يحتوي على قابلية الاختراق ؟؟

[ش ـمـ س]

.
.

السلام عليكم ..

اغلب المسارات كذا اذا جيت اسوي فحص .. ليه ؟؟

وقبل شوي يوم ركبت الاعدادات الي بموضوع الاخ MAAX ورجعت سويت فحص ماطلعلي التحذير ليه ؟

 

[ولد الحربي]

وعليكم السلام

مدري لكن اتوقع دامك ركبت الاعدادات فهي تتصرف مع الكائن بدون سؤالك
يعني انه الكاسبر احتمال يكون قيد الكائن المشبوه هذا عشان كذا ماطلعت لك مره ثانيه

والله اعلم

ننتظر رد الاخوان

 

[ugugx]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

k:



اعدادات الاخ MAAX لا تحتاج للمستخدم ( تلقائية )
​

 

[ش ـمـ س]

طيب شوفو قبل ثواني جاني هالتحذير وامس جاني مرتين :

 

[ولد الحربي]

اي اخوي هذا اللي اقصده انه تلقائيه ..

لكن الصوره الجديده هذا يعني انه فيه مهاجم على الكمبيوتر !!
احووول عسى مايكون كذا وان كان كذا الكاسبر صده ولا ؟

انا استخدم الكاسبر يمكن من اول مانزل لكن ماشفت زي هذي الرساله

ننتظر رد الاخوان يشرحون لنا الوضع

 

[ugugx]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

هذه الصورة معناها
الجهاز تحت الهجوم من اّى بى رقم : 222.82.249.235
باستخدام فيروس : instrusion.win.mssql.worm.helkern
نوع المنفذ المتصل بالانترنت : UDP

طلب : ممكن صورة واجهة البرنامج الرئيسية
​

 

[ش ـمـ س]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

الله يجعل يده الكسر هو وكل اللي يحبون الاختراقات

 

[ابـــو عــبــد الــلــه]

عطيني تقرير للهايجاك​

 

[ش ـمـ س]

Logfile of HijackThis v1.99.1
Scan saved at 07:18:14 ص, on 09/06/09
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16830)
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\BandRich\BandLuxe HSDPA utility R1\CManager.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Users\vista\Desktop\ملفاتي\برامج\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.nesma.net.sa:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\ar-xa\msntb.dll (file missing)
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: إضافة إلى حاجب إعلان الشعار - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: إحصائيات حماية حركة زيارة الويب - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} -

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

(file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{F77CADAE-0F13-4DF4-A256-9F4FFB2FCCB2}: NameServer = 84.23.102.172 84.23.101.84
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\Windows\system32\klogon.dll
O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

 

[ابـــو عــبــد الــلــه]

من ابدأ اختر run واكتب الامر التالي

msconfig

ثم اوكي

ستظهر شاشة التطبيق

system configuration utility


اعمل كما يلي

والمثال هنا على الكاسبر وانت قيس على جهازك

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

ثم وافق على اعادة التشغيل

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

......



بعد اعادة التشغيل



اعمل التالي

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة​

 

[ugugx]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

k:

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

k:.......................:q:

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

التقرير به ثلاثة اخطاء
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\ar-xa\msntb.dll (file missing)

O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} -

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

(file missing)

MusT BE DeleteD
يجب حذفهم
بنفس البرنامج نقوم بالتشييك على العلامة بجوار القيم المصابة ثم الضغط على fix checked
k:
ننتظر تقرير جديد
​

 

[خيآل إنسآن]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

^
^
^
نفس الشي كل ساعة تطلع لي مدري ليش؟؟

يالليت تفيدونا ..​

 

[SUL6AN]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

:y:
عادي عادي هذا فيروس منتشر بالشبكه ووده يسير عليتس :hh:
بس السيكيورتي راادينه

بس وشو اتصالك ؟!

