اخي ،،،
عملت استعادة للنظام لنقطه سابقه ،،
الحمد لله شبك النت ..
وهذا تقرير الملف اللي اعطاني البرنامج التقرير :
ComboFix 09-07-08.04 - alaooi 07/09/2009 2:30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.511.223 [GMT 3:00]
Running from: c:\documents and settings\alaooi\Desktop\ComboFix.exe
AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\7c24ed.msi
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\null.sys
.
((((((((((((((((((((((((( Files Created from 2009-06-08 to 2009-07-08 )))))))))))))))))))))))))))))))
.
2009-07-08 23:15 . 2009-07-08 23:15 -------- d-----w- c:\program files\Recuva
2009-07-08 22:53 . 2009-07-08 22:53 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-07-08 22:31 . 2009-07-08 22:34 -------- d-----w- c:\program files\The KMPlayer
2009-07-08 22:12 . 2009-07-08 22:12 -------- d-----w- c:\program files\Trend Micro
2009-07-08 18:29 . 2009-07-08 18:29 -------- d-----w- c:\windows\Sun
2009-07-08 14:48 . 2009-07-08 20:51 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-07-08 11:24 . 2009-07-08 11:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-07-08 11:15 . 2009-07-08 11:15 -------- d-----w- C:\Quarantine
2009-07-08 00:54 . 2009-07-08 00:54 -------- d-----w- c:\program files\Vienna Wallpapers
2009-07-07 23:39 . 2004-08-03 21:56 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-07-07 23:37 . 2009-07-07 23:37 -------- d-----w- c:\program files\Sun
2009-07-07 23:36 . 2009-07-07 23:36 -------- d-----w- c:\program files\Common Files\Java
2009-07-07 23:32 . 2009-07-08 16:31 -------- d-----w- c:\program files\Norton Security Scan
2009-07-07 23:31 . 2009-07-07 23:32 -------- d-----w- c:\windows\system32\Adobe
2009-07-07 22:54 . 2009-07-07 22:55 -------- d-----w- c:\program files\QuickTime
2009-07-07 22:54 . 2009-07-07 22:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-07-07 22:54 . 2009-07-07 22:54 -------- d-----w- c:\documents and settings\alaooi\Local Settings\Application Data\Apple
2009-07-07 22:54 . 2009-07-07 22:54 -------- d-----w- c:\program files\Apple Software Update
2009-07-07 22:54 . 2009-07-07 22:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-07-07 22:54 . 2009-07-07 22:54 -------- d-----w- c:\documents and settings\alaooi\Local Settings\Application Data\Apple Computer
2009-07-07 22:30 . 2009-07-07 22:30 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-07 22:30 . 2009-07-07 23:37 -------- d-----w- c:\program files\Java
2009-07-07 21:32 . 2009-07-07 21:32 -------- d-----w- c:\documents and settings\alaooi\Local Settings\Application Data\True BoxShot
2009-07-07 21:32 . 2009-07-07 21:32 -------- d-----w- c:\program files\Common Files\True BoxShot for Adobe Photoshop
2009-07-07 21:27 . 2009-07-07 21:29 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-07 21:22 . 2009-07-07 21:22 -------- d-----w- c:\program files\Yahoo!
