format
زيزوومي ماسى
غير متصل
- بادئ الموضوع format
- تاريخ البدء
- 1,027
وعليكم السلام
حيااك يا الغلا
تابع هذه المواضيع
أو
واذا ما نفع هات تقرير هايجاك
بالآآنتظآآر ,,.
حيااك يا الغلا
تابع هذه المواضيع
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
أو
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
واذا ما نفع هات تقرير هايجاك
بالآآنتظآآر ,,.
توقيع : أعتز بك
تأييد
0
format
زيزوومي ماسى
غير متصل
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:41:53 م, on 31/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe
C:\Program Files\AvaFind\AvaFind.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\No-IP\DUC20.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
D:\حاتم\RAmi\متصفح 2009\TheWorld.exe
C:\DOCUME~1\User\LOCALS~1\Temp\Rar$EX00.282\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [viruscleaner] "C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe" h
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE -a
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AvaFind] "C:\Program Files\AvaFind\AvaFind.exe" /minimized
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5652 bytes
Scan saved at 02:41:53 م, on 31/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe
C:\Program Files\AvaFind\AvaFind.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\No-IP\DUC20.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
D:\حاتم\RAmi\متصفح 2009\TheWorld.exe
C:\DOCUME~1\User\LOCALS~1\Temp\Rar$EX00.282\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [viruscleaner] "C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe" h
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE -a
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AvaFind] "C:\Program Files\AvaFind\AvaFind.exe" /minimized
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5652 bytes
توقيع : format
تأييد
0
format
زيزوومي ماسى
غير متصل
ComboFix 08-08-18.01 - User 05/31/2009 15:22:04.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.206 [GMT 4.5:30]
Running from: C:\Documents and Settings\User\سطح المكتب\ComboFix1.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Screen2Exe
C:\Program Files\Screen2Exe\instlog.lsl
C:\Program Files\Screen2Exe\Screen2Exe.exe
C:\Program Files\Screen2Exe\Screen2Exe.ini
C:\Program Files\Screen2Exe\ScrSelfPlayer.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-31 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 10:52 --------- d-----w C:\Documents and Settings\User\Application Data\DMCache
2009-05-31 09:17 --------- d-----w C:\Documents and Settings\User\Application Data\Thinstall
2009-05-31 08:52 --------- d-----w C:\Documents and Settings\User\Application Data\AvaFind Data
2009-05-31 03:35 --------- d-----w C:\Documents and Settings\User\Application Data\IDM
2009-05-31 03:14 --------- d-----w C:\Documents and Settings\User\Application Data\cleaner
2009-05-31 02:02 --------- d-----w C:\Program Files\Quranzu1
2009-05-31 00:09 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{1A00B0E0-0814-4C47-A5BF-F8602CAF5100}
2009-05-31 00:08 --------- d-----w C:\Documents and Settings\User\Application Data\Blueberry
2009-05-31 00:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2009-05-30 23:39 4,608 ----a-w C:\WINDOWS\system32\bbchlp.dll
2009-05-30 23:39 4,096 ----a-w C:\WINDOWS\system32\drivers\bbcap.sys
2009-05-30 23:39 30,720 ----a-w C:\WINDOWS\system32\bbcap.dll
2009-05-30 23:39 --------- d-----w C:\Documents and Settings\User\Application Data\LogSys
2009-05-30 23:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogSys
2009-05-30 22:09 40,960 ----a-w C:\WINDOWS\system32\SSubTmr6.dll
2009-05-30 22:07 --------- d-----w C:\Program Files\arabic2regclean
2009-05-30 18:54 --------- d-----w C:\Program Files\مشغل الفلاش العربي
2009-05-30 17:14 --------- d-----w C:\Program Files\temp
2009-05-30 17:13 --------- d-----w C:\Program Files\USB Disk Security
2009-05-30 13:22 --------- d-----w C:\Documents and Settings\User\Application Data\uTorrent
2009-05-29 16:57 --------- d-----w C:\Program Files\RLPack
2009-05-29 16:41 --------- d-----w C:\Documents and Settings\User\Application Data\TeamViewer
2009-05-29 06:30 --------- d-----w C:\Program Files\uTorrent
2009-05-29 06:06 --------- d-----w C:\Program Files\No-IP
2009-05-29 04:42 --------- d-----w C:\Program Files\Tarneeb
2009-05-29 03:49 --------- d-----w C:\Program Files\PicaView32
2009-05-28 21:45 --------- d-----w C:\Documents and Settings\User\Application Data\Malwarebytes
2009-05-28 21:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-05-28 21:26 121,820 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2009-05-28 21:26 10,303,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2009-05-28 04:44 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{6CF41A80-289A-4651-96E0-C4829485C662}
