- بادئ الموضوع sneekr
- تاريخ البدء
- 1,410
هذا تقرير ComboFix
ComboFix 09-06-04.06 - user 06/05/2009 3:45.11 - NTFSx86
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_AVPsys
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.
2009-05-23 20:23 . 2009-06-01 09:46 -------- d-----w- c:\program files\AskTBar
2009-05-23 17:19 . 2009-06-02 21:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-22 21:55 . 2009-05-22 22:30 -------- d-----w- c:\documents and settings\user\Application Data\SlipStream
2009-05-22 21:40 . 2009-05-22 21:40 -------- d-----w- c:\documents and settings\user\.java
2009-05-22 21:38 . 2009-05-22 22:32 -------- d--h--w- c:\program files\GLFBB.tmp
2009-05-22 21:25 . 2009-05-22 21:28 -------- d-----w- c:\documents and settings\user\Application Data\JonDo
2009-05-22 21:24 . 2009-05-22 21:24 -------- d-----w- c:\program files\JavaSoft
2009-05-22 21:24 . 2006-03-09 14:57 36972 ------w- c:\windows\system32\ActPanel.dll
2009-05-22 02:32 . 2007-03-15 10:25 215968 ----a-w- c:\windows\system32\drivers\mpnat2k.sys
2009-05-22 02:02 . 2007-03-15 10:25 13312 ----a-w- c:\windows\system32\mpnatapi.dll
2009-05-21 07:40 . 2009-05-21 07:40 -------- d-----w- c:\documents and settings\user\Application Data\TypingMaster7
2009-05-20 14:21 . 2009-05-20 14:21 0 ----a-w- c:\documents and settings\user\Application Data\IDM\DwnlData\user\Zyzoom.org.McAfee_720\Zyzoom.org.McAfee.exe
2009-05-20 10:53 . 2009-05-20 10:53 -------- d-----w- c:\documents and settings\user\Application Data\CyberScrub
2009-05-19 06:16 . 2009-05-19 06:27 -------- d-----w- c:\windows\BDOSCAN8
2009-05-19 05:47 . 2009-05-19 05:47 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-05-18 15:31 . 2009-06-01 02:00 -------- d-----w- C:\MT
2009-05-18 15:31 . 2004-05-03 06:23 1384448 ----a-w- c:\windows\system32\msvbvm60.dll
2009-05-18 15:03 . 2009-05-18 15:03 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\ESET
2009-05-18 14:31 . 2009-05-18 14:31 -------- d-----w- c:\documents and settings\user\Application Data\ESET
2009-05-18 14:30 . 2009-05-18 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-05-17 19:05 . 2008-08-26 13:17 113664 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-05-17 19:05 . 2008-07-24 09:02 101376 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-05-17 19:05 . 2008-04-14 06:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2009-05-17 19:05 . 2007-08-09 01:13 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-05-17 19:04 . 2009-05-17 19:04 -------- d-----w- c:\program files\Zain e-GO
2009-05-08 17:59 . 2009-05-28 20:12 -------- d-----w- c:\documents and settings\user\Application Data\Skype
2009-05-08 17:59 . 2009-05-08 17:59 -------- d-----w- c:\program files\Skype
2009-05-08 17:59 . 2009-05-08 17:59 -------- d-----w- c:\program files\Common Files\Skype
2009-05-06 12:10 . 2009-05-06 12:10 198064 ----a-w- c:\documents and settings\user\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-06 12:10 . 2009-06-01 02:00 -------- d-----w- c:\program files\Internet Download Manager
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 00:51 . 2009-01-20 17:10 -------- d-----w- c:\documents and settings\user\Application Data\DMCache
2009-06-04 23:23 . 2009-06-04 23:23 -------- d-----w- c:\program files\Trend Micro
2009-06-04 23:12 . 2009-01-19 16:04 84464 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-04 23:12 . 2009-01-19 16:04 7026720 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-04 23:10 . 2009-06-04 23:10 -------- d-----w- c:\program files\Alwil Software