 

[ش ـمـ س]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

ComboFix 09-06-06.03 - vista 06/09/2009 7:55.2 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1256.966.1033.18.1014.411 [GMT 3:00]
Running from: c:\users\vista\Desktop\ملفاتي\برامج\ComboFix.exe
AV: BitDefender 8.0 Professional Plus *On-access scanning disabled* (Outdated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: BitDefender 8.0 Professional Plus *disabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Internet Security *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))
.
2009-06-09 04:59 . 2009-06-09 04:59 -------- d-----w- c:\users\vista\AppData\Local\temp
2009-06-09 04:59 . 2009-06-09 04:59 -------- d-----w- C:\temp
2009-06-09 04:59 . 2009-06-09 04:59 -------- d-----w- \temp
2009-06-09 04:54 . 2009-06-09 04:59 -------- d-s---w- \ComboFix
2009-06-08 16:07 . 2009-06-08 16:07 -------- d-----w- c:\users\vista\AppData\Local\Mozilla
2009-06-08 13:13 . 2009-06-08 13:13 -------- d-----w- c:\users\vista\AppData\Local\Google
2009-06-08 13:13 . 2009-06-08 13:13 -------- d-----w- c:\program files\Google
2009-06-08 11:10 . 2009-06-08 11:14 -------- d-----w- c:\program files\Spyware Doctor
2009-06-08 09:29 . 2009-06-08 09:29 -------- d-----w- c:\programdata\Messenger Plus!
2009-06-08 08:46 . 2009-06-08 08:46 -------- d-----w- c:\program files\AxBx
2009-06-08 08:41 . 2009-06-08 08:42 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-08 06:48 . 2009-06-08 06:49 -------- d-----w- c:\users\vista\AppData\Roaming\Media Player Classic
2009-06-08 06:48 . 2009-06-08 06:48 -------- d-----w- c:\programdata\Apple Computer
2009-06-07 15:51 . 2009-06-07 17:02 -------- d-----w- c:\users\vista\AppData\Local\Microsoft Games
2009-06-07 12:21 . 2009-06-09 04:54 -------- d-----w- \Qoobox
2009-06-07 07:13 . 2009-06-07 07:13 198064 ----a-w- c:\users\vista\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-07 07:12 . 2009-06-09 04:59 -------- d-----w- c:\users\vista\AppData\Roaming\DMCache
2009-06-07 07:12 . 2009-06-09 04:45 -------- d-----w- c:\users\vista\AppData\Roaming\IDM
2009-06-07 07:12 . 2009-06-07 11:36 -------- d-----w- c:\program files\Internet Download Manager
2009-06-07 06:47 . 2008-06-26 00:33 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-07 06:47 . 2008-06-26 00:33 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-07 06:45 . 2008-06-26 00:34 5499904 ----a-w- c:\windows\system32\NlsLexicons0022.dll
2009-06-06 10:10 . 2009-06-06 10:10 61440 ----a-w- c:\windows\system32\ntprint.exe
2009-06-06 10:10 . 2009-06-06 10:10 220160 ----a-w- c:\windows\system32\ntprint.dll
2009-06-06 10:10 . 2009-06-06 10:10 10240 ----a-w- c:\windows\system32\dhcpcmonitor.dll
2009-06-06 10:10 . 2009-06-06 10:10 120320 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2009-06-06 10:10 . 2009-06-06 10:10 1984512 ----a-w- c:\windows\system32\authui.dll
2009-06-06 10:09 . 2009-06-06 10:09 88576 ----a-w- c:\windows\system32\avifil32.dll
2009-06-06 10:09 . 2009-06-06 10:09 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-06-06 10:09 . 2009-06-06 10:09 65024 ----a-w- c:\windows\system32\avicap32.dll
2009-06-06 10:09 . 2009-06-06 10:09 31232 ----a-w- c:\windows\system32\msvidc32.dll
2009-06-06 10:09 . 2009-06-06 10:09 12800 ----a-w- c:\windows\system32\msrle32.dll
2009-06-06 10:09 . 2009-06-06 10:09 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-06-06 10:09 . 2009-06-06 10:09 69632 ----a-w- c:\windows\system32\sendmail.dll
2009-06-06 10:09 . 2009-06-06 10:09 8138240 ----a-w- c:\windows\system32\ssBranded.scr
2009-06-06 07:32 . 2009-06-06 07:32 206088 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-06-06 07:32 . 2009-06-06 07:32 33808 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-06 07:32 . 2009-06-06 07:32 239120 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\Vista\klif.sys
2009-06-06 04:40 . 2009-06-06 07:33 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-06 04:40 . 2009-06-06 07:33 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-06 04:39 . 2009-06-09 04:37 -------- d-----w- c:\programdata\Kaspersky Lab
2009-06-06 04:39 . 2009-06-09 04:35 335904 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-06 04:39 . 2009-06-09 04:35 2010656 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-06 04:39 . 2009-06-06 04:39 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-06 04:36 . 2009-06-06 04:36 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2009-06-06 00:05 . 2009-06-06 00:05 70144 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-06-06 00:05 . 2009-06-06 00:05 694784 ----a-w- c:\windows\system32\localspl.dll