2009-05-28 04:43 --------- d-----w C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic
2009-05-28 04:23 --------- d-----w C:\Program Files\Resource Tuner
2009-05-28 03:29 --------- d-----w C:\Program Files\Messenger Plus! Live
2009-05-28 03:26 --------- d-----w C:\Program Files\Internet Download Manager
2009-05-28 03:15 --------- d-----w C:\Program Files\K-Lite Codec Pack
2009-05-28 03:14 --------- d-----w C:\Program Files\Windows Live
2009-05-28 03:14 --------- d-----w C:\Program Files\Google
2009-05-27 16:45 --------- d-----w C:\Documents and Settings\User\Application Data\Resource Tuner
2009-05-27 16:45 --------- d-----w C:\Documents and Settings\User\Application Data\PE Explorer
2009-05-27 16:34 --------- d-----w C:\Documents and Settings\User\Application Data\CyberScrub
2009-05-27 10:14 --------- d-----w C:\Program Files\iWin.com
2009-05-27 10:14 --------- d-----w C:\Documents and Settings\User\Application Data\ScreenSeven
2009-05-27 10:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\iWin Games
2009-05-27 08:16 --------- d-----w C:\Program Files\Ringz Studio
2009-05-27 08:16 --------- d-----w C:\Program Files\Common Files\Real
2009-05-27 08:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-05-27 08:05 --------- d-----w C:\Documents and Settings\User\Application Data\URSoft
2009-05-25 17:39 --------- d-----w C:\Documents and Settings\User\Application Data\Media Player Classic
2009-05-25 16:45 --------- d-----w C:\Program Files\Realtek Sound Manager
2009-05-25 16:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2009-05-25 16:45 --------- d-----w C:\Program Files\AvRack
2009-05-25 16:33 --------- d-----w C:\Program Files\DIFX
2009-05-25 16:22 --------- d-----w C:\Program Files\microsoft frontpage
2009-05-25 16:21 --------- d-----w C:\Program Files\MSXML 4.0
2009-05-05 02:37 --------- d-----w C:\Program Files\AvaFind
2009-05-05 02:36 --------- d-----w C:\Program Files\Common Files\xing shared
2009-05-05 02:35 --------- d-----w C:\Program Files\Real
2009-05-05 02:28 --------- d-----w C:\Program Files\Common Files\Adobe
2009-03-26 15:35 210,352 ----a-w C:\WINDOWS\system32\idmmbc.dll
2009-03-26 15:35 210,352 ----a-w C:\WINDOWS\system32\idmmbc(2).dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/15/2008 10:30 PM 15360]
"MsnMsgr"="C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe" [03/02/2008 10:44 PM 5725208]
"AvaFind"="C:\Program Files\AvaFind\AvaFind.exe" [06/01/2004 02:48 PM 295936]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [05/28/2009 08:07 AM 2807216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [09/20/2005 03:05 PM 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [09/20/2005 03:02 PM 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [09/20/2005 03:06 PM 114688]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [06/10/2008 06:52 PM 1447168]
"viruscleaner"="C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe" [03/27/2008 03:48 AM 552960]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05/05/2009 07:05 AM 180269]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM 39792]
"DWPersistentQueuedReporting"="C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE" [04/25/2005 03:15 PM 36040]
"USB Antivirus"="C:\Program Files\USB Disk Security\USBGuard.exe" [09/23/2008 05:21 PM 318464]
"SoundMan"="SOUNDMAN.EXE" [11/15/2004 02:50 PM 77824 C:\WINDOWS\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [04/15/2008 10:30 PM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
C:\Documents and Settings\User\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
No-IP DUC.lnk - C:\Program Files\No-IP\DUC20.exe [2009-05-29 10:36:33 1172992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live Messenger Khalid Edition v5.5 Arabic\\msnmsgr.exe"=
"D:\\حاتم\\برامج\\اجهزة\\][دوٍرٍة أحترٍأف أخترٍأق الأجهزة][\\ألدرٍس ألرٍأبع شرٍح لبرٍأمج الأخترٍأق البيفورست+الشل+البيوسن\\برٍأمج الأخترٍأق\\PI 2.3.2\\DeXTeR Franklin.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"81:TCP"= 81:TCP:bifrost
"81:UDP"= 81:UDP:bifrost
R0 ulsata2;ulsata2;C:\WINDOWS\system32\drivers\ulsata2.sys [09/18/2008 04:12 AM]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [06/10/2008 06:56 PM]
R3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [05/31/2009 04:09 AM]
R3 ip100xp;ASUS NX1001 Network Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [03/27/2006 07:18 AM]
*Newly Created Service* - CATCHME
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vv67sa90.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-05-31 15:22:30
