شوف اخي الحبيب
اعمل التالي
عطل برامج الحماية وشغل الأداة
عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى
بيطلع لك تقرير اعمل له نسخ ولصق هنا دون وضع اقتباس ولا كود
واعمل لي تقرير جديد للهايجاك
وعطني التقريرين
هذا التقرير ..
ComboFix 09-06-06.03 - ص ى ح 001 06/07/2009 10:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.502.284 [GMT 3:00]
Running from: c:\documents and settings\ص ى ح 001\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-07 to 2009-06-07 )))))))))))))))))))))))))))))))
.
2009-06-06 12:13 . 2009-06-06 12:13 -------- d-----w- C:\Temp
2009-06-05 20:30 . 2009-06-05 20:36 -------- d-----w- c:\program files\AskBarDis
2009-06-05 20:29 . 2009-06-05 20:29 -------- d-----w- c:\program files\uTorrent
2009-06-05 20:29 . 2009-06-05 20:32 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\uTorrent
2009-06-04 08:32 . 2009-06-04 08:32 -------- d-----w- c:\documents and settings\ص ى ح 001\fontconfig
2009-06-03 09:46 . 2009-06-03 09:46 -------- d-----w- c:\program files\CCleaner
2009-05-31 05:32 . 2009-05-31 05:32 390664 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-26 04:58 . 2009-05-26 04:58 198064 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-24 19:43 . 2009-05-24 19:48 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\Crystal Player
2009-05-21 14:15 . 2009-06-07 07:57 -------- d-----w- c:\program files\Common Files\Akamai
2009-05-20 18:54 . 2009-05-20 18:54 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\Ulead Systems
2009-05-20 18:30 . 2009-05-20 18:30 -------- d-----w- c:\program files\Windows Media Components
2009-05-20 18:28 . 2009-05-20 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Ulead Systems
2009-05-20 18:28 . 2009-05-20 18:30 -------- d-----w- c:\program files\Common Files\Ulead Systems
2009-05-20 18:25 . 2009-05-20 18:28 -------- d-----w- c:\program files\Corel
2009-05-20 18:25 . 2009-05-20 18:25 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\InstallShield
2009-05-19 10:35 . 2009-03-26 15:35 210352 ----a-w- c:\windows\system32\idmmbc.dll
2009-05-15 14:14 . 2004-08-04 12:00 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-05-15 14:01 . 2009-05-15 14:01 -------- d-----w- c:\program files\Windows Media Connect 2
2009-05-15 13:58 . 1998-06-18 11:58 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2009-05-15 13:58 . 2005-05-19 00:17 40960 ----a-w- c:\windows\system32\osenxpsuite2005.dll
2009-05-15 13:58 . 2002-01-05 08:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-15 13:58 . 2002-01-05 02:40 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-05-15 13:58 . 2002-01-05 03:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-05-15 13:58 . 2009-05-15 13:58 -------- d-----w- c:\windows\system32\RMBin
2009-05-15 13:58 . 2009-05-15 13:58 -------- d-----w- c:\program files\Ozone
2009-05-15 13:55 . 2009-05-15 13:57 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-05-15 13:55 . 2009-05-15 13:55 -------- d-----w- c:\windows\system32\LogFiles
2009-05-14 19:47 . 2009-06-07 06:04 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\Metacafe
2009-05-14 19:46 . 2009-05-14 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Metacafe
2009-05-14 19:46 . 2009-05-14 19:46 -------- d-----w- c:\program files\Metacafe
2009-05-14 09:50 . 2009-05-14 09:51 -------- d-----w- c:\program files\BitLord
2009-05-12 03:27 . 2009-05-12 03:27 8192 ----a-r- c:\documents and settings\ص ى ح 001\Application Data\Microsoft\Installer\{AF25AEFA-F76B-48A7-A709-C69AD56AED51}\IconTmpl1.108DF49C_3AB4_4A7D_B6FD_8B6286B317FA.exe
2009-05-12 03:27 . 2009-05-12 03:27 30208 ----a-r- c:\documents and settings\ص ى ح 001\Application Data\Microsoft\Installer\{AF25AEFA-F76B-48A7-A709-C69AD56AED51}\IconTmpl.108DF49C_3AB4_4A7D_B6FD_8B6286B317FA.exe
2009-05-12 03:27 . 2009-05-12 03:27 14848 ----a-r- c:\documents and settings\ص ى ح 001\Application Data\Microsoft\Installer\{AF25AEFA-F76B-48A7-A709-C69AD56AED51}\IconTmpl4.A961A077_4BD0_4C98_86BC_EE4A98CE550D.exe
