عذرا اساتذتي على التاخير
هذا التقرير ظهر لي بعد تشغيل الاداة بالوضع الآمن ونسخته:
ComboFix 09-06-23.01 - user 06/25/2009 16:46.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1256.966.1025.18.3069.2661 [GMT 3:00]
Running from: c:\users\user\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\systeminfo.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.
2009-06-25 13:49 . 2009-06-25 13:49 -------- d-----w- c:\users\user\AppData\Local\temp
2009-06-24 23:24 . 2009-06-24 23:24 -------- d-----w- c:\program files\Trend Micro
2009-06-15 04:12 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-15 04:12 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-15 03:23 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-15 03:23 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-15 03:23 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-06-13 23:34 . 2009-06-13 23:34 -------- d-----w- c:\users\user\dataaaaaaaaaaaa
2009-06-13 06:06 . 2009-06-13 06:06 -------- d-----w- c:\users\user\.webrenderer
2009-06-13 05:33 . 2009-06-13 05:33 -------- d-----w- c:\program files\iVocalize Web Conference 4
2009-06-13 04:43 . 2009-06-12 17:49 -------- d-----w- c:\windows\Panther
2009-06-13 04:43 . 2009-06-13 04:43 -------- d-sh--w- C:\Boot
2009-06-13 04:42 . 2009-06-13 04:42 -------- d-----w- c:\windows\system32\OEM
2009-06-12 23:45 . 2009-06-12 23:45 -------- d-----w- c:\program files\BandRich
2009-06-12 23:15 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-12 19:55 . 2008-11-01 03:44 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-06-12 19:55 . 2008-11-01 01:21 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-06-12 19:55 . 2008-03-08 04:21 1695744 ----a-w- c:\windows\system32\gameux.dll
2009-06-12 19:50 . 2008-06-23 01:59 996352 ----a-w- c:\windows\system32\WMNetMgr.dll
2009-06-12 19:50 . 2008-06-23 01:59 2868736 ----a-w- c:\windows\system32\mf.dll
2009-06-12 19:50 . 2008-06-23 01:58 94720 ----a-w- c:\windows\system32\logagent.exe
2009-06-12 19:50 . 2008-02-29 07:14 19000 ----a-w- c:\windows\system32\kd1394.dll
2009-06-12 19:50 . 2008-02-29 07:11 927288 ----a-w- c:\windows\system32\winresume.exe
2009-06-12 19:50 . 2008-02-29 07:11 988216 ----a-w- c:\windows\system32\winload.exe
2009-06-12 19:50 . 2008-02-22 05:05 615992 ----a-w- c:\windows\system32\ci.dll
2009-06-12 19:49 . 2008-02-29 06:53 378368 ----a-w- c:\windows\system32\srcore.dll
2009-06-12 19:49 . 2008-02-29 06:53 40960 ----a-w- c:\windows\system32\srclient.dll
2009-06-12 19:49 . 2008-02-29 06:53 46592 ----a-w- c:\windows\system32\setbcdlocale.dll
2009-06-12 19:49 . 2008-02-29 06:35 6656 ----a-w- c:\windows\system32\kbd106n.dll
2009-06-12 19:49 . 2008-02-29 04:12 318464 ----a-w- c:\windows\system32\rstrui.exe
2009-06-12 19:49 . 2008-02-29 04:12 14848 ----a-w- c:\windows\system32\srdelayed.exe
2009-06-12 19:47 . 2008-12-16 05:31 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-06-12 19:47 . 2008-12-16 05:31 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-06-12 19:47 . 2008-12-16 03:29 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-06-12 19:44 . 2008-08-27 01:05 212480 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-06-12 19:44 . 2008-09-05 05:14 1191936 ----a-w- c:\windows\system32\msxml3.dll
2009-06-12 19:44 . 2008-04-18 05:48 269312 ----a-w- c:\windows\system32\es.dll
2009-06-12 19:43 . 2008-09-18 04:56 125952 ----a-w- c:\windows\system32\wersvc.dll
2009-06-12 19:43 . 2008-09-18 04:56 147456 ----a-w- c:\windows\system32\Faultrep.dll
2009-06-12 19:43 . 2008-04-29 03:54 181760 ----a-w- c:\windows\system32\fsquirt.exe
2009-06-12 19:43 . 2008-04-29 01:42 220160 ----a-w- c:\windows\system32\drivers\bthport.sys
2009-06-12 19:43 . 2008-04-29 01:42 29184 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2009-06-12 19:43 . 2008-12-06 04:42 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-06-12 19:43 . 2008-10-21 05:25 296960 ----a-w- c:\windows\system32\gdi32.dll
2009-06-12 19:43 . 2008-06-26 03:29 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2009-06-12 19:43 . 2008-08-12 03:39 443392 ----a-w- c:\windows\system32\win32spl.dll