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 05/31/2009 15:24:59
ComboFix-quarantined-files.txt 2009-05-31 10:54:54
Pre-Run: 35,227,779,072 bytes free
Post-Run: 35,266,609,152 bytes free
153
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.206 [GMT 4.5:30]
Running from: C:\Documents and Settings\User\سطح المكتب\ComboFix1.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Screen2Exe
C:\Program Files\Screen2Exe\instlog.lsl
C:\Program Files\Screen2Exe\Screen2Exe.exe
C:\Program Files\Screen2Exe\Screen2Exe.ini
C:\Program Files\Screen2Exe\ScrSelfPlayer.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-31 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-31 10:52 --------- d-----w C:\Documents and Settings\User\Application Data\DMCache
2009-05-31 09:17 --------- d-----w C:\Documents and Settings\User\Application Data\Thinstall
2009-05-31 08:52 --------- d-----w C:\Documents and Settings\User\Application Data\AvaFind Data
2009-05-31 03:35 --------- d-----w C:\Documents and Settings\User\Application Data\IDM
2009-05-31 03:14 --------- d-----w C:\Documents and Settings\User\Application Data\cleaner
2009-05-31 02:02 --------- d-----w C:\Program Files\Quranzu1
2009-05-31 00:09 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{1A00B0E0-0814-4C47-A5BF-F8602CAF5100}
2009-05-31 00:08 --------- d-----w C:\Documents and Settings\User\Application Data\Blueberry
2009-05-31 00:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2009-05-30 23:39 4,608 ----a-w C:\WINDOWS\system32\bbchlp.dll
2009-05-30 23:39 4,096 ----a-w C:\WINDOWS\system32\drivers\bbcap.sys
2009-05-30 23:39 30,720 ----a-w C:\WINDOWS\system32\bbcap.dll
2009-05-30 23:39 --------- d-----w C:\Documents and Settings\User\Application Data\LogSys
2009-05-30 23:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogSys
2009-05-30 22:09 40,960 ----a-w C:\WINDOWS\system32\SSubTmr6.dll
2009-05-30 22:07 --------- d-----w C:\Program Files\arabic2regclean
2009-05-30 18:54 --------- d-----w C:\Program Files\مشغل الفلاش العربي
2009-05-30 17:14 --------- d-----w C:\Program Files\temp
2009-05-30 17:13 --------- d-----w C:\Program Files\USB Disk Security
2009-05-30 13:22 --------- d-----w C:\Documents and Settings\User\Application Data\uTorrent
2009-05-29 16:57 --------- d-----w C:\Program Files\RLPack
2009-05-29 16:41 --------- d-----w C:\Documents and Settings\User\Application Data\TeamViewer
2009-05-29 06:30 --------- d-----w C:\Program Files\uTorrent
2009-05-29 06:06 --------- d-----w C:\Program Files\No-IP
2009-05-29 04:42 --------- d-----w C:\Program Files\Tarneeb
2009-05-29 03:49 --------- d-----w C:\Program Files\PicaView32
2009-05-28 21:45 --------- d-----w C:\Documents and Settings\User\Application Data\Malwarebytes
2009-05-28 21:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-05-28 21:26 121,820 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2009-05-28 21:26 10,303,520 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2009-05-28 04:44 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{6CF41A80-289A-4651-96E0-C4829485C662}
2009-05-28 04:43 --------- d-----w C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic
2009-05-28 04:23 --------- d-----w C:\Program Files\Resource Tuner
2009-05-28 03:29 --------- d-----w C:\Program Files\Messenger Plus! Live
2009-05-28 03:26 --------- d-----w C:\Program Files\Internet Download Manager
2009-05-28 03:15 --------- d-----w C:\Program Files\K-Lite Codec Pack
2009-05-28 03:14 --------- d-----w C:\Program Files\Windows Live
2009-05-28 03:14 --------- d-----w C:\Program Files\Google
2009-05-27 16:45 --------- d-----w C:\Documents and Settings\User\Application Data\Resource Tuner
2009-05-27 16:45 --------- d-----w C:\Documents and Settings\User\Application Data\PE Explorer
2009-05-27 16:34 --------- d-----w C:\Documents and Settings\User\Application Data\CyberScrub
2009-05-27 10:14 --------- d-----w C:\Program Files\iWin.com
2009-05-27 10:14 --------- d-----w C:\Documents and Settings\User\Application Data\ScreenSeven
2009-05-27 10:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\iWin Games
2009-05-27 08:16 --------- d-----w C:\Program Files\Ringz Studio
2009-05-27 08:16 --------- d-----w C:\Program Files\Common Files\Real
2009-05-27 08:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-05-27 08:05 --------- d-----w C:\Documents and Settings\User\Application Data\URSoft
2009-05-25 17:39 --------- d-----w C:\Documents and Settings\User\Application Data\Media Player Classic
2009-05-25 16:45 --------- d-----w C:\Program Files\Realtek Sound Manager
2009-05-25 16:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2009-05-25 16:45 --------- d-----w C:\Program Files\AvRack