2009-05-12 03:26 . 2009-05-12 03:26 -------- d-----w- c:\program files\CodeMeter
2009-05-12 03:26 . 2009-05-12 03:26 -------- d-----w- c:\program files\WIBU-SYSTEMS
2009-05-12 03:26 . 2009-05-12 03:26 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-12 03:25 . 2007-04-18 20:07 53248 ----a-w- c:\windows\system32\mgxasio2.dll
2009-05-12 03:25 . 2006-03-31 12:57 430080 ----a-w- c:\windows\system32\MXRestore.exe
2009-05-12 03:24 . 2007-04-27 07:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2009-05-12 03:24 . 2009-05-12 03:26 -------- d-----w- c:\windows\system32\MAGIX
2009-05-09 05:11 . 2009-06-05 15:00 -------- d-----w- c:\program files\Norton Security Scan
2009-05-09 05:10 . 2009-06-05 15:00 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-05-09 02:09 . 2009-05-09 02:09 -------- d-----w- c:\program files\Common Files\xing shared
2009-05-09 02:06 . 2009-05-09 02:08 -------- d-----w- c:\windows\system32\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 07:57 . 2009-01-17 20:40 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\DMCache
2009-06-07 07:56 . 2009-03-03 00:53 28672 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\IDM\NP_IDM5.dll
2009-06-07 07:56 . 2009-03-03 00:53 28672 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\IDM\NP_IDM4.dll
2009-06-07 07:56 . 2009-03-03 00:53 28672 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\IDM\NP_IDM3.dll
2009-06-07 07:56 . 2009-03-03 00:53 28672 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\IDM\NP_IDM2.dll
2009-06-07 07:56 . 2009-03-03 00:53 28672 ----a-w- c:\documents and settings\ص ى ح 001\Application Data\IDM\NP_IDM1.dll
2009-06-07 07:56 . 2009-01-17 20:40 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\IDM
2009-06-07 07:56 . 2009-01-17 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-07 07:55 . 2009-01-17 20:20 540704 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-07 07:55 . 2009-01-17 20:20 5024 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-07 07:55 . 2009-01-17 20:20 3555360 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-07 07:55 . 2009-01-17 20:20 35144 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-07 04:05 . 2004-08-04 12:00 40316 ----a-w- c:\windows\system32\perfc001.dat
2009-06-07 04:05 . 2004-08-04 12:00 251946 ----a-w- c:\windows\system32\perfh001.dat
2009-06-05 18:11 . 2009-01-22 09:49 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-06-04 08:18 . 2009-01-18 10:32 -------- d-----w- c:\program files\VerbAce Research
2009-06-04 06:18 . 2009-01-17 20:42 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\Skype
2009-06-04 05:04 . 2009-01-18 09:23 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\skypePM
2009-05-28 19:42 . 2009-01-17 20:40 -------- d-----w- c:\program files\Internet Download Manager
2009-05-27 15:12 . 2009-02-05 12:57 -------- d-----w- c:\program files\Circle Developement
2009-05-21 08:53 . 2009-01-17 20:26 39024 ----a-w- c:\documents and settings\ص ى ح 001\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-20 23:54 . 2009-01-17 20:20 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-20 23:54 . 2009-01-17 20:20 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-20 18:30 . 2009-01-17 20:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-15 14:29 . 2009-01-17 20:27 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\Ashampoo
2009-05-15 14:28 . 2009-01-17 20:27 -------- d-----w- c:\program files\Ashampoo
2009-05-15 13:59 . 2009-05-15 13:59 98304 ----a-w- c:\windows\system32\viscomtran.dll
2009-05-12 03:24 . 2009-01-19 20:11 -------- d-----w- c:\program files\Magix
2009-05-09 02:09 . 2009-01-17 20:41 -------- d-----w- c:\program files\Common Files\Real
2009-04-29 15:31 . 2009-01-17 20:57 -------- d-----w- c:\documents and settings\ص ى ح 001\Application Data\BSplayer Pro
