الأخ ( اعتز بك ) اشكرك على استجابتك وأسأل الله الكريم ونحن في الثلث الأخير من الليل أن يوفقك ويسهل لك كل ما تتمنى
هذا الرد الأول
ComboFix 09-04-23.A3 - ahn 06/03/2009 1:28.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.1919.1402 [GMT 3:00]
Running from: c:\documents and settings\ahn\My Documents\Downloads\Programs\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090601-0] *On-access scanning disabled* (Updated)
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\FunWebProducts
c:\program files\ShoppingReport
c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
c:\program files\ShoppingReport\Uninst.exe
c:\windows\system32\AutoRun.inf
.
((((((((((((((((((((((((( Files Created from 2009-07-02 to 2009-6-2 )))))))))))))))))))))))))))))))
.
2009-06-01 23:12 . 2009-06-01 23:12 -------- d-----w c:\program files\Trend Micro
2009-05-31 00:27 . 2009-05-31 00:27 197560 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-05-31 00:04 . 2009-06-01 00:22 -------- d-----w c:\documents and settings\All Users\Application Data\RFA_Backups
2009-05-31 00:04 . 2009-05-31 00:04 -------- d-----w c:\program files\RFA
2009-05-30 21:59 . 2009-05-30 23:30 -------- d-----w c:\program files\Hotspot Shield
2009-05-30 01:49 . 2009-05-30 01:50 -------- dc-h--w c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-05-30 01:13 . 2009-05-30 11:49 -------- d-----w c:\program files\Uniblue
2009-05-30 01:13 . 2009-05-30 01:50 -------- d-----w c:\documents and settings\ahn\Application Data\Uniblue
2009-05-30 01:13 . 2009-05-30 01:16 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-05-30 01:10 . 2009-05-30 01:14 -------- dc-h--w c:\documents and settings\All Users\Application Data\{5A76C6B3-3FA8-46D0-AA81-62C3805E38BC}
2009-05-30 00:21 . 2009-05-30 00:21 -------- d-----w c:\documents and settings\ahn\Application Data\PC Updater
2009-05-30 00:01 . 2009-05-30 00:01 0 ----a-w c:\windows\system32\Ultra.dll
2009-05-29 23:54 . 2009-05-30 00:41 -------- d-----w c:\program files\Bug Doctor
2009-05-19 10:01 . 2009-05-19 10:01 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\IsoBuster
2009-05-08 14:25 . 2006-11-06 12:30 262144 ----a-w c:\windows\system32\lame_enc.dll
2009-05-08 14:25 . 2006-07-28 22:22 51712 ----a-w c:\windows\system32\coodest.dll
2009-05-08 14:25 . 2005-05-19 11:42 1458176 ----a-w c:\windows\system32\osenxpsuite2005.ocx
2009-05-08 14:25 . 2005-05-19 00:17 40960 ----a-w c:\windows\system32\osenxpsuite2005.dll
2009-05-08 14:25 . 2005-05-16 13:27 53248 ----a-w c:\windows\system32\AloFrame.ocx
2009-05-08 14:25 . 2000-05-22 13:58 608448 ----a-w c:\windows\system32\comctl32.ocx
2009-05-08 14:25 . 2009-05-08 14:25 -------- d-----w c:\program files\Ozone
2009-05-08 12:17 . 2008-04-08 10:34 401408 ----a-w c:\program files\record Crack.exe
2009-05-08 11:39 . 2009-05-08 17:04 -------- d-----w c:\documents and settings\ahn\Local Settings\Application Data\IsoBuster
2009-05-08 11:39 . 2009-05-29 12:04 -------- d-----w c:\program files\IsoBuster
2009-05-08 11:39 . 2009-05-08 11:39 -------- d-----w c:\program files\Smart Projects
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-02 22:29 . 2008-09-28 17:20 -------- d-----w c:\documents and settings\ahn\Application Data\DMCache
2009-06-01 22:14 . 2008-11-09 00:18 -------- d-----w c:\documents and settings\ahn\Application Data\Thinstall
2009-05-31 22:06 . 2008-09-01 18:11 -------- d-----w c:\program files\Messenger Plus! Live
2009-05-31 00:02 . 2008-09-03 12:09 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-13 23:31 . 2008-06-20 20:53 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-08 14:26 . 2009-05-08 14:26 344064 ----a-w c:\windows\system32\dkll.dll
2009-05-08 14:26 . 2008-06-29 21:40 196608 ----a-w c:\windows\system32\maag.dll
2009-05-08 14:26 . 2008-06-29 21:40 1212416 ----a-w c:\windows\system32\ckll.dll
2009-05-08 14:26 . 2008-06-29 21:40 1986560 ----a-w c:\windows\system32\akll.dll
2009-05-03 18:51 . 2009-04-26 02:17 -------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-04-30 19:30 . 2009-04-26 00:40 -------- d-----w c:\program files\Microsoft Silverlight
2009-04-29 00:48 . 2009-04-29 00:48 -------- d-----w c:\program files\Satellite TV on PC
2009-04-29 00:24 . 2008-07-07 18:37 -------- d-----w c:\documents and settings\ahn\Application Data\Skype