2009-06-02 17:27 . 2009-01-30 22:33 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-01 02:00 . 2009-04-19 14:25 -------- d-----w- c:\program files\Your Uninstaller 2006
2009-06-01 02:00 . 2009-01-23 20:59 -------- d-----w- c:\program files\Unlocker
2009-06-01 02:00 . 2009-05-04 15:39 -------- d-----w- c:\program files\Filerecoveryangel
2009-06-01 02:00 . 2009-01-25 06:06 -------- d-----w- c:\program files\AutorunRemover
2009-06-01 02:00 . 2009-05-20 10:50 -------- d-----w- c:\documents and settings\user\Application Data\cleaner
2009-06-01 01:38 . 2009-01-25 14:57 -------- d-----w- c:\program files\GVR
2009-06-01 01:28 . 2009-01-31 10:38 -------- d-----w- c:\program files\PConPoint
2009-06-01 01:25 . 2009-01-19 16:01 -------- d-----w- c:\program files\Common Files\Webroot Shared
2009-06-01 01:25 . 2009-01-19 16:01 -------- d-----w- c:\documents and settings\user\Application Data\Webroot
2009-06-01 01:24 . 2009-01-21 12:43 -------- d-----w- c:\program files\Error Repair Professional
2009-06-01 01:24 . 2009-05-24 07:37 -------- d-----w- c:\program files\CodeStuff
2009-05-31 07:41 . 2009-02-22 20:28 720896 ----a-w- c:\windows\iun6002.exe
2009-05-28 18:13 . 2009-04-16 18:43 -------- d-----w- c:\documents and settings\user\Application Data\skypePM
2009-05-24 07:44 . 2009-05-24 07:43 -------- d-----w- c:\program files\Common Files\delet
2009-05-24 07:04 . 2009-03-29 21:28 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-05-23 21:12 . 2009-01-19 16:04 417824 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-23 21:12 . 2009-01-19 16:04 3556 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-23 20:27 . 2009-01-19 14:56 -------- d-----w- c:\program files\Ahead
2009-05-23 17:12 . 2009-01-25 15:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-23 16:55 . 2009-02-14 10:22 63 ----a-w- c:\windows\AlfaStart.CMD
2009-05-23 07:46 . 2009-01-19 14:54 -------- d-----w- c:\program files\Google
2009-05-22 22:37 . 2009-01-20 17:10 -------- d-----w- c:\documents and settings\user\Application Data\IDM
2009-05-22 21:24 . 2009-01-19 15:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-20 07:02 . 2009-01-22 21:16 -------- d-----w- c:\program files\Hazard Shield
2009-05-17 19:11 . 2009-01-20 14:40 -------- d-----w- c:\program files\IVT Corporation
2009-05-14 18:03 . 2009-02-14 10:18 -------- d-----w- c:\program files\Alfa Autorun Killer 2
2009-05-08 17:59 . 2009-04-16 18:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-04-27 12:53 . 2009-01-19 13:36 95024 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-27 10:44 . 2009-01-19 15:58 286720 ------w- c:\windows\Setup1.exe
2009-04-27 10:33 . 2009-01-31 17:00 286720 ----a-w- c:\windows\iun506.exe
2009-04-19 14:28 . 2009-04-19 14:28 -------- d-----w- c:\program files\Microsoft.NET
2009-04-19 14:25 . 2009-04-19 14:25 -------- d-----w- c:\documents and settings\user\Application Data\URSoft
2009-04-16 18:43 . 2009-04-16 18:43 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat
2009-04-15 05:39 . 2009-04-13 07:20 1038336 ----a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{E31C348B-63A9-4CBF-8D7F-D932ABB63244}\Icon0E6AB9FC.exe
2009-04-11 08:14 . 2009-04-11 08:06 -------- d-----w- c:\documents and settings\user\Application Data\GetRightToGo
2009-04-11 07:21 . 2009-01-19 16:10 -------- d-----w- c:\program files\CONEXANT
2009-04-11 07:17 . 2009-04-11 07:17 -------- d-----w- c:\program files\SP23455