2009-07-07 21:22 . 2009-07-07 21:23 -------- d-----w- c:\program files\CCleaner
2009-07-07 21:22 . 2009-07-07 21:22 -------- d-----w- c:\program files\SWiSH Jukebox
2009-07-07 21:21 . 2009-07-07 21:22 -------- d-----w- c:\program files\SWiSH Max2
2009-07-07 21:21 . 2008-05-21 14:29 -------- d-----w- c:\program files\Adobe Flash Player 9
2009-07-07 21:07 . 2009-07-07 21:07 -------- d-s---w- c:\documents and settings\alaooi\UserData
2009-07-07 14:13 . 2008-10-16 11:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-07-07 14:13 . 2008-10-16 11:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-07-07 14:11 . 2006-10-26 16:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-07-07 14:09 . 2009-07-07 14:09 -------- d-----w- c:\program files\Microsoft Works
2009-07-07 14:09 . 2009-07-07 14:09 -------- d-----w- c:\program files\MSBuild
2009-07-07 14:08 . 2009-07-07 14:08 -------- d-----w- c:\program files\Microsoft.NET
2009-07-07 14:06 . 2009-07-07 14:06 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-07-07 14:05 . 2009-07-07 14:08 -------- d-----w- c:\windows\SHELLNEW
2009-07-07 14:05 . 2009-07-07 14:05 -------- d-----w- c:\documents and settings\alaooi\Local Settings\Application Data\Microsoft Help
2009-07-07 14:04 . 2009-07-07 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-07-07 14:04 . 2009-07-07 14:04 -------- d--h--r- C:\MSOCache
2009-07-07 13:32 . 2001-08-23 12:00 838144 -c--a-w- c:\windows\system32\dllcache\chtbrkr.dll
2009-07-07 13:32 . 2001-08-23 12:00 838144 ----a-w- c:\windows\system32\chtbrkr.dll
2009-07-07 13:32 . 2001-08-23 12:00 1677824 -c--a-w- c:\windows\system32\dllcache\chsbrkr.dll
2009-07-07 13:32 . 2001-08-23 12:00 1677824 ----a-w- c:\windows\system32\chsbrkr.dll
2009-07-07 13:32 . 2001-08-23 12:00 98304 -c--a-w- c:\windows\system32\dllcache\msir3jp.dll
2009-07-07 13:32 . 2001-08-23 12:00 98304 ----a-w- c:\windows\system32\msir3jp.dll
2009-07-07 13:32 . 2001-08-23 12:00 70656 -c--a-w- c:\windows\system32\dllcache\korwbrkr.dll
2009-07-07 13:32 . 2001-08-23 12:00 70656 ----a-w- c:\windows\system32\korwbrkr.dll
2009-07-07 13:32 . 2001-08-23 12:00 19456 -c--a-w- c:\windows\system32\dllcache\agt0404.dll
2009-07-07 13:32 . 2001-08-23 12:00 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2009-07-07 12:35 . 2004-08-03 20:07 52864 -c--a-w- c:\windows\system32\dllcache\dmusic.sys
2009-07-07 12:35 . 2004-08-03 20:07 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2009-07-07 12:35 . 2001-08-17 11:00 54272 -c--a-w- c:\windows\system32\dllcache\swmidi.sys
2009-07-07 12:35 . 2001-08-17 11:00 54272 ----a-w- c:\windows\system32\drivers\swmidi.sys
2009-07-07 12:35 . 2004-08-03 19:39 142464 -c--a-w- c:\windows\system32\dllcache\aec.sys
2009-07-07 12:35 . 2004-08-03 19:39 142464 ----a-w- c:\windows\system32\drivers\aec.sys
2009-07-07 12:34 . 2004-08-03 20:07 6400 -c--a-w- c:\windows\system32\dllcache\splitter.sys
2009-07-07 12:34 . 2004-08-03 20:07 6400 ----a-w- c:\windows\system32\drivers\splitter.sys
2009-07-07 12:34 . 2004-08-03 20:15 82944 -c--a-w- c:\windows\system32\dllcache\wdmaud.sys
2009-07-07 12:34 . 2004-08-03 20:15 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2009-07-07 12:32 . 2004-08-03 20:07 171776 -c--a-w- c:\windows\system32\dllcache\kmixer.sys
2009-07-07 12:32 . 2004-08-03 20:07 171776 ----a-w- c:\windows\system32\drivers\kmixer.sys
2009-07-07 12:32 . 2004-08-03 20:07 2944 -c--a-w- c:\windows\system32\dllcache\drmkaud.sys
2009-07-07 12:32 . 2004-08-03 20:07 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2009-07-07 12:32 . 2004-08-03 20:15 60800 -c--a-w- c:\windows\system32\dllcache\sysaudio.sys
2009-07-07 12:32 . 2004-08-03 20:15 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2009-07-07 12:32 . 2004-08-03 19:58 7552 -c--a-w- c:\windows\system32\dllcache\mskssrv.sys
2009-07-07 12:32 . 2004-08-03 19:58 7552 ----a-w- c:\windows\system32\drivers\MSKSSRV.sys
2009-07-07 12:32 . 2004-08-03 19:58 4992 -c--a-w- c:\windows\system32\dllcache\mspqm.sys
2009-07-07 12:32 . 2004-08-03 19:58 4992 ----a-w- c:\windows\system32\drivers\MSPQM.sys
2009-07-07 12:32 . 2004-08-03 19:58 5376 -c--a-w- c:\windows\system32\dllcache\mspclock.sys
2009-07-07 12:32 . 2004-08-03 19:58 5376 ----a-w- c:\windows\system32\drivers\MSPCLOCK.sys
2009-07-07 12:31 . 2004-08-03 21:56 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
2009-07-07 12:31 . 2004-08-03 21:56 4096 ----a-w- c:\windows\system32\ksuser.dll
