط
- 340
غير متصل
السلام عليكم ورحمة الله
يا اخواني لدي مشكلتين
الاولى الجهاز بطيئ والثانيه لم اعد استطيع دخول دردشة زيزوم الاسلاميه باستخدام الجافا
وهذا تقرير
ComboFix 09-05-18.02 - hussin 05/19/2009 0:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.479.261 [GMT 3:00]
Running from: c:\documents and settings\hussin\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\opuc.dll
d:\recycler\S-1-5-21-1715567821-823518204-725345543-1003\INFO2
.
((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))
.
2009-05-18 17:43 . 2009-05-18 18:10 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-18 17:43 . 2009-05-18 18:10 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-18 17:42 . 2009-05-18 21:30 1143328 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-18 17:42 . 2009-05-18 21:30 221216 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-18 17:42 . 2009-05-18 17:42 -------- d-----w c:\program files\Kaspersky Lab
2009-05-18 17:42 . 2009-05-18 21:31 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-17 01:09 . 2009-05-17 01:10 -------- d-----w c:\program files\Java
2009-05-17 01:09 . 2009-05-17 01:09 -------- d-----w c:\program files\Common Files\Java
2009-05-16 23:02 . 2009-05-16 23:02 -------- d-----w c:\windows\Sun
2009-05-16 19:00 . 2009-05-16 19:04 378186 ----a-w c:\windows\hpoins27.dat
2009-05-16 19:00 . 2008-01-18 15:56 932 ------w c:\windows\hpomdl27.dat
2009-05-16 11:19 . 2009-05-16 11:19 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Google
2009-05-16 10:10 . 2009-05-16 17:23 -------- d-----w c:\program files\Google
2009-05-16 08:47 . 2009-05-16 08:47 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-05-16 02:54 . 2009-05-16 02:54 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\ESET
2009-05-16 00:30 . 2009-05-16 00:30 38792 ---ha-w c:\windows\system32\mlfcache.dat
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Apple Computer
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\documents and settings\hussin\Application Data\Apple Computer
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\program files\Safari
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\program files\Bonjour
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Apple
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\program files\Apple Software Update
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-05-15 18:49 . 2009-05-15 18:49 -------- d-----w c:\documents and settings\hussin\Application Data\ESET
2009-05-15 18:47 . 2009-05-15 18:47 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-15 00:57 . 2009-05-15 11:47 -------- d-----w c:\documents and settings\All Users\Application Data\Uniblue
2009-05-15 00:22 . 2009-05-15 00:22 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-15 00:22 . 2009-05-15 00:22 -------- d-----w c:\documents and settings\mozy
2009-05-15 00:22 . 2009-05-15 10:09 -------- d-----w c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-05-15 00:21 . 2009-05-15 11:47 -------- d-----w c:\documents and settings\hussin\Application Data\Uniblue
2009-05-14 23:40 . 2009-05-14 23:40 -------- d-----w c:\documents and settings\hussin\Application Data\CyberScrub
2009-05-14 23:39 . 2009-05-14 23:52 -------- d-----w c:\documents and settings\hussin\Application Data\cleaner
2009-05-14 15:22 . 2009-05-14 15:22 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-12 21:40 . 2009-05-13 17:21 -------- d-----w c:\documents and settings\hussin\Application Data\Crystal Player
2009-05-12 21:40 . 2009-05-16 02:54 -------- d-----w c:\program files\Crystal Player
2009-05-12 21:22 . 2009-05-12 21:22 -------- d-----w c:\program files\Common Files\xing shared
2009-05-12 21:22 . 2009-05-12 21:22 -------- d-----w c:\program files\Common Files\Real
2009-05-12 21:22 . 2009-05-12 21:22 -------- d-----w c:\program files\Real