2009-06-06 00:05 . 2009-06-06 00:05 33280 ----a-w- c:\windows\system32\traffic.dll
2009-06-06 00:05 . 2009-06-06 00:05 15360 ----a-w- c:\windows\system32\pacerprf.dll
2009-06-06 00:05 . 2009-06-06 00:05 13824 ----a-w- c:\windows\system32\wshqos.dll
2009-06-06 00:05 . 2009-06-06 00:05 619008 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2009-06-06 00:05 . 2009-06-06 00:05 36864 ----a-w- c:\windows\system32\cdd.dll
2009-06-06 00:05 . 2009-06-06 00:05 134656 ----a-w- c:\windows\system32\dps.dll
2009-06-06 00:04 . 2009-06-06 00:04 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-06-06 00:04 . 2009-06-06 00:04 4247552 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-06-06 00:04 . 2009-06-06 00:04 1687040 ----a-w- c:\windows\system32\gameux.dll
2009-06-06 00:04 . 2009-06-06 00:04 356864 ----a-w- c:\windows\system32\MediaMetadataHandler.dll
2009-06-06 00:01 . 2009-06-06 00:01 223232 ----a-w- c:\windows\system32\SLC.dll
2009-06-06 00:01 . 2009-06-06 00:01 33280 ----a-w- c:\windows\system32\slwmi.dll
2009-06-06 00:01 . 2009-06-06 00:01 268288 ----a-w- c:\windows\system32\mcbuilder.exe
2009-06-06 00:01 . 2009-06-06 00:01 566784 ----a-w- c:\windows\system32\SLCommDlg.dll
2009-06-06 00:01 . 2009-06-06 00:01 351232 ----a-w- c:\windows\system32\SLUI.exe
2009-06-06 00:01 . 2009-06-06 00:01 186368 ----a-w- c:\windows\system32\SLLUA.exe
2009-06-06 00:01 . 2009-06-06 00:01 57856 ----a-w- c:\windows\system32\SLUINotify.dll
2009-06-06 00:00 . 2009-06-06 00:01 2605568 ----a-w- c:\windows\system32\SLsvc.exe
2009-06-06 00:00 . 2009-06-06 00:00 39936 ----a-w- c:\windows\system32\slcinst.dll
2009-06-05 09:36 . 2009-06-05 09:36 -------- d-----w- c:\windows\مضاد التجسس
2009-06-05 09:23 . 2009-06-08 08:42 -------- d-----w- c:\program files\MSN Messenger
2009-06-05 09:23 . 2009-06-05 09:23 -------- d-----w- c:\windows\PCHEALTH
2009-06-05 07:20 . 2009-06-05 07:20 268800 ----a-w- c:\windows\system32\es.dll
2009-06-05 07:18 . 2009-06-05 07:18 7680 ----a-w- c:\windows\system32\lsass.exe
2009-06-05 07:18 . 2009-06-05 07:18 72704 ----a-w- c:\windows\system32\secur32.dll
2009-06-05 07:18 . 2009-06-05 07:18 1233408 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-05 07:18 . 2009-06-05 07:18 25600 ----a-w- c:\windows\system32\amxread.dll
2009-06-05 07:18 . 2009-06-05 07:18 14848 ----a-w- c:\windows\system32\apilogen.dll
2009-06-05 07:18 . 2009-06-05 07:18 425472 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-06-05 07:18 . 2009-06-05 07:18 712192 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-06-05 07:17 . 2009-06-05 07:17 347136 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-06-05 07:17 . 2009-06-05 07:17 -------- d-----w- c:\program files\MSXML 4.0
2009-06-05 04:56 . 2009-06-05 04:56 -------- d-----w- C:\DepositFiles
2009-06-05 04:56 . 2009-06-05 04:56 -------- d-----w- \DepositFiles
2009-06-05 02:03 . 2009-06-05 02:03 98816 ----a-w- c:\windows\system32\mfps.dll
2009-06-05 02:03 . 2009-06-05 02:03 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2009-06-05 02:03 . 2009-06-05 02:03 2855424 ----a-w- c:\windows\system32\mf.dll
2009-06-05 02:03 . 2009-06-05 02:03 2048 ----a-w- c:\windows\system32\mferror.dll
2009-06-05 02:03 . 2009-06-05 02:03 24576 ----a-w- c:\windows\system32\mfpmp.exe
2009-06-05 02:03 . 2009-06-05 02:03 996352 ----a-w- c:\windows\system32\WMNetMgr.dll
2009-06-05 02:03 . 2009-06-05 02:03 94720 ----a-w- c:\windows\system32\logagent.exe
2009-06-04 12:43 . 2009-06-04 12:43 61440 ----a-w- c:\windows\system32\winipsec.dll
2009-06-04 12:43 . 2009-06-04 12:43 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2009-06-04 12:43 . 2009-06-04 12:43 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2009-06-04 12:43 . 2009-06-04 12:43 272896 ----a-w- c:\windows\system32\polstore.dll
2009-06-04 12:43 . 2009-06-04 12:43 87040 ----a-w- c:\windows\system32\msoert2.dll
2009-06-04 12:43 . 2009-06-04 12:43 39424 ----a-w- c:\windows\system32\ACCTRES.dll
2009-06-04 12:43 . 2009-06-04 12:43 205824 ----a-w- c:\windows\system32\msoeacct.dll
2009-06-04 12:42 . 2009-06-04 12:42 194560 ----a-w- c:\windows\system32\WebClnt.dll
2009-06-04 12:42 . 2009-06-04 12:42 110080 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2009-06-04 12:42 . 2009-06-04 12:42 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-06-04 12:41 . 2009-06-04 12:41 297472 ----a-w- c:\windows\system32\gdi32.dll
2009-06-04 12:41 . 2009-06-04 12:41 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2009-06-04 12:41 . 2009-06-04 12:41 30208 ----a-w- c:\windows\system32\xolehlp.dll
2009-06-04 12:40 . 2009-06-04 12:40 2048 ----a-w- c:\windows\system32\msxml3r.dll
