شكرا لاهتمامك بالموضوع اخي AbOdy
انا جربت اعمل مثل ما قلتلي بالنسبة لالغاء استعادة النظام لجميع الاقراص بس ما نفع والصورة بتوضح
وبعد ما عملت سكان باكومبو فيكس
المهم عملت الي قلتلي عليه وعطلت استعادة النظام اوكي
وهادا تقرير الكومبو فيكس
ComboFix 09-07-01.01 - خالد 07/02/2009 14:39.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.2047.1660 [GMT 3:00]
Running from: f:\برامج\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-06-02 to 2009-07-02 )))))))))))))))))))))))))))))))
.
2009-07-02 11:36 . 2009-07-02 11:36 22784 ----a-w- c:\windows\system32\winxp.exe
2009-07-02 11:05 . 2005-05-03 10:43 69632 ----a-w- c:\windows\Alcmtr.exe
2009-07-02 10:42 . 2001-09-19 14:00 73216 -c--a-w- c:\windows\system32\dllcache\avwav.dll
2009-07-01 22:45 . 2009-07-01 22:45 -------- d-----w- c:\program files\CodeStuff
2009-07-01 22:02 . 2009-07-01 22:02 -------- d-----w- c:\program files\Sierra Entertainment
2009-07-01 05:50 . 2009-07-01 05:50 -------- d-----w- C:\Hotspot Shield
2009-07-01 05:33 . 2009-07-01 05:36 -------- d-----w- c:\documents and settings\خالد\Local Settings\Application Data\Hotspot_Shield
2009-07-01 04:49 . 2009-07-01 04:49 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-07-01 04:22 . 2009-07-01 04:22 -------- d-sh--w- c:\documents and settings\خالد\PrivacIE
2009-07-01 04:21 . 2009-07-01 04:21 -------- d-sh--w- c:\documents and settings\خالد\IECompatCache
2009-07-01 04:19 . 2009-07-01 04:19 -------- d-sh--w- c:\documents and settings\خالد\IETldCache
2009-07-01 04:15 . 2009-07-01 04:15 -------- d-----w- c:\windows\system32\KB905474
2009-07-01 04:15 . 2009-03-10 19:26 1430400 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-07-01 04:15 . 2009-03-10 19:18 453000 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2009-07-01 04:14 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-07-01 04:14 . 2009-07-01 04:14 -------- d-----w- c:\windows\ie8updates
2009-07-01 04:14 . 2009-04-30 21:13 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-07-01 04:14 . 2009-04-30 21:13 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-07-01 04:14 . 2009-04-30 21:13 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-07-01 04:14 . 2009-04-30 21:13 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-07-01 04:12 . 2009-07-01 04:14 -------- dc-h--w- c:\windows\ie8
2009-07-01 03:16 . 2009-07-01 05:27 22784 ----a-w- c:\windows\system32\RLPack.exe
2009-06-30 20:06 . 2009-02-09 11:22 2190592 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-06-30 20:06 . 2009-02-09 11:22 2146816 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-06-30 20:06 . 2009-02-09 11:22 2025472 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-06-30 19:55 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-06-30 19:33 . 2008-06-14 17:31 271616 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-06-30 19:33 . 2008-06-14 17:31 271616 ------w- c:\windows\system32\drivers\bthport.sys
2009-06-30 19:27 . 2009-07-01 03:35 63 ----a-w- c:\windows\AlfaStart.CMD
2009-06-30 19:27 . 2009-06-30 20:11 245 ----a-w- c:\windows\StartClean.cmd
2009-06-30 19:27 . 2009-06-30 20:11 1100 ----a-w- c:\windows\AlfaRun.cmd
2009-06-30 19:27 . 2009-06-30 19:27 -------- d-----w- c:\program files\Alfa Autorun Killer 2
2009-06-30 18:57 . 2009-01-07 15:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-06-30 18:57 . 2009-07-01 04:16 -------- d--h--w- c:\windows\$hf_mig$
2009-06-27 21:21 . 2008-09-24 07:40 4122368 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
2009-06-27 21:21 . 2006-12-08 12:20 10528768 ----a-w- c:\windows\system32\RTLCPL.exe
2009-06-27 21:20 . 2009-06-27 21:20 -------- d-----w- c:\program files\Realtek AC97
2009-06-27 21:20 . 2006-07-31 08:27 217088 ----a-w- c:\windows\alcrmv.exe
2009-06-27 21:20 . 2006-07-31 08:19 315392 ----a-w- c:\windows\alcupd.exe
2009-06-27 19:14 . 2009-06-27 19:14 -------- d-----w- c:\windows\FARCRY
2009-06-27 19:12 . 2009-06-27 19:14 2926768 ----a-w- c:\documents and settings\خالد\Application Data\IDM\idmupdt.exe
2009-06-27 13:27 . 2009-06-27 13:41 4970105 ----a-w- c:\documents and settings\خالد\Application Data\IDM\DwnlData\خالد\megamanager_239\megamanager.exe