2009-05-12 09:37 . 2009-05-12 09:38 -------- d-----w c:\program files\iVocalize Web Conference 4
2009-05-12 03:12 . 2009-05-12 03:12 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-12 03:11 . 2009-05-15 20:20 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-12 03:11 . 2009-05-12 03:11 -------- d-----w c:\documents and settings\hussin\Application Data\SUPERAntiSpyware.com
2009-05-11 21:46 . 2009-05-11 21:46 -------- d-----w c:\documents and settings\hussin\Application Data\OfficeUpdate12
2009-05-10 12:40 . 2009-05-10 12:40 -------- d-----w c:\documents and settings\hussin\Application Data\Ashampoo
2009-05-10 12:39 . 2009-05-10 12:39 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\ashampoo
2009-05-10 12:39 . 2009-05-10 12:39 -------- d-----w c:\documents and settings\All Users\Application Data\ashampoo
2009-05-10 12:14 . 2009-05-10 12:15 -------- d-----w c:\program files\NeroBurningROMPortable
2009-05-09 08:09 . 2009-05-13 22:18 -------- d-----w C:\WinSetupFromUSB
2009-05-08 15:01 . 2009-05-08 15:01 -------- d-----w c:\documents and settings\hussin\Application Data\URSoft
2009-05-08 15:01 . 2009-05-11 10:31 -------- d-----w c:\program files\Your Uninstaller 2008
2009-05-07 23:47 . 2009-05-07 23:48 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Hotspot_Shield
2009-05-07 21:04 . 2009-05-07 21:04 -------- d-----w c:\program files\Hotspot Shield
2009-05-07 18:26 . 2009-05-07 19:48 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Conduit
2009-05-07 18:25 . 2009-05-07 23:48 -------- d-----w c:\program files\Hotspot_Shield
2009-05-07 16:18 . 2009-05-07 16:18 -------- d-sh--w c:\documents and settings\hussin\IECompatCache
2009-05-07 16:17 . 2009-05-07 16:17 -------- d-sh--w c:\documents and settings\hussin\PrivacIE
2009-05-07 16:16 . 2009-05-07 16:16 -------- d-sh--w c:\documents and settings\hussin\IETldCache
2009-05-07 16:12 . 2009-05-07 16:12 -------- d-----w c:\windows\ie8updates
2009-05-07 16:12 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-07 16:08 . 2009-05-07 16:11 -------- dc-h--w c:\windows\ie8
2009-05-07 14:20 . 2009-03-24 13:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-07 12:36 . 2008-04-13 18:47 25856 -c--a-w c:\windows\system32\dllcache\usbprint.sys
2009-05-07 12:36 . 2008-04-13 18:47 25856 ----a-w c:\windows\system32\drivers\usbprint.sys
2009-05-07 09:12 . 2007-09-21 16:24 43520 ----a-w c:\windows\system32\drivers\fetnd5bv.sys
2009-05-07 09:12 . 2006-10-27 13:26 69632 ----a-w c:\windows\system32\vuins32.dll
2009-05-07 09:09 . 2009-05-07 09:09 -------- d-----w C:\S3Graphics
2009-05-07 08:44 . 2004-06-14 11:56 427864 ----a-w c:\windows\system32\XceedZip.dll
2009-05-07 08:44 . 2009-05-07 08:44 -------- d-----w c:\program files\Driver-Soft
2009-05-07 07:42 . 2009-03-26 15:35 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-05-07 03:45 . 2003-10-03 13:28 45056 ----a-w c:\windows\system32\vusetup.dll
2009-05-07 03:45 . 2005-01-05 15:02 6912 ----a-w c:\windows\system32\drivers\vulfnth.sys
2009-05-07 03:45 . 2005-06-06 14:51 11264 ----a-w c:\windows\system32\drivers\vulfntr.sys
2009-05-07 02:13 . 2009-05-07 02:14 -------- d-----w c:\documents and settings\hussin\Application Data\QuickScan
2009-05-06 21:57 . 2009-05-13 09:07 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-06 20:32 . 2008-04-14 15:59 21504 -c--a-w c:\windows\system32\dllcache\hidserv.dll
2009-05-06 20:32 . 2008-04-14 15:59 21504 ----a-w c:\windows\system32\hidserv.dll
2009-05-06 20:31 . 2008-04-14 15:40 14592 -c--a-w c:\windows\system32\dllcache\kbdhid.sys
2009-05-06 20:31 . 2008-04-14 15:40 14592 ----a-w c:\windows\system32\drivers\kbdhid.sys
2009-05-06 20:31 . 2008-04-13 18:45 32128 -c--a-w c:\windows\system32\dllcache\usbccgp.sys
2009-05-06 20:31 . 2008-04-13 18:45 32128 ----a-w c:\windows\system32\drivers\usbccgp.sys