2009-07-07 12:31 . 2004-08-03 20:15 145792 -c--a-w- c:\windows\system32\dllcache\portcls.sys
2009-07-07 12:31 . 2004-08-03 20:15 145792 ----a-w- c:\windows\system32\drivers\portcls.sys
2009-07-07 12:31 . 2004-08-03 20:08 60288 -c--a-w- c:\windows\system32\dllcache\drmk.sys
2009-07-07 12:31 . 2004-08-03 20:08 60288 ----a-w- c:\windows\system32\drivers\drmk.sys
2009-07-07 12:31 . 2004-02-24 10:41 36864 ----a-w- c:\windows\system32\UnAudioNT.dll
2009-07-07 12:31 . 2009-07-07 12:31 -------- d-----w- c:\program files\VIA Technologies, Inc
2009-07-07 12:31 . 2004-02-10 19:51 115840 ----a-w- c:\windows\system32\drivers\viaudios.sys
2009-07-07 12:23 . 2009-07-08 17:47 -------- d-----w- c:\documents and settings\alaooi\Tracing
2009-07-07 12:17 . 2009-07-07 12:17 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-07-07 12:16 . 2006-11-29 10:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-07-07 12:16 . 2009-07-07 12:16 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-07-07 12:15 . 2009-07-07 12:15 -------- d-----w- c:\program files\Microsoft
2009-07-07 12:15 . 2009-07-07 12:15 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-07-07 12:14 . 2009-07-07 12:21 -------- d-----w- c:\program files\Windows Live
2009-07-07 11:55 . 2009-07-07 11:55 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-07 11:30 . 2009-07-07 11:30 -------- d-----w- c:\program files\Windows Defender
2009-07-07 11:29 . 2009-07-07 11:29 -------- d-----w- c:\program files\الحاسبة المتطورة لـ Microsoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-07 21:27 . 2009-07-07 01:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-07 16:43 . 2009-07-07 00:41 106072 ----a-w- c:\documents and settings\alaooi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-07 02:43 . 2009-07-07 00:26 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-07-07 02:28 . 2009-07-07 02:28 52067 ----a-w- c:\windows\BricoPackUninst.cmd
2009-07-07 02:28 . 2009-07-07 02:26 4835 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-07-07 02:28 . 2004-08-03 21:56 218624 ----a-w- c:\windows\system32\uxtheme.dll
2009-07-07 02:15 . 2009-07-07 02:15 -------- d-----w- c:\documents and settings\alaooi\Application Data\Avant Profiles
2009-07-07 02:15 . 2009-07-07 02:15 -------- d-----w- c:\program files\Avant Browser
2009-07-07 02:03 . 2009-07-07 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-07-07 02:03 . 2009-07-07 02:03 -------- d-----w- c:\program files\Common Files\Cisco Systems
2009-07-07 02:03 . 2009-07-07 02:02 -------- d-----w- c:\program files\McAfee
2009-07-07 02:02 . 2009-07-07 02:02 -------- d-----w- c:\program files\Common Files\McAfee
2009-07-07 01:54 . 2009-07-07 01:54 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-07-07 01:54 . 2009-07-07 01:54 -------- d-----w- c:\program files\CyberLink
2009-07-07 01:53 . 2009-07-07 01:51 -------- d-----w- c:\program files\Ahead
2009-07-07 01:53 . 2009-07-07 01:51 -------- d-----w- c:\program files\Common Files\Ahead
2009-07-07 01:47 . 2009-07-07 01:47 -------- d-----w- c:\documents and settings\alaooi\Application Data\Hewlett-Packard
2009-07-07 01:47 . 2009-07-07 01:41 20458 ----a-w- c:\windows\hpoins01.dat
2009-07-07 01:47 . 2009-07-07 01:41 -------- d-----w- c:\program files\Hewlett-Packard
2009-07-07 01:42 . 2009-07-07 01:42 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-07-07 01:36 . 2009-07-07 01:36 -------- d-----w- c:\program files\KYE
2009-07-07 01:13 . 2009-07-07 01:13 -------- d-----w- c:\program files\Common Files\snpstd
2009-07-07 01:13 . 2009-07-07 00:48 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-07 01:12 . 2009-07-07 01:12 -------- d-----w- c:\program files\Vimicro
2009-07-07 01:10 . 2009-07-07 01:09 -------- d-----w- c:\program files\VIA
2009-07-07 01:07 . 2009-07-07 00:57 5 ----a-w- c:\windows\system32\BSETUP.TMP
2009-07-07 00:28 . 2009-07-07 00:28 -------- d-----w- c:\program files\microsoft frontpage
2009-07-07 00:24 . 2009-07-07 00:24 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-07 15:44 . 2004-08-03 21:56 344064 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:52 . 2004-08-03 21:56 659456 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:52 . 2004-08-03 21:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-17 09:58 . 2004-08-03 20:17 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 2004-08-03 21:56 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2008-03-09 03:25 . 2009-07-07 23:35 236 ---ha-w- c:\program files\Common Files\dx.reg
.