2009-05-25 16:33 --------- d-----w C:\Program Files\DIFX
2009-05-25 16:22 --------- d-----w C:\Program Files\microsoft frontpage
2009-05-25 16:21 --------- d-----w C:\Program Files\MSXML 4.0
2009-05-05 02:37 --------- d-----w C:\Program Files\AvaFind
2009-05-05 02:36 --------- d-----w C:\Program Files\Common Files\xing shared
2009-05-05 02:35 --------- d-----w C:\Program Files\Real
2009-05-05 02:28 --------- d-----w C:\Program Files\Common Files\Adobe
2009-03-26 15:35 210,352 ----a-w C:\WINDOWS\system32\idmmbc.dll
2009-03-26 15:35 210,352 ----a-w C:\WINDOWS\system32\idmmbc(2).dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04/15/2008 10:30 PM 15360]
"MsnMsgr"="C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe" [03/02/2008 10:44 PM 5725208]
"AvaFind"="C:\Program Files\AvaFind\AvaFind.exe" [06/01/2004 02:48 PM 295936]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [05/28/2009 08:07 AM 2807216]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [09/20/2005 03:05 PM 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [09/20/2005 03:02 PM 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [09/20/2005 03:06 PM 114688]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [06/10/2008 06:52 PM 1447168]
"viruscleaner"="C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe" [03/27/2008 03:48 AM 552960]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05/05/2009 07:05 AM 180269]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM 39792]
"DWPersistentQueuedReporting"="C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE" [04/25/2005 03:15 PM 36040]
"USB Antivirus"="C:\Program Files\USB Disk Security\USBGuard.exe" [09/23/2008 05:21 PM 318464]
"SoundMan"="SOUNDMAN.EXE" [11/15/2004 02:50 PM 77824 C:\WINDOWS\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [04/15/2008 10:30 PM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
C:\Documents and Settings\User\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
No-IP DUC.lnk - C:\Program Files\No-IP\DUC20.exe [2009-05-29 10:36:33 1172992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live Messenger Khalid Edition v5.5 Arabic\\msnmsgr.exe"=
"D:\\حاتم\\برامج\\اجهزة\\][دوٍرٍة أحترٍأف أخترٍأق الأجهزة][\\ألدرٍس ألرٍأبع شرٍح لبرٍأمج الأخترٍأق البيفورست+الشل+البيوسن\\برٍأمج الأخترٍأق\\PI 2.3.2\\DeXTeR Franklin.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"81:TCP"= 81:TCP:bifrost
"81:UDP"= 81:UDP:bifrost
R0 ulsata2;ulsata2;C:\WINDOWS\system32\drivers\ulsata2.sys [09/18/2008 04:12 AM]
R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [06/10/2008 06:56 PM]
R3 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [05/31/2009 04:09 AM]
R3 ip100xp;ASUS NX1001 Network Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [03/27/2006 07:18 AM]
*Newly Created Service* - CATCHME
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\vv67sa90.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2009-05-31 15:22:30
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 05/31/2009 15:24:59
ComboFix-quarantined-files.txt 2009-05-31 10:54:54
Pre-Run: 35,227,779,072 bytes free
Post-Run: 35,266,609,152 bytes free
153
توقيع : format
تأييد
0
format
زيزوومي ماسى
غير متصل
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:02:23 م, on 31/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe
C:\Program Files\AvaFind\AvaFind.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
D:\حاتم\RAmi\متصفح 2009\TheWorld.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Default User\Local Settings\Temp\birr8y9sd\uruninstaller.exe
C:\Documents and Settings\Default User\Local Settings\Temp\birr8y9sd\uruninstaller.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\User\LOCALS~1\Temp\Rar$EX00.172\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE -a
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5293 bytes
Scan saved at 04:02:23 م, on 31/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Abadisoft\Avc 4.0\AbadisoftCleanVirus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe
C:\Program Files\AvaFind\AvaFind.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
D:\حاتم\RAmi\متصفح 2009\TheWorld.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Default User\Local Settings\Temp\birr8y9sd\uruninstaller.exe
C:\Documents and Settings\Default User\Local Settings\Temp\birr8y9sd\uruninstaller.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\User\LOCALS~1\Temp\Rar$EX00.172\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE -a
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live Messenger Khalid Edition v5.5 Arabic\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5293 bytes
توقيع : format
تأييد
0