أخي أعمل التالي بالترتيب
عطل برامج الحماية لديك
نزل هذه الاداة
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى الصق التقرير بردك الاول
هذا هو التقرير حق الاول ...
ComboFix 09-05-26.02 - XP 05/27/2009 12:24.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1918.1461 [GMT 3:00]
Running from: c:\documents and settings\XP\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-04-27 to 2009-05-27 )))))))))))))))))))))))))))))))
.
2009-05-25 18:06 . 2009-05-25 18:06 -------- d-----w c:\program files\Trend Micro
2009-05-23 11:38 . 2009-05-23 12:09 -------- d-----w c:\program files\3D Driving-School
2009-05-23 11:35 . 2009-05-23 11:35 -------- d-----w c:\documents and settings\XP\Local Settings\Application Data\Help
2009-05-21 08:38 . 2009-05-27 09:16 3400 ----a-w c:\windows\system32\winxtm.dll
2009-05-21 08:35 . 2009-05-21 16:47 -------- d-sh--w c:\program files\XSoft
2009-05-21 08:31 . 2009-05-21 08:32 -------- d-----w C:\PC
2009-05-21 08:31 . 2009-05-21 08:31 -------- d-----w c:\program files\MultiPing
2009-05-20 14:26 . 2009-05-20 14:26 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-05-20 14:26 . 2009-05-20 14:26 -------- d-----w c:\documents and settings\XP\Application Data\skypePM
2009-05-20 14:21 . 2009-05-27 09:18 -------- d-----w c:\documents and settings\XP\Application Data\Skype
2009-05-20 14:12 . 2009-05-20 14:12 -------- d-----w c:\program files\Common Files\Skype
2009-05-20 14:12 . 2009-05-20 14:12 -------- d-----r c:\program files\Skype
2009-05-20 14:12 . 2009-05-20 14:12 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-05-15 08:51 . 2009-05-15 08:53 592 ----a-w c:\windows\chgkey.vbs
2009-05-15 08:49 . 2009-05-15 08:49 -------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-13 08:11 . 2009-05-25 10:01 -------- d-----w c:\program files\Counter-Strike 1.6
2009-05-09 18:31 . 2009-05-12 14:22 -------- d-----w c:\documents and settings\All Users\Application Data\Test Drive Unlimited
2009-05-09 10:48 . 2009-05-09 10:48 -------- d-----w c:\documents and settings\XP\Local Settings\Application Data\RcIncidents
2009-05-08 08:40 . 2009-05-08 08:41 -------- d-----w c:\windows\system32\Adobe
2009-05-03 11:52 . 2009-05-21 18:04 -------- d-----w C:\Temp
2009-05-01 01:34 . 2009-05-01 01:45 -------- d-----w c:\program files\Hotspot Shield
2009-05-01 01:21 . 2009-05-03 10:51 -------- d-----w c:\program files\Hotspot_Shield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-27 09:20 . 2001-09-19 14:00 42048 ----a-w c:\windows\system32\perfc001.dat
2009-05-27 09:20 . 2001-09-19 14:00 257948 ----a-w c:\windows\system32\perfh001.dat
2009-05-27 09:16 . 2009-04-08 15:59 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-05-26 19:19 . 2009-04-08 15:59 466976 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-26 19:19 . 2009-04-08 15:59 2676 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-26 19:19 . 2009-04-08 15:59 2329632 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-26 19:19 . 2009-04-08 15:59 19280 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-26 13:15 . 2009-04-07 14:58 -------- d-----w c:\documents and settings\XP\Application Data\uTorrent
2009-05-23 10:08 . 2009-04-03 16:44 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-21 16:46 . 2009-04-03 16:24 -------- d-----w c:\program files\mpegable
2009-05-20 13:45 . 2009-04-08 15:59 94643 ----a-w c:\windows\system32\drivers\klick.dat
2009-05-20 13:45 . 2009-04-08 15:59 105395 ----a-w c:\windows\system32\drivers\klin.dat
2009-05-10 09:59 . 2009-04-03 16:45 -------- d-----w c:\program files\Google
2009-05-03 11:00 . 2009-05-03 10:55 -------- d-----w c:\documents and settings\XP\Application Data\cleaner
2009-05-03 10:55 . 2009-05-03 10:55 -------- d-----w c:\documents and settings\XP\Application Data\CyberScrub
2009-05-03 10:51 . 2009-04-11 11:10 -------- d-----w c:\program files\Conduit
2009-04-16 10:10 . 2009-04-16 10:08 -------- d-----w c:\program files\LeapFTP
2009-04-16 08:44 . 2009-04-16 08:31 -------- d-----w c:\documents and settings\XP\Application Data\SecondLife
2009-04-13 09:13 . 2009-04-13 09:13 -------- d-----w c:\program files\WildGames
2009-04-13 03:31 . 2009-04-03 16:42 -------- d-----w c:\documents and settings\XP\Application Data\Ahead
2009-04-12 12:29 . 2009-04-03 15:56 -------- d-----w c:\documents and settings\XP\Application Data\BSplayer Pro
2009-04-12 11:40 . 2009-04-12 11:39 -------- d-----w c:\program files\SWiSH Max2
2009-04-11 18:43 . 2009-04-03 16:30 -------- d-----w c:\documents and settings\XP\Application Data\Apple Computer
2009-04-11 18:02 . 2009-04-03 04:39 190040 ----a-w c:\documents and settings\XP\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-11 09:42 . 2009-04-03 15:56 -------- d-----w c:\program files\Common Files\Adobe