2009-06-04 12:40 . 2009-06-04 12:40 1194496 ----a-w- c:\windows\system32\msxml3.dll
2009-06-04 12:40 . 2009-06-04 12:40 2923520 ----a-w- c:\windows\explorer.exe
2009-06-04 12:39 . 2009-06-04 12:39 14848 ----a-w- c:\windows\system32\wshrm.dll
2009-06-04 12:39 . 2009-06-04 12:39 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
2009-06-04 12:38 . 2009-06-04 12:38 11776 ----a-w- c:\windows\system32\sbunattend.exe
2009-06-04 12:38 . 2009-06-04 12:38 290304 ----a-w- c:\windows\system32\drivers\srv.sys
2009-06-04 12:37 . 2009-06-04 12:37 1645568 ----a-w- c:\windows\system32\connect.dll
2009-06-04 12:37 . 2009-06-04 12:37 1327104 ----a-w- c:\windows\system32\quartz.dll
2009-06-04 01:50 . 2009-06-04 01:50 -------- d-----w- c:\program files\Lavasoft
2009-06-04 01:31 . 2009-06-04 02:42 -------- d-----w- c:\program files\Common Files\Softwin
2009-06-04 01:31 . 2009-06-04 01:31 -------- d-----w- c:\program files\Softwin
2009-06-03 15:58 . 2009-06-03 15:58 95232 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-06-03 15:58 . 2009-06-03 15:58 241152 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-06-03 15:58 . 2009-06-03 15:58 160768 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-06-03 15:57 . 2009-06-03 15:57 41984 ----a-w- c:\windows\system32\drivers\monitor.sys
2009-06-03 15:57 . 2009-06-03 15:57 1060920 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-06-03 15:57 . 2009-06-03 15:57 211456 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-06-03 15:56 . 2009-06-03 15:56 374456 ----a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2009-06-03 15:56 . 2009-06-03 15:56 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2009-06-03 15:55 . 2009-06-03 15:55 414208 ----a-w- c:\windows\system32\msscp.dll
2009-06-03 15:55 . 2009-06-03 15:55 63488 ----a-w- c:\windows\system32\drivers\mpsdrv.sys
2009-06-03 15:55 . 2009-06-03 15:55 396800 ----a-w- c:\windows\system32\MPSSVC.dll
2009-06-03 15:55 . 2009-06-03 15:55 392192 ----a-w- c:\windows\system32\FirewallAPI.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-09 04:35 . 2009-06-03 09:06 1063378944 --sha-w- \hiberfil.sys
2009-06-09 04:35 . 2009-06-03 09:01 1377304576 --sha-w- \pagefile.sys
2009-06-09 04:35 . 2009-06-06 04:39 2228 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-09 04:35 . 2009-06-06 04:39 16788 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-06 07:33 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-06 05:03 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-06-06 00:09 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-06-06 00:06 . 2009-06-06 00:06 8192 ----a-w- c:\windows\system32\riched32.dll
2009-06-06 00:06 . 2009-06-06 00:06 20480 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2009-06-06 00:06 . 2009-06-06 00:06 77824 ----a-w- c:\windows\system32\rascfg.dll
2009-06-06 00:06 . 2009-06-06 00:06 61952 ----a-w- c:\windows\system32\drivers\wanarp.sys
2009-06-06 00:06 . 2009-06-06 00:06 52736 ----a-w- c:\windows\system32\rasdiag.dll
2009-06-06 00:06 . 2009-06-06 00:06 48640 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2009-06-06 00:06 . 2009-06-06 00:06 32768 ----a-w- c:\windows\system32\rasmxs.dll
2009-06-06 00:06 . 2009-06-06 00:06 22016 ----a-w- c:\windows\system32\rasser.dll
2009-06-06 00:06 . 2009-06-06 00:06 384000 ----a-w- c:\windows\system32\netcfgx.dll
2009-06-06 00:06 . 2009-06-06 00:06 286208 ----a-w- c:\windows\system32\ipnathlp.dll
2009-06-06 00:06 . 2009-06-06 00:06 13824 ----a-w- c:\windows\system32\icsunattend.exe
2009-06-05 02:06 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-06-04 12:45 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-04 12:39 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-06-04 01:21 . 2007-03-08 10:52 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-04 01:18 . 2007-03-08 10:53 -------- d-----w- c:\programdata\Symantec
2009-06-03 15:45 . 2009-06-03 15:45 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-03 15:45 . 2009-06-03 15:45 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-06-03 15:45 . 2009-06-03 15:45 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-06-03 15:45 . 2009-06-03 15:45 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-06-03 09:11 . 2007-03-08 10:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-03 09:10 . 2007-03-08 09:28 -------- d-----w- c:\program files\TOSHIBA
2009-06-03 09:09 . 2007-03-08 10:46 -------- d-----w- c:\program files\InterVideo
.
((((((((((((((((((((((((((((( SnapShot@2009-06-07_12.27.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-08 13:18 . 2009-06-09 04:38 33730 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:02 . 2009-06-09 04:38 59196 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-06-04 06:10 . 2009-06-04 06:10 84661 c:\windows\System32\Macromed\Flash\uninstall_plugin.exe