2009-06-12 19:43 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-06-12 19:43 . 2008-05-10 01:33 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
2009-06-12 19:42 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-06-12 19:41 . 2008-12-16 02:42 288768 ----a-w- c:\windows\system32\drivers\srv.sys
2009-06-12 19:41 . 2008-05-08 21:59 90112 ----a-w- c:\windows\system32\wshext.dll
2009-06-12 19:41 . 2008-05-08 21:59 430080 ----a-w- c:\windows\system32\vbscript.dll
2009-06-12 19:41 . 2008-05-08 21:59 180224 ----a-w- c:\windows\system32\scrobj.dll
2009-06-12 19:41 . 2008-05-08 21:59 172032 ----a-w- c:\windows\system32\scrrun.dll
2009-06-12 19:41 . 2008-05-08 21:59 155648 ----a-w- c:\windows\system32\wscript.exe
2009-06-12 19:41 . 2008-05-08 21:58 135168 ----a-w- c:\windows\system32\cscript.exe
2009-06-12 19:41 . 2008-10-29 06:29 2927104 ----a-w- c:\windows\explorer.exe
2009-06-12 19:41 . 2008-10-21 05:25 1645568 ----a-w- c:\windows\system32\connect.dll
2009-06-12 19:31 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-06-12 19:31 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-06-12 19:31 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-12 19:31 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-06-12 19:31 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-06-12 19:31 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-06-12 19:31 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-06-12 19:31 . 2008-10-16 11:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-06-12 19:31 . 2008-10-16 10:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-06-12 19:30 . 2009-06-13 00:06 -------- d-----w- c:\users\user\AppData\Local\Google
2009-06-12 19:27 . 2009-06-23 22:07 -------- d-----w- c:\progra~2\Messenger Plus!
2009-06-12 19:23 . 2009-03-30 07:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-12 19:23 . 2009-03-24 13:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-12 19:23 . 2009-06-12 19:23 -------- d-----w- c:\program files\Avira
2009-06-12 19:23 . 2009-06-12 19:23 -------- d-----w- c:\progra~2\Avira
2009-06-12 19:16 . 2009-06-12 19:16 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-06-12 19:16 . 2009-06-12 19:16 172032 ------w- c:\windows\Setup1.exe
2009-06-12 19:16 . 2009-06-12 19:16 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-12 19:15 . 2009-06-12 19:15 -------- d-----w- c:\program files\DVD X Studios
2009-06-12 19:15 . 2009-06-12 19:15 -------- d-----w- c:\program files\mpegable
2009-06-12 19:15 . 2009-06-12 19:15 47104 ------w- c:\windows\AKDeInstall.exe
2009-06-12 19:14 . 2003-06-22 23:44 1415680 ----a-w- c:\windows\system32\WMV9VCM.dll
2009-06-12 19:14 . 2006-07-05 17:02 5120 ----a-w- c:\windows\system32\ff_vfw.dll
2009-06-12 19:14 . 2009-06-12 19:14 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-12 19:14 . 2009-06-12 19:14 -------- d-----w- c:\progra~2\GRETECH
2009-06-12 19:14 . 2009-06-12 19:14 -------- d-----w- c:\users\user\AppData\Roaming\GRETECH
2009-06-12 19:14 . 2009-06-12 20:02 -------- d-----w- c:\program files\Google
2009-06-12 19:14 . 2009-06-12 19:14 -------- d-----w- c:\program files\GRETECH
2009-06-12 19:13 . 2009-06-12 19:13 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-12 19:13 . 2009-06-12 19:13 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-12 19:13 . 2009-06-12 19:13 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-12 19:13 . 2009-06-12 19:13 -------- d-----w- c:\program files\Common Files\Real
2009-06-12 19:13 . 2009-06-12 19:13 -------- d-----w- c:\program files\Real
2009-06-12 19:12 . 2009-06-12 23:15 -------- d-----w- c:\program files\Circle Developement
2009-06-12 19:12 . 2009-06-12 19:12 -------- d-----w- c:\program files\Windows Live
2009-06-12 19:12 . 2009-06-12 19:12 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-12 19:11 . 2009-06-12 19:12 -------- d-----w- c:\program files\MSN Messenger
2009-06-12 19:09 . 2009-06-12 19:10 -------- d-----w- c:\program files\Java
2009-06-12 19:09 . 2009-06-12 19:09 -------- d-----w- c:\program files\Common Files\Java