2009-05-06 15:09 . 2009-05-15 19:37 -------- d-----w c:\documents and settings\hussin\Application Data\IDM
2009-05-06 14:53 . 2009-05-16 16:45 -------- d-----w c:\documents and settings\hussin\Application Data\Thinstall
2009-05-06 13:14 . 2009-05-06 13:14 604416 ----a-w c:\windows\system32\TUProgSt.exe
2009-05-06 13:14 . 2009-04-27 11:21 28928 ----a-w c:\windows\system32\uxtuneup.dll
2009-05-06 13:14 . 2009-05-06 13:14 361216 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-05-06 13:13 . 2009-05-06 13:13 -------- d-----w c:\documents and settings\hussin\Application Data\TuneUp Software
2009-05-06 13:11 . 2009-05-06 13:11 -------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-06 13:11 . 2009-05-18 16:10 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-05-06 13:10 . 2009-05-06 13:10 -------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-03 13:00 . 2009-05-03 13:00 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-30 20:22 . 2009-04-30 20:22 413760 ----a-w c:\windows\system32\mpg4c32.dll
2009-04-21 15:34 . 2009-05-07 21:04 -------- d-----w c:\program files\Conduit
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 21:30 . 2009-05-18 17:42 2884 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-18 21:30 . 2009-05-18 17:42 11060 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-18 18:11 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-17 00:54 . 2009-04-17 13:54 -------- d-----w c:\program files\Internet Download Manager
2009-05-12 21:22 . 2009-04-12 18:54 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-12 21:22 . 2009-04-12 18:54 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-11 17:20 . 2009-04-11 22:08 -------- d-----w c:\program files\ma-config.com
2009-05-11 17:20 . 2009-04-11 22:08 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-17 18:12 . 2009-04-12 10:54 49472 ----a-w c:\documents and settings\hussin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 17:49 . 2009-04-17 17:49 -------- d-----w c:\program files\Microsoft
2009-04-17 17:49 . 2009-04-12 17:32 -------- d-----w c:\program files\Windows Live
2009-04-17 17:49 . 2009-04-17 17:49 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-17 17:41 . 2009-04-17 17:41 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-16 04:29 . 2001-09-19 15:00 39982 ----a-w c:\windows\system32\perfc001.dat
2009-04-16 04:29 . 2001-09-19 15:00 251478 ----a-w c:\windows\system32\perfh001.dat
2009-04-12 21:18 . 2009-04-12 21:18 -------- d-----w c:\program files\Microsoft.NET
2009-04-12 15:15 . 2009-04-12 15:15 0 ----a-w c:\windows\nsreg.dat
2009-04-11 22:52 . 2009-04-11 22:52 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-11 19:11 . 2009-04-11 19:11 -------- d-----w c:\program files\C-Media 3D Audio
2009-04-11 19:11 . 2009-04-11 19:11 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-11 19:11 . 2009-04-11 19:02 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-11 19:02 . 2009-04-11 19:02 -------- d-----w c:\program files\S3
2009-04-11 19:02 . 2009-04-11 19:02 -------- d-----w c:\program files\VIA
2009-04-11 18:48 . 2009-04-11 18:48 -------- d-----w c:\program files\microsoft frontpage
2009-04-11 18:43 . 2009-04-11 18:43 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-16 17:50 . 2009-03-16 17:50 81984 ----a-w c:\windows\system32\bdod.bin