2009-06-25 20:52 . 2009-06-25 20:52 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-06-25 20:45 . 2009-06-25 20:53 -------- d-----w- c:\program files\DirectX Happy Uninstall
2009-06-25 18:07 . 2009-06-25 18:07 -------- d-----w- c:\program files\Trend Micro
2009-06-25 17:25 . 2009-06-25 17:25 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-06-24 20:28 . 2009-06-24 20:28 932368 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2009-06-24 20:28 . 2009-06-24 20:28 678416 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2009-06-24 20:28 . 2009-06-24 20:28 604688 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2009-06-24 20:28 . 2009-06-24 20:28 522768 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2009-06-24 20:28 . 2009-06-24 20:28 1096208 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2009-06-24 17:51 . 2009-06-24 17:51 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-06-24 17:47 . 2009-06-24 17:47 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-24 17:47 . 2009-06-24 17:47 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-24 17:46 . 2009-07-02 11:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-24 17:46 . 2009-06-24 17:46 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-24 17:45 . 2009-06-24 17:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-24 15:51 . 2009-06-24 15:51 2005 ----a-w- c:\windows\system32\sdbackup.reg
2009-06-24 14:01 . 2009-06-24 14:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-06-24 14:01 . 2009-06-24 14:01 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-06-24 08:33 . 2009-07-02 11:44 54482976 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-24 08:29 . 2009-06-24 08:29 -------- d-----w- c:\documents and settings\LocalService\سطح المكتب
2009-06-24 08:28 . 2009-06-24 08:28 -------- d-----w- c:\documents and settings\خالد\Local Settings\Application Data\Symantec
2009-06-24 06:05 . 2007-03-21 17:39 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2009-06-24 06:05 . 2009-06-24 14:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-06-23 18:38 . 2008-07-08 11:54 148496 ----a-w- c:\windows\system32\drivers\57907138.sys
2009-06-23 13:25 . 2009-06-23 13:25 639224 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-06-22 16:30 . 2003-06-18 14:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2009-06-22 16:30 . 2009-06-22 16:30 -------- d-----w- c:\program files\Microsoft.NET
2009-06-22 16:29 . 2009-06-22 16:30 -------- d--h--w- c:\windows\ShellNew
2009-06-22 16:12 . 2009-06-22 16:12 -------- d-----w- c:\windows\3FDF4C9CBFA043AEB7D454BC33B1B0DA.TMP
2009-06-22 16:11 . 2009-06-22 16:14 -------- d-----w- c:\windows\NV36723684.TMP
2009-06-22 16:10 . 2009-06-22 16:10 -------- d-----w- c:\program files\AGEIA Technologies
2009-06-22 16:10 . 2009-06-22 16:10 -------- d-----w- c:\windows\system32\AGEIA
2009-06-22 16:09 . 2009-06-22 16:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-22 16:08 . 2009-06-22 16:13 -------- d-----w- c:\windows\nview
2009-06-22 16:08 . 2008-10-07 05:33 453152 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-22 16:06 . 2008-07-23 12:24 446464 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-06-21 08:37 . 2009-06-21 08:37 -------- d--h--w- c:\windows\PIF
2009-06-20 11:04 . 2009-06-20 11:04 -------- d--h--r- c:\documents and settings\خالد\Application Data\SecuROM
2009-06-18 15:36 . 2009-06-18 15:36 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-17 07:15 . 2009-06-17 07:15 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-16 07:56 . 2009-06-30 11:43 -------- d-----w- c:\windows\system32\NtmsData
2009-06-15 21:15 . 2009-07-02 11:43 49 ----a-w- c:\windows\system32\_WDYSZYG.sys
2009-06-15 21:15 . 2009-07-01 03:55 -------- d-----w- c:\program files\WinUtilities
2009-06-14 16:55 . 2009-06-14 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Ubisoft
2009-06-14 16:55 . 2009-06-14 16:55 -------- d-----w- c:\documents and settings\خالد\Application Data\Ubisoft
2009-06-14 09:40 . 2008-06-26 11:34 11776 ----a-w- c:\documents and settings\خالد\Application Data\Mozilla\Firefox\Profiles\k0des5km.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