2009-06-12 19:07 . 2009-06-12 19:07 -------- d-----w- c:\windows\system32\Macromed
2009-06-12 19:03 . 2009-06-12 19:05 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-12 19:02 . 2003-06-18 14:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2009-06-12 19:01 . 2009-06-12 19:01 -------- d-----w- c:\program files\Microsoft Works
2009-06-12 18:59 . 2009-06-12 18:59 -------- d-----w- c:\windows\PCHEALTH
2009-06-12 18:59 . 2009-06-12 18:59 -------- d-----w- c:\program files\Microsoft.NET
2009-06-12 18:57 . 2009-06-12 19:19 -------- d-----w- c:\progra~2\NVIDIA
2009-06-12 18:53 . 2009-06-12 18:53 -------- d-----w- c:\windows\system32\ar
2009-06-12 18:52 . 2009-06-12 18:54 -------- d-----w- c:\windows\system32\drivers\ar-SA
2009-06-12 18:52 . 2009-06-12 18:54 -------- d-----w- c:\windows\system32\wbem\ar-SA
2009-06-12 18:52 . 2009-06-12 18:54 -------- d-----w- c:\windows\ar-SA
2009-06-12 18:39 . 2009-06-12 18:39 -------- d-----w- c:\program files\Fingerprint Reader Suite
2009-06-12 18:39 . 2009-06-12 18:39 -------- d-----w- c:\progra~2\UIB
2009-06-12 18:38 . 2007-08-23 20:45 753664 ----a-w- c:\windows\system32\nvcplui.exe
2009-06-12 18:38 . 2007-08-23 20:45 307200 ----a-w- c:\windows\system32\nvexpbar.dll
2009-06-12 18:38 . 2007-08-23 20:45 1073152 ----a-w- c:\windows\system32\nvcpluir.dll
2009-06-12 18:38 . 2009-06-12 18:38 -------- d-----w- c:\users\user\Roaming
2009-06-12 18:38 . 2009-06-12 18:38 -------- d-----w- c:\users\user\AppData\Roaming\Intel
2009-06-12 18:38 . 2009-06-12 18:38 -------- d-----w- c:\users\Public\Roaming
2009-06-12 18:38 . 2009-06-12 18:38 -------- d-----w- c:\users\Default\Roaming
2009-06-12 18:38 . 2009-06-12 18:38 -------- d-----w- c:\progra~2\Roaming
2009-06-12 18:36 . 2009-06-12 18:36 -------- d-----w- c:\program files\Broadcom
2009-06-12 18:34 . 2007-10-10 22:04 393216 ----a-w- c:\windows\system32\OEM02Cvw.dll
2009-06-12 18:34 . 2007-10-10 22:03 235648 ----a-w- c:\windows\system32\drivers\OEM02Dev.sys
2009-06-12 18:34 . 2007-10-10 22:02 28672 ----a-w- c:\windows\OEM02Cfg.exe
2009-06-12 18:34 . 2007-07-18 16:51 90112 ----a-w- c:\windows\CtDrvIns.exe
2009-06-12 18:34 . 2007-07-17 22:02 40960 ----a-w- c:\windows\system32\OEM02Pin.dll
2009-06-12 18:34 . 2007-06-07 22:00 141376 ----a-w- c:\windows\system32\drivers\OEM02Afx.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-24 18:03 . 2009-06-12 19:46 -------- d-----w- c:\program files\Mozilla Firefox 3.1 Beta 3
2009-06-12 23:47 . 2009-06-12 23:47 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-06-12 23:36 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-06-12 23:03 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-06-12 19:27 . 2009-06-12 19:27 27240 ----a-w- c:\users\user\AppData\Roaming\nvModes.dat
2009-06-12 19:11 . 2009-06-12 18:16 115576 ----a-w- c:\users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-12 19:08 . 2009-06-12 19:08 2232 ----a-w- c:\windows\Java\Packages\Data\OHFDBVNL.DAT
2009-06-12 19:08 . 2009-06-12 19:08 155995 ----a-w- c:\windows\Java\Packages\CED7BXF3.ZIP
2009-06-12 19:08 . 2009-06-12 19:08 2678 ----a-w- c:\windows\Java\Packages\Data\5BZ1BLJ3.DAT
2009-06-12 19:08 . 2009-06-12 19:08 2678 ----a-w- c:\windows\Java\Packages\Data\P3RTVHRF.DAT
2009-06-12 19:08 . 2009-06-12 19:08 2678 ----a-w- c:\windows\Java\Packages\Data\IEM73F73.DAT
2009-06-12 19:08 . 2009-06-12 19:08 2678 ----a-w- c:\windows\Java\Packages\Data\C773BHZJ.DAT
2009-06-12 19:08 . 2009-06-12 19:08 2678 ----a-w- c:\windows\Java\Packages\Data\79JB3HZB.DAT
2009-06-12 19:03 . 2009-06-12 18:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-12 18:54 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-06-12 18:54 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-06-12 18:54 . 2009-06-12 18:54 41018 ----a-w- c:\windows\inf\PERFLIB\0401\perfd.dat
2009-06-12 18:54 . 2009-06-12 18:54 41018 ----a-w- c:\windows\inf\PERFLIB\0401\perfc.dat
2009-06-12 18:54 . 2009-06-12 18:54 285290 ----a-w- c:\windows\inf\PERFLIB\0401\perfi.dat
2009-06-12 18:54 . 2009-06-12 18:54 285290 ----a-w- c:\windows\inf\PERFLIB\0401\perfh.dat