2009-03-08 01:34 . 2004-08-04 00:55 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-04 00:55 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-04 00:55 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-04 00:55 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-04 00:55 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-04 00:55 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-04 00:55 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-04 00:53 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-04 00:56 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-09-19 15:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-04 00:55 283136 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2008-06-24 20:17 1569304 ----a-w c:\program files\Hotspot_Shield\tbHots.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-12 198160]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-18 206088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [06/05/2009 04:14 م 604416]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37]
2009-05-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
2009-05-18 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-18 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-18 c:\windows\Tasks\User_Feed_Synchronization-{B1E48AB9-F5EC-468C-8021-FD6EBEA75192}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Add to &LinkFox - c:\progra~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
FF - ProfilePath - c:\documents and settings\hussin\Application Data\Mozilla\Firefox\Profiles\yyj51c8o.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/firefox
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\documents and settings\hussin\Application Data\Mozilla\Firefox\Profiles\yyj51c8o.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-19 00:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3688)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-18 0:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-18 21:35
Pre-Run: 15,281,217,536 bytes free
Post-Run: 15,342,526,464 bytes free
257 --- E O F --- 2009-05-13 08:33
يا اخواني لدي مشكلتين
الاولى الجهاز بطيئ والثانيه لم اعد استطيع دخول دردشة زيزوم الاسلاميه باستخدام الجافا
وهذا تقرير
ComboFix 09-05-18.02 - hussin 05/19/2009 0:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.479.261 [GMT 3:00]
Running from: c:\documents and settings\hussin\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\opuc.dll
d:\recycler\S-1-5-21-1715567821-823518204-725345543-1003\INFO2
.
((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))
.
2009-05-18 17:43 . 2009-05-18 18:10 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-18 17:43 . 2009-05-18 18:10 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-18 17:42 . 2009-05-18 21:30 1143328 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-18 17:42 . 2009-05-18 21:30 221216 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-18 17:42 . 2009-05-18 17:42 -------- d-----w c:\program files\Kaspersky Lab
2009-05-18 17:42 . 2009-05-18 21:31 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-17 01:09 . 2009-05-17 01:10 -------- d-----w c:\program files\Java
2009-05-17 01:09 . 2009-05-17 01:09 -------- d-----w c:\program files\Common Files\Java
2009-05-16 23:02 . 2009-05-16 23:02 -------- d-----w c:\windows\Sun
2009-05-16 19:00 . 2009-05-16 19:04 378186 ----a-w c:\windows\hpoins27.dat
2009-05-16 19:00 . 2008-01-18 15:56 932 ------w c:\windows\hpomdl27.dat
2009-05-16 11:19 . 2009-05-16 11:19 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Google
2009-05-16 10:10 . 2009-05-16 17:23 -------- d-----w c:\program files\Google
2009-05-16 08:47 . 2009-05-16 08:47 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-05-16 02:54 . 2009-05-16 02:54 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\ESET
2009-05-16 00:30 . 2009-05-16 00:30 38792 ---ha-w c:\windows\system32\mlfcache.dat
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Apple Computer
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\documents and settings\hussin\Application Data\Apple Computer
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-15 23:45 . 2009-05-15 23:45 -------- d-----w c:\program files\Safari
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\program files\Bonjour