+ 2009-06-04 06:10 . 2009-06-09 03:32 84661 c:\windows\System32\Macromed\Flash\uninstall_plugin.exe
- 2009-06-03 09:16 . 2009-06-07 11:33 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-06-03 09:16 . 2009-06-09 04:43 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-06-03 09:16 . 2009-06-09 04:43 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-06-03 09:16 . 2009-06-07 11:33 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-06-03 09:16 . 2009-06-09 04:43 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-06-03 09:16 . 2009-06-07 11:33 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-03-08 10:59 . 2009-06-08 11:48 25214 c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A70900000002}\SC_Reader.exe
- 2007-03-08 10:59 . 2007-03-08 10:59 25214 c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A70900000002}\SC_Reader.exe
+ 2009-06-04 02:02 . 2009-06-08 10:50 3110 c:\windows\System32\WDI\ERCQueuedResolutions.dat
- 2009-06-04 02:02 . 2009-06-06 04:59 3110 c:\windows\System32\WDI\ERCQueuedResolutions.dat
+ 2009-06-03 08:27 . 2009-06-09 04:38 5578 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2563931981-1979627906-1060493120-1000_UserData.bin
+ 2009-06-09 04:36 . 2009-06-09 04:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-07 12:01 . 2009-06-07 12:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-07 12:01 . 2009-06-07 12:01 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-09 04:36 . 2009-06-09 04:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-06-09 04:42 610142 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-06-07 12:07 610142 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-06-07 12:07 103924 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-06-09 04:42 103924 c:\windows\System32\perfc009.dat
+ 2009-06-04 23:18 . 2009-06-07 23:36 262144 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\usrclass.dat
- 2009-06-04 23:18 . 2009-06-04 23:18 262144 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2009-06-04 23:19 . 2009-06-07 23:43 262144 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2009-06-04 23:19 . 2009-06-04 23:19 262144 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2009-06-04 23:18 . 2009-06-07 23:37 262144 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2009-06-04 23:18 . 2009-06-04 23:18 262144 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2007-03-08 10:36 . 2009-06-09 04:35 537760 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2007-03-08 10:36 . 2009-06-07 12:00 537760 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-06-07 2815408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-06-06 206088]
"MSConfig"="c:\windows\system32\msconfig.exe" [2006-11-02 222208]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{73050385-9800-4D58-9D4B-99CC9DAA1850}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{EF5A89E8-4EB2-4026-90A3-371B4D037594}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{7F604D55-133D-473A-AFED-25821A0BC91D}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{76C90CE1-EE0A-40EA-BD47-B42AFB1899ED}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{FB5A8BE6-8102-45E9-A4F3-A72D73B77688}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{D9BEA7A0-B82C-4BC4-A65C-E5F5B94F8E30}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{4514ECF5-6617-4EFC-BA77-5BFDFCFE8405}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/08 05:29 م 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/08 05:28 م 20496]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/08 06:02 م 26640]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\System32\drivers\br3gmdm.sys [29/08/07 05:44 م 100096]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = proxy.nesma.net.sa:8080
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: إضافة إلى حاجب إعلان الشعار - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\users\vista\AppData\Roaming\Mozilla\Firefox\Profiles\x153qkix.default\
FF - component: c:\users\vista\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-06-09 07:59
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????W7?=Ld??8?Y?`?Y???Y???Y??
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-06-09 8:01
ComboFix-quarantined-files.txt 2009-06-09 05:01
ComboFix2.txt 2009-06-07 12:29
Pre-Run: 86,825,689,088 bytes free
Post-Run: 86,833,909,760 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=9 Sets=1,2,3,4,5,6,7,8,9
314 --- E O F --- 2009-06-07 23:37