2009-04-28 23:57 . 2009-04-28 23:57 -------- d-----w c:\program files\HiFisoftware
2009-04-28 22:45 . 2008-07-07 18:40 -------- d-----w c:\documents and settings\ahn\Application Data\skypePM
2009-04-26 16:21 . 2009-04-26 01:17 -------- d-----w c:\program files\Cicle Developement
2009-04-26 02:17 . 2009-04-26 02:17 -------- d-----w c:\program files\MyProduct
2009-04-26 01:19 . 2009-04-26 01:19 -------- d-----w c:\program files\Circle Dvelopement
2009-04-26 01:15 . 2008-06-25 00:13 -------- d-----w c:\program files\Windows Live
2009-04-26 00:40 . 2009-04-26 00:40 -------- d-----w c:\program files\Microsoft Office Outlook Connector
2009-04-26 00:38 . 2009-04-26 00:38 -------- d-----w c:\program files\Microsoft
2009-04-25 22:26 . 2009-04-23 23:31 -------- d-----w c:\program files\Acoustica MP3 Audio Mixer
2009-04-25 22:26 . 2009-04-25 22:26 -------- d-----w c:\documents and settings\ahn\Application Data\ShoppingReport
2009-04-25 22:23 . 2009-04-25 22:23 -------- d-----w c:\program files\Alta Softworks
2009-04-24 16:59 . 2009-04-24 16:59 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-04-24 16:59 . 2009-04-24 16:59 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-04-24 16:53 . 2009-04-24 16:53 -------- d-----w c:\documents and settings\All Users\Application Data\Nokia
2009-04-24 16:51 . 2008-10-02 11:48 -------- d-----w c:\program files\Nokia
2009-04-24 16:49 . 2008-12-24 01:43 -------- d-----w c:\program files\Common Files\Nokia
2009-04-24 16:49 . 2009-04-24 16:49 -------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-04-24 00:29 . 2008-12-09 15:40 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-04-23 20:02 . 2008-06-20 20:21 -------- d-----w c:\program files\Java
2009-04-23 19:59 . 2009-04-23 19:59 -------- d-----w c:\program files\Common Files\xing shared
2009-04-23 19:59 . 2008-06-20 20:16 -------- d-----w c:\program files\Common Files\Real
2009-04-23 19:59 . 2009-04-23 19:59 -------- d-----w c:\program files\Hotspot_Shield
2009-04-23 19:59 . 2009-04-23 19:59 -------- d-----w c:\program files\Conduit
2009-04-23 19:58 . 2009-04-23 19:58 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-23 19:58 . 2009-04-23 19:58 -------- d-----w c:\program files\Opera Software
2009-04-19 01:34 . 2008-06-20 04:50 99496 ----a-w c:\documents and settings\ahn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-15 23:17 . 2009-04-15 23:17 -------- d-----w c:\documents and settings\ahn\Application Data\Ectaco
2009-04-09 17:17 . 2008-10-15 18:50 -------- d-----w c:\program files\Recuva
2009-03-29 01:42 . 2009-03-29 01:42 1968736 ----a-w C:\12377665455474790032281.rm
2009-03-23 00:54 . 2009-02-04 15:00 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2008-04-14 11:42 284160 ----a-w c:\windows\system32\pdh.dll
2008-10-17 18:59 . 2008-10-17 18:59 99496 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-09-27 03:39 . 2008-09-27 03:39 0 ----a-w c:\program files\Common Files\dht342126
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]
2009-05-29 12:05 2094616 ----a-w c:\program files\IsoBuster\tbIso0.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-03-27 21:12 1164600 ----a-w c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-03-27 1164600]
"{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}"= "c:\program files\IsoBuster\tbIso0.dll" [2009-05-29 2094616]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-03-27 1164600]
"{266FCDCA-7BB3-4DA7-B3BF-F845DEA2EBD6}"= "c:\program files\IsoBuster\tbIso0.dll" [2009-05-29 2094616]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CLASSES_ROOT\clsid\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-05-12 3885408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-01-07 2610608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-31 68856]
"Google Update"="c:\documents and settings\ahn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-11 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-26 786521]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-20 198160]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"rfagent"="c:\program files\RFA\rfagent.exe" [2008-11-24 916800]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-23 2756608]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave4"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^ahn^Start Menu^Programs^Startup^Adobe Media Player.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Adobe\Adobe Media Player.lnk