2009-06-14 09:40 . 2008-06-26 11:34 114688 ----a-w- c:\documents and settings\خالد\Application Data\Mozilla\Firefox\Profiles\k0des5km.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\npmozax.dll
2009-06-14 09:37 . 2009-06-14 09:40 -------- d-----w- c:\program files\Hotspot Shield
2009-06-07 10:13 . 2007-10-22 00:39 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
2009-06-07 10:13 . 2007-10-12 12:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
2009-06-07 10:13 . 2007-10-12 12:14 1374232 ----a-w- c:\windows\system32\D3DCompiler_36.dll
2009-06-07 10:13 . 2007-10-02 06:56 444776 ----a-w- c:\windows\system32\d3dx10_36.dll
2009-06-07 10:08 . 2009-06-07 10:08 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-06 10:52 . 2009-06-06 10:52 -------- d-----w- c:\documents and settings\خالد\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-06-06 10:52 . 2009-06-17 07:14 38208 ----a-w- c:\documents and settings\خالد\Application Data\Macromedia\Flash Player\
2009-06-04 18:06 . 2009-06-04 18:06 0 ----a-w- c:\windows\system32\cd.dat
2009-06-04 16:00 . 2009-06-04 16:00 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.459\English\setup.exe
2009-06-02 15:51 . 2009-06-23 07:18 -------- d-----w- c:\documents and settings\خالد\Local Settings\Application Data\DFH
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-02 11:42 . 2009-06-24 08:33 641960 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-02 11:41 . 2001-09-19 15:00 41076 ----a-w- c:\windows\system32\perfc001.dat
2009-07-02 11:41 . 2001-09-19 15:00 254326 ----a-w- c:\windows\system32\perfh001.dat
2009-07-02 09:42 . 2009-05-29 19:45 10 ----a-w- c:\windows\popcinfo.dat
2009-07-02 00:32 . 2009-05-30 06:27 -------- d-----w- c:\documents and settings\خالد\Application Data\Hamachi
2009-07-01 21:53 . 2009-05-29 19:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-01 05:34 . 2009-05-29 18:21 73744 ----a-w- c:\documents and settings\خالد\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-01 05:31 . 2009-05-29 19:37 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-01 05:31 . 2009-05-30 06:45 -------- d-----w- c:\program files\Real
2009-06-28 16:00 . 2009-05-30 06:45 -------- d-----w- c:\documents and settings\خالد\Application Data\IDM
2009-06-28 16:00 . 2009-05-30 06:45 -------- d-----w- c:\program files\Internet Download Manager
2009-06-28 14:16 . 2009-05-30 06:45 -------- d-----w- c:\documents and settings\خالد\Application Data\DMCache
2009-06-23 07:22 . 2009-05-30 20:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-06-22 21:02 . 2009-05-29 19:36 -------- d-----w- c:\program files\Realtek
2009-06-18 15:35 . 2009-05-30 06:45 -------- d-----w- c:\program files\Common Files\Real
2009-06-09 09:44 . 2009-05-30 06:46 -------- d-----w- c:\program files\Hamachi
2009-06-01 18:13 . 2009-06-01 18:13 33840 ----a-w- c:\windows\system32\drivers\HssDrv.sys
2009-05-31 11:27 . 2009-05-31 11:27 -------- d-----w- c:\program files\Conduit
2009-05-30 20:33 . 2009-05-30 20:33 -------- d-----w- c:\program files\DIFX
2009-05-30 20:33 . 2009-05-30 20:33 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-05-30 20:33 . 2009-05-30 20:33 -------- d-----w- c:\documents and settings\خالد\Application Data\PC Suite
2009-05-30 09:41 . 2009-05-30 09:40 -------- d-----w- c:\program files\Windows Live
2009-05-30 09:41 . 2009-05-30 09:41 -------- d-----w- c:\program files\Microsoft
2009-05-30 09:41 . 2009-05-30 09:41 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-05-30 08:41 . 2009-05-30 08:41 -------- d-----w- c:\program files\Common Files\Windows Live
2009-05-30 08:38 . 2009-05-30 08:37 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-30 08:37 . 2009-05-30 07:21 978 ----a-w- c:\windows\eReg.dat
2009-05-30 07:08 . 2009-05-30 06:46 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-05-30 06:44 . 2009-05-30 06:44 0 ----a-w- c:\windows\nsreg.dat
2009-05-29 21:33 . 2009-05-29 21:33 -------- d-----w- c:\program files\Askey Computer
2009-05-29 19:38 . 2009-05-29 19:38 315392 ----a-w- c:\windows\HideWin.exe
2009-05-29 19:37 . 2009-05-29 19:37 -------- d-----w- c:\program files\Intel
2009-05-29 19:36 . 2009-05-29 19:36 -------- d-----w- c:\documents and settings\خالد\Application Data\InstallShield