 

[ش ـمـ س]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

Logfile of HijackThis v1.99.1
Scan saved at 07:49:27 ص, on 09/06/09
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16830)
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\BandRich\BandLuxe HSDPA utility R1\CManager.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Users\vista\Desktop\ملفاتي\برامج\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.nesma.net.sa:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O8 - Extra context menu item: إضافة إلى حاجب إعلان الشعار - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: إحصائيات حماية حركة زيارة الويب - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{F77CADAE-0F13-4DF4-A256-9F4FFB2FCCB2}: NameServer = 84.23.102.172 84.23.101.84
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\Windows\system32\klogon.dll
O23 - Service: Kaspersky Internet Security (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" -r (file missing)
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

 

[ش ـمـ س]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

بجد ؟؟ يعني مو احد يبي يهكر الجهاز :er:

اتصالي ع الباند لوكس بطاقة موبايلي ..:?:

 

[ugugx]

ما شاء الله التقرير 100%
هل هناك اى مشاكل اخرى ام............
---------------------------------------------------
انتهى
​

 

[ش ـمـ س]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

يعني خلاص ماعاد بتجيني رسائل التحذير ؟؟

كلش تمام يعني ؟؟

 

[صمت السكوت]

حملي الاداه التاليه وشغليها واختاري fix

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

 

[SUL6AN]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

بالاذن اختي خلــود هذي خاصه فقط بوندوز xp
الاخت عندها وندوز فيستا :q:


عموما السالفه لا تخيف جدا

يعني ممكن يحاولون يسيرون عليك اليوم اذا ما مدااهم بيسافرون عنك :q:
بالتوفيق