backup=c:\windows\pss\Adobe Media Player.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^ahn^Start Menu^Programs^Startup^CCC.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Catalyst Control Center\CCC.lnk
[HKLM\~\startupfolder\C:^Documents and Settings^ahn^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GetRight - Tray Icon.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^سرعة تشغيل Adobe Reader.lnk]
backup=c:\windows\pss\سرعة تشغيل Adobe Reader.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"TOSHIBA Bluetooth Service"=2 (0x2)
"Microsoft Office Groove Audit Service"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9039:TCP"= 9039:TCP:BitComet 9039 TCP
"9039:UDP"= 9039:UDP:BitComet 9039 UDP
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
S2 gearsec;gearsec;c:\windows\system32\gearsec.exe [2003-12-01 53248]
S3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\DRIVERS\l251x86.sys [2007-08-21 30208]
S3 SynMini;USB2.0 1.3M WebCam;c:\windows\system32\Drivers\SynMini.sys [2008-06-20 1116544]
S3 SynScan;USB2.0 1.3M WebCam Still Image;c:\windows\system32\Drivers\SynScan.sys [2008-06-20 7808]
S3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2007-07-04 57344]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a698f7e4-ba3b-11dd-b8cc-000ea6f33393}]
\shEll\auToPlaY\comMaNd - xuma.exe
\shEll\AutoRun\command - xuma.exe
\shEll\exPLORe\COmMANd - xuma.exe
\shEll\OpEN\CoMmAnd - xuma.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb
.
Contents of the 'Scheduled Tasks' folder
2009-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
2009-06-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-1708537768-1417001333-1003.job
- c:\documents and settings\ahn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-10 00:18]
2009-06-02 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-06-02 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
.
- - - - ORPHANS REMOVED - - - -
BHO-{c95a4e8e-816d-4655-8c79-d736da1adb6d} - (no file)
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.com.sa/
mLocal Page = c:\windows\pchealth\helpctr\System\panels\blank.htm
uInternet Settings,ProxyServer = socks=
uInternet Settings,ProxyOverride = plimus.com,
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} -
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\ahn\Application Data\Mozilla\Firefox\Profiles\cxyz18s3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://mystart.hiyo.com/?loc=ff_address&search=
FF - component: c:\documents and settings\ahn\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\documents and settings\ahn\Application Data\Mozilla\Firefox\Profiles\cxyz18s3.default\extensions\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\components\FFAlert.dll
FF - component: c:\documents and settings\ahn\Application Data\Mozilla\Firefox\Profiles\cxyz18s3.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\documents and settings\ahn\Local Settings\Application Data\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-03 01:29
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1d6ad953-a367-4ae3-a567-c6a467bcfa42}]
@Denied: (Full) (Everyone)
"Model"=dword:00000084
"Therad"=dword:0000001d
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,79,03,df,a1,98,54,7b,0a,8d,f4,4f,9b,e7,92,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):6b,b0,d6,12,45,65,85,7d,c2,13,df,c3,51,fb,44,0e,02,9c,9f,ec,3c,
de,e0,d3,22,6d,8d,22,9c,4a,5e,b0,7e,23,2c,f0,2e,43,90,ee,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):4a,f0,5b,95,d1,a5,8a,be,0a,4a,ec,8f,e4,92,6c,76,9d,a4,af,59,1a,
55,fc,7b,50,65,43,41,d7,d4,f3,5b,fc,15,28,8a,a1,e0,e5,bc,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{ec128013-c740-4c60-8244-8b1380c0d3c1}]
@Denied: (Full) (Everyone)
"Model"=dword:0000012d
"Therad"=dword:0000001f
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1224)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-02 1:32
ComboFix-quarantined-files.txt 2009-06-02 22:31
ComboFix2.txt 2009-04-24 01:20
Pre-Run: 57,609,719,808 bytes free
Post-Run: 57,990,934,528 bytes free
278 --- E O F --- 2009-05-13 23:31
يمكن نجح معك الحل التالي