2009-04-11 04:14 . 2009-04-11 04:14 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS
2009-04-06 21:23 . 2009-04-06 21:23 -------- d-----w- c:\program files\Lavalys
2009-03-26 15:35 . 2009-04-29 12:20 210352 ----a-w- c:\windows\system32\idmmbc.dll
2009-03-11 22:08 . 2009-02-22 16:41 849 ----a-w- c:\windows\AlfaRun.cmd
2009-03-11 22:08 . 2009-02-22 16:41 125 ----a-w- c:\windows\StartClean.cmd
2009-01-22 12:36 . 2009-01-22 12:31 102400 --sh--r- c:\windows\system32\XP-6635D69D.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-06 2799024]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\XP-6635D69D.EXE"=
"c:\\WINDOWS\\system32\\WISPTIS.EXE"=
"c:\\WINDOWS\\system32\\igfxsrvc.exe"=
"c:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"c:\\Program Files\\Autorun Eater\\billy.exe"=
"c:\\Program Files\\GVR\\GVR.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Alfa Autorun Killer 2\\alfa autorun killer 2.0.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [x]
R3 USBSER34;USBSER34;c:\windows\system32\Drivers\USBSER34.SYS [2007-09-23 37456]
S3 MPNatDrv;Artera NAT Driver;c:\windows\system32\DRIVERS\mpnat2k.sys [2007-03-15 215968]
--- Other Services/Drivers In Memory ---
*Deregistered* - AFD
*Deregistered* - AgereModemAudio
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Compbatt
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - hpqcxs08
*Deregistered* - hpqddsvc
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - LanmanServer
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MPNatDrv
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - Serenum
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VcommMgr
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
SafeBoot-aawservice
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mWindow Title = Microsoft Internet Explorer
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: View Original Image -
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\h2exl4yz.default\
FF - component: c:\documents and settings\user\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-05 03:51
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):0b,06,b1,9f,97,ec,84,92,9b,70,b2,bd,37,de,70,68,c6,43,c4,b7,46,
ea,f9,b0,cf,5e,59,ac,18,84,6a,99,c3,cf,77,94,2c,1a,e9,f1,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{652b10f3-ae29-4742-a964-0f1682fb1422}]
@Denied: (Full) (Everyone)
"Model"=dword:0000005a
"Therad"=dword:00000010
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):79,6a,32,9f,74,48,71,f7,c5,a3,21,5e,0b,f7,3c,48,8c,ea,06,56,26,
9a,b6,a9,c9,e6,9a,bd,e9,66,bc,f7,71,c2,c2,2f,e5,22,71,e3,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{b8da2e69-0d64-42fe-8165-381fa7090bf2}]
@Denied: (Full) (Everyone)
"Model"=dword:0000002f
"Therad"=dword:0000001b
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(852)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\windows\system32\Msi.dll
c:\program files\Common Files\Microsoft Shared\Web Components\10\1025\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1025\OWCI11.DLL
c:\windows\system32\MSVCP60.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-05 3:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-05 00:52
Pre-Run: 34,986,491,904 bytes free
Post-Run: 35,031,494,656 bytes free
340 --- E O F --- 2009-06-05 00:00
ComboFix 09-06-04.06 - user 06/05/2009 3:45.11 - NTFSx86
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_AVPsys
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.