2009-05-29 19:36 . 2009-05-29 19:36 -------- d-----w- c:\program files\MSXML 4.0
2009-05-29 18:42 . 2009-05-29 18:15 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-29 18:16 . 2009-05-29 18:16 -------- d-----w- c:\program files\microsoft frontpage
2009-05-29 18:13 . 2009-05-29 18:13 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-25 02:21 . 2009-05-25 02:21 219664 ----a-w- c:\windows\system32\klogon.dll
2009-05-25 02:18 . 2009-05-25 02:18 27507 ----a-w- c:\windows\system32\drivers\klopp.dat
2009-05-24 12:30 . 2009-05-24 12:30 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-05-16 17:59 . 2009-05-16 17:59 19472 ----a-w- c:\windows\system32\drivers\klmouflt.sys
2009-05-13 14:46 . 2009-05-13 14:46 31760 ----a-w- c:\windows\system32\drivers\klim5.sys
2009-05-13 05:02 . 2008-04-14 18:29 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:32 . 2008-04-14 18:29 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-19 19:47 . 2008-04-14 18:07 1847040 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:52 . 2008-04-14 18:29 585216 ----a-w- c:\windows\system32\rpcrt4.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-07-01_05.51.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-02 11:44 . 2009-07-02 11:44 16384 c:\windows\temp\Perflib_Perfdata_264.dat
+ 2009-07-02 11:37 . 2009-07-02 11:37 16384 c:\windows\temp\Perflib_Perfdata_128.dat
+ 2009-07-02 10:42 . 2001-09-19 14:00 35328 c:\windows\system32\winchat.exe
+ 2009-05-29 18:17 . 2008-04-14 18:29 39936 c:\windows\system32\wbem\snmpthrd.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 10240 c:\windows\system32\wbem\snmpstup.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 15872 c:\windows\system32\wbem\snmp\smierrsm.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 57344 c:\windows\system32\sol.exe
+ 2009-05-29 18:17 . 2008-04-14 18:30 33280 c:\windows\system32\snmp.exe
+ 2009-07-02 11:05 . 2008-04-14 18:30 23552 c:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\wdmaud.drv
+ 2009-07-02 11:05 . 2004-07-09 01:27 48512 c:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\stream.sys
+ 2009-07-02 11:05 . 2008-04-13 21:15 60160 c:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\drmk.sys
- 2001-09-19 15:00 . 2009-07-01 04:23 40972 c:\windows\system32\perfc009.dat
+ 2001-09-19 15:00 . 2009-07-02 11:41 40972 c:\windows\system32\perfc009.dat
+ 2009-05-29 18:17 . 2008-04-14 18:29 33792 c:\windows\system32\lmmib2.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 44544 c:\windows\system32\hticons.dll
+ 2009-05-29 18:17 . 2008-04-14 18:29 39936 c:\windows\system32\hostmib.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 55808 c:\windows\system32\freecell.exe
+ 2009-05-29 18:16 . 2008-04-14 18:29 91648 c:\windows\system32\evntwin.exe
+ 2009-05-29 18:16 . 2008-04-14 18:29 24064 c:\windows\system32\evntcmd.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 13894 c:\windows\system32\dllcache\zonelibm.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 13894 c:\windows\system32\dllcache\zonelibm.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 29760 c:\windows\system32\dllcache\znetm.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 29760 c:\windows\system32\dllcache\znetm.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 41029 c:\windows\system32\dllcache\zcorem.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 41029 c:\windows\system32\dllcache\zcorem.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 36937 c:\windows\system32\dllcache\zclientm.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 36937 c:\windows\system32\dllcache\zclientm.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 35328 c:\windows\system32\dllcache\winchat.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 35328 c:\windows\system32\dllcache\winchat.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 32339 c:\windows\system32\dllcache\uniansi.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 32339 c:\windows\system32\dllcache\uniansi.dll
+ 2009-06-25 20:49 . 2004-07-09 01:27 48512 c:\windows\system32\dllcache\stream.sys