2009-04-29 15:31 . 2009-01-20 10:13 -------- d-----w- c:\program files\VideoLAN
2009-02-26 21:16 . 2009-01-17 20:43 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-02-26 21:16 . 2009-01-17 20:43 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-02-26 21:16 . 2009-01-17 20:43 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-02-26 21:16 . 2009-01-17 20:43 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-02-26 21:16 . 2009-01-17 20:43 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 09:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-26 2815408]
"Exitamen"="c:\docume~1\
001~1\APPLIC~1\LICENS~1\info view nurb.exe" [2009-02-05 15:57 815104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-26 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-04 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-09 185896]
"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\­ î ¥ 001\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
CodeMeter Control Center.lnk - c:\program files\CodeMeter\Runtime\bin\CodeMeterCC.exe [2007-3-23 4984832]
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2009-3-3 145736]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Metacafe.lnk - c:\program files\Metacafe\MetacafeAgent.exe [2009-3-3 145736]
VerbAce-Pro Startup Agent.lnk - c:\program files\VerbAce Research\VerbAce-Pro\VerbAce-Pro.exe [2009-6-4 651264]
«©م، ¢¬نïé Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\CodeMeter\\Runtime\\bin\\CodeMeter.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1207:TCP"= 1207:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
"1645:TCP"= 1645:TCP:Akamai NetSession Interface
"2136:TCP"= 2136:TCP:Akamai NetSession Interface
"2171:TCP"= 2171:TCP:Akamai NetSession Interface
"4993:TCP"= 4993:TCP:Akamai NetSession Interface
"1055:TCP"= 1055:TCP:Akamai NetSession Interface
"1198:TCP"= 1198:TCP:Akamai NetSession Interface
"1227:TCP"= 1227:TCP:Akamai NetSession Interface
"1237:TCP"= 1237:TCP:Akamai NetSession Interface
"1304:TCP"= 1304:TCP:Akamai NetSession Interface
"1323:TCP"= 1323:TCP:Akamai NetSession Interface
"1382:TCP"= 1382:TCP:Akamai NetSession Interface
"1421:TCP"= 1421:TCP:Akamai NetSession Interface
"1473:TCP"= 1473:TCP:Akamai NetSession Interface
"3515:TCP"= 3515:TCP:Akamai NetSession Interface
"3631:TCP"= 3631:TCP:Akamai NetSession Interface
"2067:TCP"= 2067:TCP:Akamai NetSession Interface
"2113:TCP"= 2113:TCP:Akamai NetSession Interface
"2270:TCP"= 2270:TCP:Akamai NetSession Interface
"3664:TCP"= 3664:TCP:Akamai NetSession Interface
"2156:TCP"= 2156:TCP:Akamai NetSession Interface
"2502:TCP"= 2502:TCP:Akamai NetSession Interface
"4491:TCP"= 4491:TCP:Akamai NetSession Interface
"4505:TCP"= 4505:TCP:Akamai NetSession Interface
"3375:TCP"= 3375:TCP:Akamai NetSession Interface
"1789:TCP"= 1789:TCP:Akamai NetSession Interface
"4065:TCP"= 4065:TCP:Akamai NetSession Interface
"2729:TCP"= 2729:TCP:Akamai NetSession Interface
"3608:TCP"= 3608:TCP:Akamai NetSession Interface
"1834:TCP"= 1834:TCP:Akamai NetSession Interface
"2084:TCP"= 2084:TCP:Akamai NetSession Interface
"2194:TCP"= 2194:TCP:Akamai NetSession Interface
"2331:TCP"= 2331:TCP:Akamai NetSession Interface
"2469:TCP"= 2469:TCP:Akamai NetSession Interface
"2601:TCP"= 2601:TCP:Akamai NetSession Interface
"2283:TCP"= 2283:TCP:Akamai NetSession Interface
"2655:TCP"= 2655:TCP:Akamai NetSession Interface
"2859:TCP"= 2859:TCP:Akamai NetSession Interface
"4765:TCP"= 4765:TCP:Akamai NetSession Interface
"1042:TCP"= 1042:TCP:Akamai NetSession Interface
"4203:TCP"= 4203:TCP:Akamai NetSession Interface
"2701:TCP"= 2701:TCP:Akamai NetSession Interface
"3573:TCP"= 3573:TCP:Akamai NetSession Interface
"3925:TCP"= 3925:TCP:Akamai NetSession Interface
"4697:TCP"= 4697:TCP:Akamai NetSession Interface
"2238:TCP"= 2238:TCP:Akamai NetSession Interface
"2631:TCP"= 2631:TCP:Akamai NetSession Interface
"1377:TCP"= 1377:TCP:Akamai NetSession Interface