2009-05-23 20:23 . 2009-06-01 09:46 -------- d-----w- c:\program files\AskTBar
2009-05-23 17:19 . 2009-06-02 21:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-22 21:55 . 2009-05-22 22:30 -------- d-----w- c:\documents and settings\user\Application Data\SlipStream
2009-05-22 21:40 . 2009-05-22 21:40 -------- d-----w- c:\documents and settings\user\.java
2009-05-22 21:38 . 2009-05-22 22:32 -------- d--h--w- c:\program files\GLFBB.tmp
2009-05-22 21:25 . 2009-05-22 21:28 -------- d-----w- c:\documents and settings\user\Application Data\JonDo
2009-05-22 21:24 . 2009-05-22 21:24 -------- d-----w- c:\program files\JavaSoft
2009-05-22 21:24 . 2006-03-09 14:57 36972 ------w- c:\windows\system32\ActPanel.dll
2009-05-22 02:32 . 2007-03-15 10:25 215968 ----a-w- c:\windows\system32\drivers\mpnat2k.sys
2009-05-22 02:02 . 2007-03-15 10:25 13312 ----a-w- c:\windows\system32\mpnatapi.dll
2009-05-21 07:40 . 2009-05-21 07:40 -------- d-----w- c:\documents and settings\user\Application Data\TypingMaster7
2009-05-20 14:21 . 2009-05-20 14:21 0 ----a-w- c:\documents and settings\user\Application Data\IDM\DwnlData\user\Zyzoom.org.McAfee_720\Zyzoom.org.McAfee.exe
2009-05-20 10:53 . 2009-05-20 10:53 -------- d-----w- c:\documents and settings\user\Application Data\CyberScrub
2009-05-19 06:16 . 2009-05-19 06:27 -------- d-----w- c:\windows\BDOSCAN8
2009-05-19 05:47 . 2009-05-19 05:47 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-05-18 15:31 . 2009-06-01 02:00 -------- d-----w- C:\MT
2009-05-18 15:31 . 2004-05-03 06:23 1384448 ----a-w- c:\windows\system32\msvbvm60.dll
2009-05-18 15:03 . 2009-05-18 15:03 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\ESET
2009-05-18 14:31 . 2009-05-18 14:31 -------- d-----w- c:\documents and settings\user\Application Data\ESET
2009-05-18 14:30 . 2009-05-18 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-05-17 19:05 . 2008-08-26 13:17 113664 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2009-05-17 19:05 . 2008-07-24 09:02 101376 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-05-17 19:05 . 2008-04-14 06:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2009-05-17 19:05 . 2007-08-09 01:13 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2009-05-17 19:04 . 2009-05-17 19:04 -------- d-----w- c:\program files\Zain e-GO
2009-05-08 17:59 . 2009-05-28 20:12 -------- d-----w- c:\documents and settings\user\Application Data\Skype
2009-05-08 17:59 . 2009-05-08 17:59 -------- d-----w- c:\program files\Skype
2009-05-08 17:59 . 2009-05-08 17:59 -------- d-----w- c:\program files\Common Files\Skype
2009-05-06 12:10 . 2009-05-06 12:10 198064 ----a-w- c:\documents and settings\user\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-06 12:10 . 2009-06-01 02:00 -------- d-----w- c:\program files\Internet Download Manager
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 00:51 . 2009-01-20 17:10 -------- d-----w- c:\documents and settings\user\Application Data\DMCache
2009-06-04 23:23 . 2009-06-04 23:23 -------- d-----w- c:\program files\Trend Micro
2009-06-04 23:12 . 2009-01-19 16:04 84464 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-04 23:12 . 2009-01-19 16:04 7026720 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-04 23:10 . 2009-06-04 23:10 -------- d-----w- c:\program files\Alwil Software
2009-06-02 17:27 . 2009-01-30 22:33 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-01 02:00 . 2009-04-19 14:25 -------- d-----w- c:\program files\Your Uninstaller 2006
2009-06-01 02:00 . 2009-01-23 20:59 -------- d-----w- c:\program files\Unlocker
2009-06-01 02:00 . 2009-05-04 15:39 -------- d-----w- c:\program files\Filerecoveryangel
2009-06-01 02:00 . 2009-01-25 06:06 -------- d-----w- c:\program files\AutorunRemover