+ 2009-07-02 10:42 . 2001-09-19 14:00 57344 c:\windows\system32\dllcache\sol.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 57344 c:\windows\system32\dllcache\sol.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 10240 c:\windows\system32\dllcache\snmpstup.dll
- 2009-05-29 18:17 . 2001-09-19 15:00 10240 c:\windows\system32\dllcache\snmpstup.dll
- 2009-05-29 18:17 . 2001-09-19 15:00 15872 c:\windows\system32\dllcache\smierrsm.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 15872 c:\windows\system32\dllcache\smierrsm.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 42573 c:\windows\system32\dllcache\shvlzm.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 42573 c:\windows\system32\dllcache\shvlzm.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 66113 c:\windows\system32\dllcache\shvl.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 66113 c:\windows\system32\dllcache\shvl.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 42574 c:\windows\system32\dllcache\rvsezm.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 42574 c:\windows\system32\dllcache\rvsezm.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 48706 c:\windows\system32\dllcache\rvse.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 48706 c:\windows\system32\dllcache\rvse.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 13312 c:\windows\system32\dllcache\htrn_jis.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 13312 c:\windows\system32\dllcache\htrn_jis.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 42573 c:\windows\system32\dllcache\hrtzzm.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 42573 c:\windows\system32\dllcache\hrtzzm.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 57409 c:\windows\system32\dllcache\hrtz.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 57409 c:\windows\system32\dllcache\hrtz.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 55808 c:\windows\system32\dllcache\freecell.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 55808 c:\windows\system32\dllcache\freecell.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 42575 c:\windows\system32\dllcache\chkrzm.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 42575 c:\windows\system32\dllcache\chkrzm.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 40515 c:\windows\system32\dllcache\chkr.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 40515 c:\windows\system32\dllcache\chkr.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 80384 c:\windows\system32\dllcache\charmap.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 80384 c:\windows\system32\dllcache\charmap.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 42577 c:\windows\system32\dllcache\bckgzm.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 42577 c:\windows\system32\dllcache\bckgzm.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 82501 c:\windows\system32\dllcache\bckg.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 82501 c:\windows\system32\dllcache\bckg.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 16384 c:\windows\system32\dllcache\avmeter.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 16384 c:\windows\system32\dllcache\avmeter.dll
- 2009-05-29 19:38 . 2006-08-01 12:02 49152 c:\windows\system32\ChCfg.exe
+ 2009-05-29 19:38 . 2006-08-01 07:02 49152 c:\windows\system32\ChCfg.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 80384 c:\windows\system32\charmap.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 73216 c:\windows\system32\avwav.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 16384 c:\windows\system32\avmeter.dll
+ 2009-05-29 19:38 . 2006-07-21 08:14 86016 c:\windows\SoundMan.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 5632 c:\windows\system32\write.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 5632 c:\windows\system32\wbem\snmp\smimsgif.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 5632 c:\windows\system32\wbem\snmp\smierrsy.dll
+ 2009-05-29 18:17 . 2008-04-14 18:30 8704 c:\windows\system32\snmptrap.exe
+ 2009-05-29 18:17 . 2008-04-14 18:29 6144 c:\windows\system32\snmpmib.dll