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Apple
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\program files\Apple Software Update
2009-05-15 23:44 . 2009-05-15 23:44 -------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-05-15 18:49 . 2009-05-15 18:49 -------- d-----w c:\documents and settings\hussin\Application Data\ESET
2009-05-15 18:47 . 2009-05-15 18:47 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-15 00:57 . 2009-05-15 11:47 -------- d-----w c:\documents and settings\All Users\Application Data\Uniblue
2009-05-15 00:22 . 2009-05-15 00:22 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-05-15 00:22 . 2009-05-15 00:22 -------- d-----w c:\documents and settings\mozy
2009-05-15 00:22 . 2009-05-15 10:09 -------- d-----w c:\documents and settings\All Users\Application Data\Hagel Technologies
2009-05-15 00:21 . 2009-05-15 11:47 -------- d-----w c:\documents and settings\hussin\Application Data\Uniblue
2009-05-14 23:40 . 2009-05-14 23:40 -------- d-----w c:\documents and settings\hussin\Application Data\CyberScrub
2009-05-14 23:39 . 2009-05-14 23:52 -------- d-----w c:\documents and settings\hussin\Application Data\cleaner
2009-05-14 15:22 . 2009-05-14 15:22 -------- d--h--w c:\windows\system32\GroupPolicy
2009-05-12 21:40 . 2009-05-13 17:21 -------- d-----w c:\documents and settings\hussin\Application Data\Crystal Player
2009-05-12 21:40 . 2009-05-16 02:54 -------- d-----w c:\program files\Crystal Player
2009-05-12 21:22 . 2009-05-12 21:22 -------- d-----w c:\program files\Common Files\xing shared
2009-05-12 21:22 . 2009-05-12 21:22 -------- d-----w c:\program files\Common Files\Real
2009-05-12 21:22 . 2009-05-12 21:22 -------- d-----w c:\program files\Real
2009-05-12 09:37 . 2009-05-12 09:38 -------- d-----w c:\program files\iVocalize Web Conference 4
2009-05-12 03:12 . 2009-05-12 03:12 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-12 03:11 . 2009-05-15 20:20 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-12 03:11 . 2009-05-12 03:11 -------- d-----w c:\documents and settings\hussin\Application Data\SUPERAntiSpyware.com
2009-05-11 21:46 . 2009-05-11 21:46 -------- d-----w c:\documents and settings\hussin\Application Data\OfficeUpdate12
2009-05-10 12:40 . 2009-05-10 12:40 -------- d-----w c:\documents and settings\hussin\Application Data\Ashampoo
2009-05-10 12:39 . 2009-05-10 12:39 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\ashampoo
2009-05-10 12:39 . 2009-05-10 12:39 -------- d-----w c:\documents and settings\All Users\Application Data\ashampoo
2009-05-10 12:14 . 2009-05-10 12:15 -------- d-----w c:\program files\NeroBurningROMPortable
2009-05-09 08:09 . 2009-05-13 22:18 -------- d-----w C:\WinSetupFromUSB
2009-05-08 15:01 . 2009-05-08 15:01 -------- d-----w c:\documents and settings\hussin\Application Data\URSoft
2009-05-08 15:01 . 2009-05-11 10:31 -------- d-----w c:\program files\Your Uninstaller 2008
2009-05-07 23:47 . 2009-05-07 23:48 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Hotspot_Shield
2009-05-07 21:04 . 2009-05-07 21:04 -------- d-----w c:\program files\Hotspot Shield
2009-05-07 18:26 . 2009-05-07 19:48 -------- d-----w c:\documents and settings\hussin\Local Settings\Application Data\Conduit
2009-05-07 18:25 . 2009-05-07 23:48 -------- d-----w c:\program files\Hotspot_Shield
2009-05-07 16:18 . 2009-05-07 16:18 -------- d-sh--w c:\documents and settings\hussin\IECompatCache
2009-05-07 16:17 . 2009-05-07 16:17 -------- d-sh--w c:\documents and settings\hussin\PrivacIE
2009-05-07 16:16 . 2009-05-07 16:16 -------- d-sh--w c:\documents and settings\hussin\IETldCache
2009-05-07 16:12 . 2009-05-07 16:12 -------- d-----w c:\windows\ie8updates
2009-05-07 16:12 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-07 16:08 . 2009-05-07 16:11 -------- dc-h--w c:\windows\ie8