2009-06-01 02:00 . 2009-05-20 10:50 -------- d-----w- c:\documents and settings\user\Application Data\cleaner
2009-06-01 01:38 . 2009-01-25 14:57 -------- d-----w- c:\program files\GVR
2009-06-01 01:28 . 2009-01-31 10:38 -------- d-----w- c:\program files\PConPoint
2009-06-01 01:25 . 2009-01-19 16:01 -------- d-----w- c:\program files\Common Files\Webroot Shared
2009-06-01 01:25 . 2009-01-19 16:01 -------- d-----w- c:\documents and settings\user\Application Data\Webroot
2009-06-01 01:24 . 2009-01-21 12:43 -------- d-----w- c:\program files\Error Repair Professional
2009-06-01 01:24 . 2009-05-24 07:37 -------- d-----w- c:\program files\CodeStuff
2009-05-31 07:41 . 2009-02-22 20:28 720896 ----a-w- c:\windows\iun6002.exe
2009-05-28 18:13 . 2009-04-16 18:43 -------- d-----w- c:\documents and settings\user\Application Data\skypePM
2009-05-24 07:44 . 2009-05-24 07:43 -------- d-----w- c:\program files\Common Files\delet
2009-05-24 07:04 . 2009-03-29 21:28 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-05-23 21:12 . 2009-01-19 16:04 417824 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-05-23 21:12 . 2009-01-19 16:04 3556 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-05-23 20:27 . 2009-01-19 14:56 -------- d-----w- c:\program files\Ahead
2009-05-23 17:12 . 2009-01-25 15:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-23 16:55 . 2009-02-14 10:22 63 ----a-w- c:\windows\AlfaStart.CMD
2009-05-23 07:46 . 2009-01-19 14:54 -------- d-----w- c:\program files\Google
2009-05-22 22:37 . 2009-01-20 17:10 -------- d-----w- c:\documents and settings\user\Application Data\IDM
2009-05-22 21:24 . 2009-01-19 15:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-20 07:02 . 2009-01-22 21:16 -------- d-----w- c:\program files\Hazard Shield
2009-05-17 19:11 . 2009-01-20 14:40 -------- d-----w- c:\program files\IVT Corporation
2009-05-14 18:03 . 2009-02-14 10:18 -------- d-----w- c:\program files\Alfa Autorun Killer 2
2009-05-08 17:59 . 2009-04-16 18:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-04-27 12:53 . 2009-01-19 13:36 95024 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-27 10:44 . 2009-01-19 15:58 286720 ------w- c:\windows\Setup1.exe
2009-04-27 10:33 . 2009-01-31 17:00 286720 ----a-w- c:\windows\iun506.exe
2009-04-19 14:28 . 2009-04-19 14:28 -------- d-----w- c:\program files\Microsoft.NET
2009-04-19 14:25 . 2009-04-19 14:25 -------- d-----w- c:\documents and settings\user\Application Data\URSoft
2009-04-16 18:43 . 2009-04-16 18:43 32 ----a-w- c:\documents and settings\All Users\Application Data\ezsid.dat
2009-04-15 05:39 . 2009-04-13 07:20 1038336 ----a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{E31C348B-63A9-4CBF-8D7F-D932ABB63244}\Icon0E6AB9FC.exe
2009-04-11 08:14 . 2009-04-11 08:06 -------- d-----w- c:\documents and settings\user\Application Data\GetRightToGo
2009-04-11 07:21 . 2009-01-19 16:10 -------- d-----w- c:\program files\CONEXANT
2009-04-11 07:17 . 2009-04-11 07:17 -------- d-----w- c:\program files\SP23455
2009-04-11 04:14 . 2009-04-11 04:14 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS
2009-04-06 21:23 . 2009-04-06 21:23 -------- d-----w- c:\program files\Lavalys
2009-03-26 15:35 . 2009-04-29 12:20 210352 ----a-w- c:\windows\system32\idmmbc.dll
2009-03-11 22:08 . 2009-02-22 16:41 849 ----a-w- c:\windows\AlfaRun.cmd
2009-03-11 22:08 . 2009-02-22 16:41 125 ----a-w- c:\windows\StartClean.cmd
2009-01-22 12:36 . 2009-01-22 12:31 102400 --sh--r- c:\windows\system32\XP-6635D69D.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-06 2799024]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalTalk.lnk]
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\XP-6635D69D.EXE"=
"c:\\WINDOWS\\system32\\WISPTIS.EXE"=
"c:\\WINDOWS\\system32\\igfxsrvc.exe"=
"c:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"c:\\Program Files\\Autorun Eater\\billy.exe"=