------- Sigcheck -------
Cryptography Services Error !!
.
(((((((((((((((((((((((((((((
SnapShot@2009-07-08_11.21.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-08 23:38 . 2009-07-08 23:38 16384 c:\windows\Temp\Perflib_Perfdata_220.dat
+ 2001-08-23 12:00 . 2009-07-08 16:25 59440 c:\windows\system32\perfc009.dat
- 2001-08-23 12:00 . 2009-07-08 10:34 59440 c:\windows\system32\perfc009.dat
+ 2001-08-23 12:00 . 2009-07-08 16:25 395200 c:\windows\system32\perfh009.dat
- 2001-08-23 12:00 . 2009-07-08 10:34 395200 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDeck"="c:\program files\VIA Technologies" [X]
"RaidTool"="c:\program files\VIA\RAID\raid_tool.exe" [2004-10-11 589824]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-06-04 1400944]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-07 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
"CHotkey"="mHotkey.exe" - c:\windows\mHotkey.exe [2002-10-09 493056]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-7-8 113664]
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmserver]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"= %windir%\system32\sessmgr.exe:*:enabled
xpsp2res.dll,-22019
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= c:\program files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"= %windir%\system32\sessmgr.exe:*:enabled
xpsp2res.dll,-22019
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"= c:\program files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= c:\program files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= c:\program files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= c:\program files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= c:\program files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote
"c:\\Program Files\\Messenger\\msmsgs.exe"= c:\program files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
S3 GAGPDrv;GAGPDrv; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter
DcomLaunch REG_MULTI_SZ DcomLaunch TermService
bthsvcs REG_MULTI_SZ BthServ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
Alerter
LmHosts
.
Contents of the 'Scheduled Tasks' folder
2009-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
2009-07-07 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8246931252.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 21:52]
2009-07-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 16:20]
.
.
------- Supplementary Scan -------
.
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-09 02:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\TEMP\TMP000000441924161C8926B213 524288 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10b.exe"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}\ProgID]
@Denied: (A) (Everyone)
@="{14F73AF0-14FC-4256-8455-9CAD5D41D078}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{3DA165B6-CC41-11d2-BDC6-00C04F79EC6B}\Version]
@Denied: (A) (Everyone)
@="{14F73AF0-14FC-4256-8455-9CAD5D41D078}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{8D8763AB-E93B-4812-964E-F04E0008FD50}\Version]
@Denied: (A) (Everyone)
@="{8D8763AB-E93B-4812-964E-F04E0008FD50}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx, 1"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\Flash10b.ocx, 1"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
[HKEY_LOCAL_MACHINE\softwareSoftware\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2284)
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Windows Defender\MsMpEng.exe
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\system32\rundll32.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\vstskmgr.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wdfmgr.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
c:\program files\McAfee\VirusScan Enterprise\mcshield.exe
.
**************************************************************************
.
Completion time: 2009-07-08 2:42 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-08 23:42
ComboFix2.txt 2009-07-08 11:23
Pre-Run: 32,864,313,344 bytes free
Post-Run: 33,081,577,472 bytes free
362 --- E O F --- 2009-07-07 23:41