2009-05-07 14:20 . 2009-03-24 13:08 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-07 12:36 . 2008-04-13 18:47 25856 -c--a-w c:\windows\system32\dllcache\usbprint.sys
2009-05-07 12:36 . 2008-04-13 18:47 25856 ----a-w c:\windows\system32\drivers\usbprint.sys
2009-05-07 09:12 . 2007-09-21 16:24 43520 ----a-w c:\windows\system32\drivers\fetnd5bv.sys
2009-05-07 09:12 . 2006-10-27 13:26 69632 ----a-w c:\windows\system32\vuins32.dll
2009-05-07 09:09 . 2009-05-07 09:09 -------- d-----w C:\S3Graphics
2009-05-07 08:44 . 2004-06-14 11:56 427864 ----a-w c:\windows\system32\XceedZip.dll
2009-05-07 08:44 . 2009-05-07 08:44 -------- d-----w c:\program files\Driver-Soft
2009-05-07 07:42 . 2009-03-26 15:35 210352 ----a-w c:\windows\system32\idmmbc.dll
2009-05-07 03:45 . 2003-10-03 13:28 45056 ----a-w c:\windows\system32\vusetup.dll
2009-05-07 03:45 . 2005-01-05 15:02 6912 ----a-w c:\windows\system32\drivers\vulfnth.sys
2009-05-07 03:45 . 2005-06-06 14:51 11264 ----a-w c:\windows\system32\drivers\vulfntr.sys
2009-05-07 02:13 . 2009-05-07 02:14 -------- d-----w c:\documents and settings\hussin\Application Data\QuickScan
2009-05-06 21:57 . 2009-05-13 09:07 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-06 20:32 . 2008-04-14 15:59 21504 -c--a-w c:\windows\system32\dllcache\hidserv.dll
2009-05-06 20:32 . 2008-04-14 15:59 21504 ----a-w c:\windows\system32\hidserv.dll
2009-05-06 20:31 . 2008-04-14 15:40 14592 -c--a-w c:\windows\system32\dllcache\kbdhid.sys
2009-05-06 20:31 . 2008-04-14 15:40 14592 ----a-w c:\windows\system32\drivers\kbdhid.sys
2009-05-06 20:31 . 2008-04-13 18:45 32128 -c--a-w c:\windows\system32\dllcache\usbccgp.sys
2009-05-06 20:31 . 2008-04-13 18:45 32128 ----a-w c:\windows\system32\drivers\usbccgp.sys
2009-05-06 15:09 . 2009-05-15 19:37 -------- d-----w c:\documents and settings\hussin\Application Data\IDM
2009-05-06 14:53 . 2009-05-16 16:45 -------- d-----w c:\documents and settings\hussin\Application Data\Thinstall
2009-05-06 13:14 . 2009-05-06 13:14 604416 ----a-w c:\windows\system32\TUProgSt.exe
2009-05-06 13:14 . 2009-04-27 11:21 28928 ----a-w c:\windows\system32\uxtuneup.dll
2009-05-06 13:14 . 2009-05-06 13:14 361216 ----a-w c:\windows\system32\TuneUpDefragService.exe
2009-05-06 13:13 . 2009-05-06 13:13 -------- d-----w c:\documents and settings\hussin\Application Data\TuneUp Software
2009-05-06 13:11 . 2009-05-06 13:11 -------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-06 13:11 . 2009-05-18 16:10 -------- d-----w c:\program files\TuneUp Utilities 2009
2009-05-06 13:10 . 2009-05-06 13:10 -------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-03 13:00 . 2009-05-03 13:00 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-04-30 20:22 . 2009-04-30 20:22 413760 ----a-w c:\windows\system32\mpg4c32.dll
2009-04-21 15:34 . 2009-05-07 21:04 -------- d-----w c:\program files\Conduit
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 21:30 . 2009-05-18 17:42 2884 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-18 21:30 . 2009-05-18 17:42 11060 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-18 18:11 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-05-17 00:54 . 2009-04-17 13:54 -------- d-----w c:\program files\Internet Download Manager
2009-05-12 21:22 . 2009-04-12 18:54 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-12 21:22 . 2009-04-12 18:54 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-11 17:20 . 2009-04-11 22:08 -------- d-----w c:\program files\ma-config.com
2009-05-11 17:20 . 2009-04-11 22:08 -------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com
2009-04-17 18:12 . 2009-04-12 10:54 49472 ----a-w c:\documents and settings\hussin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 17:49 . 2009-04-17 17:49 -------- d-----w c:\program files\Microsoft