"c:\\Program Files\\GVR\\GVR.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Alfa Autorun Killer 2\\alfa autorun killer 2.0.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [x]
R3 USBSER34;USBSER34;c:\windows\system32\Drivers\USBSER34.SYS [2007-09-23 37456]
S3 MPNatDrv;Artera NAT Driver;c:\windows\system32\DRIVERS\mpnat2k.sys [2007-03-15 215968]
--- Other Services/Drivers In Memory ---
*Deregistered* - AFD
*Deregistered* - AgereModemAudio
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Compbatt
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HidServ
*Deregistered* - hpqcxs08
*Deregistered* - hpqddsvc
*Deregistered* - HTTP
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - KSecDD
*Deregistered* - LanmanServer
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - MDM
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MPNatDrv
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RemoteRegistry
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - Serenum
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - Update
*Deregistered* - VcommMgr
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
SafeBoot-aawservice
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mWindow Title = Microsoft Internet Explorer
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: View Original Image -
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\h2exl4yz.default\
FF - component: c:\documents and settings\user\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
Rootkit scan 2009-06-05 03:51
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):0b,06,b1,9f,97,ec,84,92,9b,70,b2,bd,37,de,70,68,c6,43,c4,b7,46,
ea,f9,b0,cf,5e,59,ac,18,84,6a,99,c3,cf,77,94,2c,1a,e9,f1,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{652b10f3-ae29-4742-a964-0f1682fb1422}]
@Denied: (Full) (Everyone)
"Model"=dword:0000005a
"Therad"=dword:00000010
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):79,6a,32,9f,74,48,71,f7,c5,a3,21,5e,0b,f7,3c,48,8c,ea,06,56,26,
9a,b6,a9,c9,e6,9a,bd,e9,66,bc,f7,71,c2,c2,2f,e5,22,71,e3,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{b8da2e69-0d64-42fe-8165-381fa7090bf2}]
@Denied: (Full) (Everyone)
"Model"=dword:0000002f
"Therad"=dword:0000001b
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(852)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\windows\system32\Msi.dll
c:\program files\Common Files\Microsoft Shared\Web Components\10\1025\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1025\OWCI11.DLL
c:\windows\system32\MSVCP60.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-05 3:52 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-05 00:52
Pre-Run: 34,986,491,904 bytes free
Post-Run: 35,031,494,656 bytes free
340 --- E O F --- 2009-06-05 00:00
توقيع : sneekr
تأييد
0
هذا تقرير HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:55:01, on 05/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-21-1708537768-1770027372-1417001333-1003\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot (User '?')
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
--
End of file - 2150 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:55:01, on 05/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-21-1708537768-1770027372-1417001333-1003\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot (User '?')
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
--
End of file - 2150 bytes
توقيع : sneekr
تأييد
0
kemo_2009
زيزوومى مميز
غير متصل
تظهر هذة الرسالة
معنى هذه الرسالة ان الوندوز عندك يبغى تحديث
عشان ينزل اصدار احدث من windows installer
سبب مشكلتك الحين ان البرنامج هذا windows installer
انحذف من عندك
الحل
ادخل على
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
واكتب في مربع البحث windows installer
وبعديها حمل اي اصدار يعجبك
تأييد
0