"4950:TCP"= 4950:TCP:Akamai NetSession Interface
"4149:TCP"= 4149:TCP:Akamai NetSession Interface
"1537:TCP"= 1537:TCP:Akamai NetSession Interface
"1070:TCP"= 1070:TCP:Akamai NetSession Interface
"1391:TCP"= 1391:TCP:Akamai NetSession Interface
"1654:TCP"= 1654:TCP:Akamai NetSession Interface
"1076:TCP"= 1076:TCP:Akamai NetSession Interface
"2603:TCP"= 2603:TCP:Akamai NetSession Interface
"3354:TCP"= 3354:TCP:Akamai NetSession Interface
"1030:TCP"= 1030:TCP:Akamai NetSession Interface
"1362:TCP"= 1362:TCP:Akamai NetSession Interface
"4875:TCP"= 4875:TCP:Akamai NetSession Interface
"3993:TCP"= 3993:TCP:Akamai NetSession Interface
"1051:TCP"= 1051:TCP:Akamai NetSession Interface
"1079:TCP"= 1079:TCP:Akamai NetSession Interface
"4939:TCP"= 4939:TCP:Akamai NetSession Interface
"4168:TCP"= 4168:TCP:Akamai NetSession Interface
"2369:TCP"= 2369:TCP:Akamai NetSession Interface
"1249:TCP"= 1249:TCP:Akamai NetSession Interface
"3576:TCP"= 3576:TCP:Akamai NetSession Interface
"3817:TCP"= 3817:TCP:Akamai NetSession Interface
"1546:TCP"= 1546:TCP:Akamai NetSession Interface
"3446:TCP"= 3446:TCP:Akamai NetSession Interface
"2942:TCP"= 2942:TCP:Akamai NetSession Interface
"3330:TCP"= 3330:TCP:Akamai NetSession Interface
"3569:TCP"= 3569:TCP:Akamai NetSession Interface
"3048:TCP"= 3048:TCP:Akamai NetSession Interface
"2461:TCP"= 2461:TCP:Akamai NetSession Interface
"4543:TCP"= 4543:TCP:Akamai NetSession Interface
"1131:TCP"= 1131:TCP:Akamai NetSession Interface
"3097:TCP"= 3097:TCP:Akamai NetSession Interface
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [04/08/2004 03:00 م 14336]
R2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files\CodeMeter\Runtime\bin\CodeMeter.exe [23/08/2007 03:20 ص 2007040]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [05/06/2009 11:30 م 234888]
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [01/01/2009 04:22 م 194304]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder
2009-06-05 c:\windows\Tasks\Norton Security Scan for ص ى ح 001.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 16:04]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
FF - ProfilePath - c:\documents and settings\ص ى ح 001\Application Data\Mozilla\Firefox\Profiles\aeafdpea.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\documents and settings\ص ى ح 001\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\progra~1\MOZILL~1\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\progra~1\MOZILL~1\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\progra~1\MOZILL~1\extensions\talkback@mozilla.org\components\qfaservices.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-07 10:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1f77b401-bb81-494b-a17f-4355c947b395}]
@Denied: (Full) (Everyone)
"Model"=dword:0000008b
"Therad"=dword:00000020
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,0f,41,34,5e,b6,6f,99,5a,13,b1,15,3c,46,79,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):a2,1c,0a,43,9c,f9,7d,a1,0f,23,52,2c,02,e3,e8,95,96,97,da,e9,df,
fd,8e,08,39,5a,83,90,1f,73,2a,fd,99,05,91,40,28,93,a7,58,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):46,2b,fd,76,bb,ad,a9,89,76,4a,6c,a6,8c,c0,46,cb,20,c8,dc,56,e2,
b4,3b,7c,12,41,92,6e,55,1c,b8,9c,eb,60,55,60,66,6d,05,dd,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{8087314d-4d4e-4f99-8656-c2c0559622ac}]
@Denied: (Full) (Everyone)
"Model"=dword:00000091
"Therad"=dword:00000001
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1432)
c:\windows\system32\WINSPOOL.DRV
- - - - - - - > 'explorer.exe'(456)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
.
**************************************************************************
.
Completion time: 2009-06-07 10:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-07 07:59
Pre-Run: 24,003,588,096 bytes free
Post-Run: 24,443,293,696 bytes free
311 --- E O F --- 2009-06-04 09:43