+ 2009-07-02 11:05 . 2002-12-11 21:14 4096 c:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\ksuser.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 4677 c:\windows\system32\dllcache\zeeverm.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 4677 c:\windows\system32\dllcache\zeeverm.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 5632 c:\windows\system32\dllcache\write.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 5632 c:\windows\system32\dllcache\write.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 5632 c:\windows\system32\dllcache\smimsgif.dll
- 2009-05-29 18:17 . 2001-09-19 15:00 5632 c:\windows\system32\dllcache\smimsgif.dll
- 2009-05-29 18:17 . 2001-09-19 15:00 5632 c:\windows\system32\dllcache\smierrsy.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 5632 c:\windows\system32\dllcache\smierrsy.dll
+ 2009-06-25 20:49 . 2002-12-11 21:14 4096 c:\windows\system32\dllcache\ksuser.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 119808 c:\windows\system32\winmine.exe
+ 2009-05-29 18:17 . 2008-04-14 18:29 188416 c:\windows\system32\wbem\snmpsmir.dll
+ 2009-05-29 18:17 . 2008-04-14 18:29 358400 c:\windows\system32\wbem\snmpincl.dll
+ 2009-05-29 18:17 . 2008-04-14 18:29 259072 c:\windows\system32\wbem\snmpcl.dll
+ 2009-05-29 18:17 . 2008-04-14 18:30 236544 c:\windows\system32\wbem\snmp\smi2smir.exe
+ 2009-05-29 18:12 . 2008-04-14 18:30 538624 c:\windows\system32\spider.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 139264 c:\windows\system32\sndvol32.exe
+ 2009-05-29 18:12 . 2008-04-14 18:30 131072 c:\windows\system32\sndrec32.exe
+ 2009-07-02 11:05 . 2007-04-16 12:28 577536 c:\windows\system32\ReinstallBackups\0016\DriverFiles\SOUNDMAN.EXE
+ 2009-07-02 11:05 . 2007-03-07 06:59 131072 c:\windows\system32\ReinstallBackups\0016\DriverFiles\RTLCPAPI.dll
+ 2009-07-02 11:05 . 2007-10-03 09:20 262144 c:\windows\system32\ReinstallBackups\0016\DriverFiles\RTCOMDLL.dll
+ 2009-07-02 11:05 . 2008-04-13 21:49 146048 c:\windows\system32\ReinstallBackups\0016\DriverFiles\i386\portcls.sys
+ 2009-07-02 10:59 . 2007-03-07 06:59 131072 c:\windows\system32\ReinstallBackups\0015\DriverFiles\RTLCPAPI.dll
+ 2009-07-02 10:59 . 2007-10-03 09:20 262144 c:\windows\system32\ReinstallBackups\0015\DriverFiles\RTCOMDLL.dll
+ 2009-07-02 10:51 . 2007-03-07 06:59 131072 c:\windows\system32\ReinstallBackups\0014\DriverFiles\RTLCPAPI.dll
+ 2009-07-02 10:51 . 2007-10-03 09:20 262144 c:\windows\system32\ReinstallBackups\0014\DriverFiles\RTCOMDLL.dll
- 2001-09-19 15:00 . 2009-07-01 04:23 314644 c:\windows\system32\perfh009.dat
+ 2001-09-19 15:00 . 2009-07-02 11:41 314644 c:\windows\system32\perfh009.dat
+ 2009-05-29 18:12 . 2008-04-14 18:30 342016 c:\windows\system32\mspaint.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 127488 c:\windows\system32\mshearts.exe
+ 2009-05-29 18:12 . 2008-04-14 18:29 123392 c:\windows\system32\mplay32.exe
+ 2009-07-02 10:42 . 2004-08-03 23:55 348672 c:\windows\system32\hypertrm.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 605696 c:\windows\system32\getuname.dll
+ 2009-05-29 21:03 . 2009-07-02 11:43 297256 c:\windows\system32\FNTCACHE.DAT
+ 2009-05-29 18:16 . 2008-04-14 18:29 101376 c:\windows\system32\evntagnt.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 113222 c:\windows\system32\dllcache\zoneclim.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 113222 c:\windows\system32\dllcache\zoneclim.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 119808 c:\windows\system32\dllcache\winmine.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 119808 c:\windows\system32\dllcache\winmine.exe
+ 2009-07-02 10:43 . 2001-09-19 14:00 139264 c:\windows\system32\dllcache\sndvol32.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 139264 c:\windows\system32\dllcache\sndvol32.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 753236 c:\windows\system32\dllcache\rvseres.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 753236 c:\windows\system32\dllcache\rvseres.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 127488 c:\windows\system32\dllcache\mshearts.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 127488 c:\windows\system32\dllcache\mshearts.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 605696 c:\windows\system32\dllcache\getuname.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 605696 c:\windows\system32\dllcache\getuname.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 217160 c:\windows\system32\dllcache\cmnclim.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 217160 c:\windows\system32\dllcache\cmnclim.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 780885 c:\windows\system32\dllcache\chkrres.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 780885 c:\windows\system32\dllcache\chkrres.dll