2009-04-17 17:49 . 2009-04-12 17:32 -------- d-----w c:\program files\Windows Live
2009-04-17 17:49 . 2009-04-17 17:49 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-17 17:41 . 2009-04-17 17:41 -------- d-----w c:\program files\Common Files\Windows Live
2009-04-16 04:29 . 2001-09-19 15:00 39982 ----a-w c:\windows\system32\perfc001.dat
2009-04-16 04:29 . 2001-09-19 15:00 251478 ----a-w c:\windows\system32\perfh001.dat
2009-04-12 21:18 . 2009-04-12 21:18 -------- d-----w c:\program files\Microsoft.NET
2009-04-12 15:15 . 2009-04-12 15:15 0 ----a-w c:\windows\nsreg.dat
2009-04-11 22:52 . 2009-04-11 22:52 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-11 19:11 . 2009-04-11 19:11 -------- d-----w c:\program files\C-Media 3D Audio
2009-04-11 19:11 . 2009-04-11 19:11 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-11 19:11 . 2009-04-11 19:02 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-11 19:02 . 2009-04-11 19:02 -------- d-----w c:\program files\S3
2009-04-11 19:02 . 2009-04-11 19:02 -------- d-----w c:\program files\VIA
2009-04-11 18:48 . 2009-04-11 18:48 -------- d-----w c:\program files\microsoft frontpage
2009-04-11 18:43 . 2009-04-11 18:43 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-16 17:50 . 2009-03-16 17:50 81984 ----a-w c:\windows\system32\bdod.bin
2009-03-08 01:34 . 2004-08-04 00:55 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 01:34 . 2004-08-04 00:55 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 01:33 . 2004-08-04 00:55 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 01:33 . 2004-08-04 00:55 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 01:32 . 2004-08-04 00:55 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 01:32 . 2004-08-04 00:55 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 01:31 . 2004-08-04 00:55 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 01:31 . 2004-08-04 00:53 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 01:31 . 2004-08-04 00:56 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 01:22 . 2001-09-19 15:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-04 00:55 283136 ----a-w c:\windows\system32\pdh.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2008-06-24 20:17 1569304 ----a-w c:\program files\Hotspot_Shield\tbHots.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2008-06-24 1569304]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-12 198160]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-05-18 206088]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [06/05/2009 04:14 م 604416]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-04-27 12:37]
2009-05-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
2009-05-18 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-18 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-05-18 c:\windows\Tasks\User_Feed_Synchronization-{B1E48AB9-F5EC-468C-8021-FD6EBEA75192}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 01:31]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Add to &LinkFox - c:\progra~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
FF - ProfilePath - c:\documents and settings\hussin\Application Data\Mozilla\Firefox\Profiles\yyj51c8o.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/firefox
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\documents and settings\hussin\Application Data\Mozilla\Firefox\Profiles\yyj51c8o.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2009-05-19 00:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3688)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-18 0:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-18 21:35
Pre-Run: 15,281,217,536 bytes free
Post-Run: 15,342,526,464 bytes free
257 --- E O F --- 2009-05-13 08:33