2009-06-12 18:54 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-06-12 18:53 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-06-12 18:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-06-12 18:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-06-12 18:39 . 2009-06-12 18:16 680 ----a-w- c:\users\user\AppData\Local\d3d9caps.dat
2009-06-12 18:37 . 2009-06-12 18:37 -------- d-----w- c:\progra~2\Intel
2009-06-12 18:28 . 2009-06-12 18:28 -------- d-----w- c:\program files\SigmaTel
2009-06-12 18:28 . 2009-06-12 18:28 -------- d-----w- c:\program files\Common Files\InstallShield
2009-04-24 16:05 . 2009-06-14 08:13 827904 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-06-14 08:13 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-06-14 08:13 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-04-23 12:43 . 2009-06-12 19:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-12 19:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-04-21 11:55 . 2009-06-12 19:46 2033152 ----a-w- c:\windows\system32\win32k.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-16 20:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-16 20:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-12 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-23 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-23 8478720]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-23 81920]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2007-08-23 81920]
"PSQLLauncher"="c:\program files\Fingerprint Reader Suite\launcher.exe" [2007-04-16 49168]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-12 185896]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-12 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-16 20:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{909B1286-A474-40C0-9FAD-FA5A31E47235}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [12/06/09 09:28 م 73728]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/06/09 10:23 م 108289]
S2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [11/02/09 02:37 م 87264]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [26/02/07 02:52 م 179712]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\System32\drivers\br3gmdm.sys [23/12/08 11:18 ص 104448]
S3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [12/06/09 09:34 م 235648]
S3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [12/06/09 09:34 م 7424]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - ECACHE
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
.
- - - - ORPHANS REMOVED - - - -
HKLM-RunOnce-<NO NAME> - (no file)
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.goole.com.sa/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {59E21531-1692-4FEB-8AB2-B095E123240F} = 84.23.101.84 84.23.101.85
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\erhv12zg.default\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-25 16:49
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(532)
c:\windows\system32\psqlpwd.dll
c:\program files\Fingerprint Reader Suite\homefus2.dll
c:\program files\Fingerprint Reader Suite\infra.dll
- - - - - - - > 'Explorer.exe'(1540)
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
.
Completion time: 2009-06-25 16:50
ComboFix-quarantined-files.txt 2009-06-25 13:50
Pre-Run: 72,618,090,496 bytes free
Post-Run: 73,302,786,048 bytes free
273 --- E O F --- 2009-06-23 23:33
وهذا تقرير الهاي جاك استخرجته بعد التقرير الاول
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:55:27 م, on 25/06/09
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\OEM02Mon.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\CManager.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Fingerprint Reader Suite\launcher.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{59E21531-1692-4FEB-8AB2-B095E123240F}: NameServer = 84.23.101.84 84.23.101.85
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: BandLuxe Service (BandLuxe_Service) - BandRich Inc. - C:\Program Files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
--
End of file - 5892 bytes
.png)
.png)