2009-04-10 17:13 . 2009-04-03 16:44 -------- d-----w c:\program files\Circle Developement
2009-04-09 06:39 . 2009-04-09 06:39 -------- d-----w c:\program files\MSXML 4.0
2009-04-08 18:51 . 2008-01-29 15:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-04-08 18:51 . 2009-04-08 18:51 33808 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\klbg.sys
2009-04-08 18:51 . 2009-04-08 18:51 213520 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\XP\klif.sys
2009-04-08 18:51 . 2009-04-08 18:51 21256 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\vkbd.dll
2009-04-08 18:51 . 2009-04-08 18:51 861448 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\updater.dll
2009-04-08 18:50 . 2009-04-08 18:50 83208 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\mzvkbd.dll
2009-04-08 18:50 . 2009-04-08 18:50 62728 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ievkbd.dll
2009-04-08 18:50 . 2009-04-08 18:50 43784 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\fssync.dll
2009-04-08 18:50 . 2009-04-08 18:50 365832 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ckahum.dll
2009-04-08 18:50 . 2009-04-08 18:50 201992 ----a-w c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\avp.exe
2009-04-08 18:36 . 2009-04-08 18:36 0 ----a-w c:\documents and settings\XP\jagex_runescape_preferences.dat
2009-04-08 18:34 . 2009-04-08 18:34 57344 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-2ba8c07f-n\Decora-SSE.dll
2009-04-08 18:34 . 2009-04-08 18:34 24064 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-77e0844e-n\Decora-D3D.dll
2009-04-08 18:34 . 2009-04-08 18:34 315392 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5a9dde51-n\jogl.dll
2009-04-08 18:34 . 2009-04-08 18:34 20480 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5a9dde51-n\jogl_awt.dll
2009-04-08 18:34 . 2009-04-08 18:34 114688 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-5a9dde51-n\jogl_cg.dll
2009-04-08 18:34 . 2009-04-08 18:34 20480 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-26f02d4c-n\gluegen-rt.dll
2009-04-08 18:34 . 2009-04-08 18:34 348160 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-7d12a2ba-n\msvcr71.dll
2009-04-08 18:34 . 2009-04-08 18:34 499712 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-7d12a2ba-n\msvcp71.dll
2009-04-08 18:34 . 2009-04-08 18:34 499712 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-7d12a2ba-n\jmc.dll
2009-04-08 18:33 . 2009-04-08 18:34 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-08 18:33 . 2009-04-08 18:33 -------- d-----w c:\program files\Java
2009-04-08 18:33 . 2009-04-08 18:33 152576 ----a-w c:\documents and settings\XP\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-08 15:59 . 2009-04-08 15:59 -------- d-----w c:\program files\Kaspersky Lab
2009-04-08 15:57 . 2009-04-08 15:57 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-08 10:04 . 2009-04-08 10:04 -------- d-----w c:\documents and settings\XP\Application Data\Media Player Classic
2009-04-07 14:58 . 2009-04-07 14:58 -------- d-----w c:\program files\uTorrent
2009-04-07 14:34 . 2009-04-07 14:34 390664 ----a-w c:\documents and settings\XP\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-04-07 11:35 . 2009-04-03 02:29 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-07 10:22 . 2009-04-07 10:22 -------- d-----w c:\program files\Common Files\xing shared
2009-04-07 10:22 . 2009-04-03 16:40 -------- d-----w c:\program files\Common Files\Real
2009-04-03 18:18 . 2009-04-03 18:18 33256 ----a-w c:\windows\system32\drivers\HssDrv.sys
2009-04-03 17:06 . 2009-04-03 17:06 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-03 16:47 . 2009-04-03 16:47 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-03 16:46 . 2009-04-03 16:46 -------- d-----w c:\program files\DivX
2009-04-03 16:45 . 2009-04-03 16:45 -------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-04-03 16:45 . 2009-04-03 16:45 -------- d-----w c:\documents and settings\XP\Application Data\GRETECH
2009-04-03 16:45 . 2009-04-03 16:45 -------- d-----w c:\program files\GRETECH
2009-04-03 16:43 . 2009-04-03 16:43 -------- d-----w c:\program files\Windows Live
2009-04-03 16:42 . 2009-04-03 16:41 -------- d-----w c:\program files\Common Files\Ahead
2009-04-03 16:41 . 2009-04-03 16:41 -------- d-----w c:\program files\Nero
2009-04-03 16:41 . 2009-04-03 16:41 -------- d-----w c:\documents and settings\All Users\Application Data\Nero
2009-04-03 16:40 . 2009-04-03 15:57 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-03 16:40 . 2009-04-03 15:57 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-03 16:40 . 2009-04-03 16:40 -------- d-----w c:\program files\Real
2009-04-03 16:35 . 2009-04-03 02:38 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-03 16:34 . 2009-04-03 16:34 -------- d-----w c:\program files\ESET