+ 2009-07-02 10:42 . 2001-09-19 14:00 114688 c:\windows\system32\dllcache\calc.exe
- 2009-05-29 18:12 . 2001-09-19 15:00 114688 c:\windows\system32\dllcache\calc.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 227840 c:\windows\system32\dllcache\avtapi.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 227840 c:\windows\system32\dllcache\avtapi.dll
+ 2009-05-29 18:12 . 2008-04-14 18:29 101888 c:\windows\system32\clipbrd.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 114688 c:\windows\system32\calc.exe
+ 2009-07-02 10:42 . 2001-09-19 14:00 227840 c:\windows\system32\avtapi.dll
+ 2009-05-29 18:12 . 2008-04-14 18:29 183296 c:\windows\system32\accwiz.exe
+ 2009-07-02 11:05 . 2007-10-11 03:04 1826816 c:\windows\system32\ReinstallBackups\0016\DriverFiles\SkyTel.exe
+ 2009-07-02 11:05 . 2007-07-26 10:06 1191936 c:\windows\system32\ReinstallBackups\0016\DriverFiles\RtlUpd.exe
+ 2009-07-02 11:05 . 2007-03-23 11:19 9715200 c:\windows\system32\ReinstallBackups\0016\DriverFiles\RTLCPL.EXE
+ 2009-07-02 11:05 . 2007-11-01 06:38 4620288 c:\windows\system32\ReinstallBackups\0016\DriverFiles\RtkHDAud.sys
+ 2009-07-02 11:05 . 2007-06-28 08:44 2165760 c:\windows\system32\ReinstallBackups\0016\DriverFiles\MicCal.exe
+ 2009-07-02 11:05 . 2006-05-04 08:26 2808832 c:\windows\system32\ReinstallBackups\0016\DriverFiles\ALCWZRD.EXE
+ 2009-07-02 10:59 . 2007-10-11 03:04 1826816 c:\windows\system32\ReinstallBackups\0015\DriverFiles\SkyTel.exe
+ 2009-07-02 10:59 . 2007-07-26 10:06 1191936 c:\windows\system32\ReinstallBackups\0015\DriverFiles\RtlUpd.exe
+ 2009-07-02 10:59 . 2007-03-23 11:19 9715200 c:\windows\system32\ReinstallBackups\0015\DriverFiles\RTLCPL.EXE
+ 2009-07-02 10:59 . 2007-11-01 06:38 4620288 c:\windows\system32\ReinstallBackups\0015\DriverFiles\RtkHDAud.sys
+ 2009-07-02 10:59 . 2007-06-28 08:44 2165760 c:\windows\system32\ReinstallBackups\0015\DriverFiles\MicCal.exe
+ 2009-07-02 10:59 . 2006-05-04 08:26 2808832 c:\windows\system32\ReinstallBackups\0015\DriverFiles\ALCWZRD.EXE
+ 2009-07-02 10:51 . 2007-10-11 03:04 1826816 c:\windows\system32\ReinstallBackups\0014\DriverFiles\SkyTel.exe
+ 2009-07-02 10:51 . 2007-07-26 10:06 1191936 c:\windows\system32\ReinstallBackups\0014\DriverFiles\RtlUpd.exe
+ 2009-07-02 10:51 . 2007-03-23 11:19 9715200 c:\windows\system32\ReinstallBackups\0014\DriverFiles\RTLCPL.EXE
+ 2009-07-02 10:51 . 2007-11-01 06:38 4620288 c:\windows\system32\ReinstallBackups\0014\DriverFiles\RtkHDAud.sys
+ 2009-07-02 10:51 . 2007-06-28 08:44 2165760 c:\windows\system32\ReinstallBackups\0014\DriverFiles\MicCal.exe
+ 2009-07-02 10:51 . 2006-05-04 08:26 2808832 c:\windows\system32\ReinstallBackups\0014\DriverFiles\ALCWZRD.EXE
+ 2009-07-02 10:43 . 2001-09-19 14:00 2178131 c:\windows\system32\dllcache\shvlres.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 2178131 c:\windows\system32\dllcache\shvlres.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 1175635 c:\windows\system32\dllcache\hrtzres.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 1175635 c:\windows\system32\dllcache\hrtzres.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 1039955 c:\windows\system32\dllcache\cmnresm.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 1039955 c:\windows\system32\dllcache\cmnresm.dll
+ 2009-07-02 10:43 . 2001-09-19 14:00 1817687 c:\windows\system32\dllcache\bckgres.dll
- 2009-05-29 18:12 . 2001-09-19 15:00 1817687 c:\windows\system32\dllcache\bckgres.dll
+ 2009-07-02 11:05 . 2007-10-25 03:57 16855552 c:\windows\system32\ReinstallBackups\0016\DriverFiles\RTHDCPL.EXE