2009-04-03 16:34 . 2009-04-03 16:34 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-04-03 16:30 . 2009-04-03 16:30 -------- d-----w c:\program files\QuickTime
2009-04-03 16:30 . 2009-04-03 16:30 -------- d-----w c:\program files\iPod
2009-04-03 16:30 . 2009-04-03 16:30 -------- d-----w c:\program files\iTunes
2009-04-03 16:30 . 2009-04-03 16:29 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-03 16:25 . 2009-04-03 16:25 -------- d-----w c:\program files\Microsoft.NET
2009-04-03 16:25 . 2009-04-03 16:25 -------- d-----w c:\program files\Microsoft ActiveSync
2009-04-03 16:24 . 2009-04-03 16:24 47104 ------w c:\windows\AKDeInstall.exe
2009-04-03 16:02 . 2009-04-03 16:00 -------- d-----w c:\program files\Acala DivX DVD Player Assist
2009-04-03 16:00 . 2009-04-03 02:37 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-03 16:00 . 2009-04-03 15:57 -------- d-----w c:\program files\CyberLink
2009-04-03 15:58 . 2009-04-03 15:58 -------- d-----w c:\documents and settings\XP\Application Data\CyberLink
2009-04-03 15:58 . 2009-04-03 15:58 -------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-04-03 15:56 . 2009-04-03 15:56 -------- d-----w c:\program files\Webteh
2009-04-03 02:40 . 2009-04-03 02:40 -------- d-----w c:\program files\Realtek
2009-04-03 02:40 . 2009-04-03 02:40 315392 ----a-w c:\windows\HideWin.exe
2009-04-03 02:39 . 2009-04-03 02:39 -------- d-----w c:\program files\Driver
2009-04-03 02:38 . 2009-04-03 02:38 -------- d-----w c:\program files\S3
2009-04-03 02:37 . 2009-04-03 02:37 -------- d-----w c:\program files\VIA
2009-04-03 02:30 . 2009-04-03 02:30 -------- d-----w c:\program files\microsoft frontpage
2009-04-03 02:27 . 2009-04-03 02:27 22144 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-06 14:20 . 2008-04-14 10:29 283136 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:06 . 2008-04-14 10:29 826368 ----a-w c:\windows\system32\wininet.dll
.
(((((((((((((((((((((((((((((
SnapShot@2009-05-26_09.31.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-27 09:16 . 2009-05-27 09:16 16384 c:\windows\Temp\Perflib_Perfdata_260.dat
- 2001-09-19 14:00 . 2009-05-26 08:54 42068 c:\windows\system32\perfc009.dat
+ 2001-09-19 14:00 . 2009-05-27 09:20 42068 c:\windows\system32\perfc009.dat
+ 2001-09-19 14:00 . 2009-05-27 09:20 265496 c:\windows\system32\perfh009.dat
- 2001-09-19 14:00 . 2009-05-26 08:54 265496 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-21 24264488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-10-06 278528]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-04-03 155648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-07 198160]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-08 201992]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-08 148888]
"winxld"="c:\program files\XSoft\xworking\xld.exe" [2006-11-21 40448]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2006-09-21 53248]
"S3Trayp"="S3trayp.exe" - c:\windows\system32\S3Trayp.exe [2007-06-11 176128]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-10-11 1826816]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-4-11 113664]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
«©م، ¢¬نïé Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{67C4682D-5AED-48DB-83CB-2B53270E9BCB}"= "c:\progra~1\XSoft\xworking\AMon.dll" [2006-09-14 169984]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\English\\setup.exe"=
"c:\\Program Files\\LeapFTP\\LeapFTP.exe"=
"c:\\Documents and Settings\\XP\\سطح المكتب\\Live For Speed\\LFS.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [03/04/2009 05:38 ص 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [03/04/2009 05:38 ص 52224]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [03/04/2009 05:37 ص 13696]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14/11/2007 03:06 م 30728]
R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [22/04/2009 04:12 ص 328752]
R2 SystemLoginService;Login Service;c:\program files\XSoft\xworking\sysrts.exe [21/05/2009 11:35 ص 456192]
R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\system32\drivers\HssDrv.sys [03/04/2009 09:18 م 33256]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [25/03/2008 08:07 م 24592]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [11/07/2007 01:08 م 714240]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [23/04/2009 12:34 ص 34352]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-27 12:26
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1860)
c:\windows\system32\klogon.dll
- - - - - - - > 'explorer.exe'(2312)
c:\program files\XSoft\xworking\KeyMon.dll
.
Completion time: 2009-05-27 12:27
ComboFix-quarantined-files.txt 2009-05-27 09:27
ComboFix2.txt 2009-05-26 09:32
Pre-Run: 4,707,315,712 bytes free
Post-Run: 4,738,560,000 bytes free
237 --- E O F --- 2009-05-16 18:57