+ 2009-07-02 10:59 . 2007-10-25 03:57 16855552 c:\windows\system32\ReinstallBackups\0015\DriverFiles\RTHDCPL.EXE
+ 2009-07-02 10:51 . 2007-10-25 03:57 16855552 c:\windows\system32\ReinstallBackups\0014\DriverFiles\RTHDCPL.EXE
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-06-14 09:37 218160 ----a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-26 13570048]
"WinUtilities Quick Launcher"="c:\program files\WinUtilities\WO.exe" [2009-07-01 2355200]
"FB921EB4"="c:\windows\system32\RLPack.exe" [2009-07-01 22784]
"regdiit"="c:\windows\system32\winxp.exe" [2009-07-02 22784]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-18 198160]
"DAEMON Tools"="f:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-05-25 303376]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-25 16855552]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-10-11 1826816]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe]
"Debugger"=c:\windows\system32\wscript.exe /E:vbs c:\windows\system32\winjpg.jpg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dwwinxp.exe]
"Debugger"=c:\windows\system32\winxp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"f:\\العاب\\جنرالز\\زيرو اور\\game.dat"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"e:\\Program Files\\COD 2\\CoD2MP_s.exe"=
"e:\\بتلفيلد\\بتلفيلد\\BF2.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 08:41 م 33808]
R1 is-E8KS9drv;is-E8KS9drv;c:\windows\system32\drivers\57907138.sys [23/06/2009 09:38 م 148496]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [01/06/2009 09:13 م 331312]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 05:46 م 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 08:59 م 19472]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [01/06/2009 09:58 م 34352]
S3 utezodg4;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\utezodg4.sys --> c:\windows\system32\Drivers\utezodg4.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1590A643-53AD-A5F6-20CE-69B74E37DC68}]
c:\windows\system32\RLPack.exe
.
Contents of the 'Scheduled Tasks' folder
2009-07-02 c:\windows\Tasks\User_Feed_Synchronization-{A8FEC442-4522-4202-A42F-87A70697FEC3}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]
2009-07-02 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-07-01 19:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
IE: {{CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
FF - ProfilePath - c:\documents and settings\خالد\Application Data\Mozilla\Firefox\Profiles\k0des5km.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - component: c:\documents and settings\خالد\Application Data\Mozilla\Firefox\Profiles\k0des5km.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\FFAlert.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-02 14:44
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
FB921EB4 = c:\windows\system32\RLPack.exe????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2224)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\snmp.exe
.
**************************************************************************
.
Completion time: 2009-07-02 14:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-02 11:47
ComboFix2.txt 2009-07-01 05:53
Pre-Run: 27,930,656,768 bytes free
Post-Run: 27,947,429,888 bytes free
445 --- E O F --- 2009-07-01 04:17
***************************************************************************
وبعدها عملت فحص باداة المكافي الي قلتلي عنها وهادا التقرير
***************************************************************************
وبعد كدا فتحت برنامج starter وعملت دليت للقيم المشار اليها بالاحمر بالصورة التالية
*****************************************************************************
وبعده بالهاياك وهاد التقرير لكن ما لقيت شي في الهايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:52:42 م, on 02/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\CodeStuff\Starter\Starter.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinUtilities Quick Launcher] C:\Program Files\WinUtilities\WO.exe /autorun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\RunOnce: [KB923561] rundll32.exe apphelp.dll,ShimFlushCache
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5264 bytes
بعد هادا كله ضل شي لازم اعملو
مشكور مقدما
