عذرا..
حدث خطأ...والجهاز مو جهازي...ألحين أنا أشتغل على جهاز آخر...
صارت الحروف والأرقام مقلوبة..لما أضغط زرد...يطلع لي غير المكتوب عليه..
أرجو الحل سريعا...
هذا التقرير..
ComboFix 09-07-14.08 - dell 07/17/2009 20:04.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1014.579 [GMT 3:00]
Running from: c:\documents and settings\dell\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\2511d47.msp
c:\windows\Installer\33a43.msi
c:\windows\Installer\4c0b169.msi
c:\windows\Installer\70d5102.msp
c:\windows\Installer\7b1938c.msp
c:\windows\Installer\9f3b418.msp
c:\windows\Installer\f90a84.msp
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_AVPsys
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.
2009-07-17 14:51 . 2009-07-17 14:51 -------- d-----w- c:\program files\Trend Micro
2009-07-16 21:17 . 2009-07-17 14:01 -------- d-----w- c:\documents and settings\dell\Application Data\HPAppData
2009-07-16 21:11 . 2005-05-24 22:39 465952 ----a-w- c:\windows\system32\ar5211.sys
2009-07-16 21:11 . 2005-05-31 10:12 49224 ----a-w- c:\windows\system32\athgina.dll
2009-07-16 21:11 . 2005-05-31 10:12 36864 ----a-w- c:\windows\system32\acs.exe
2009-07-16 21:10 . 2009-07-16 21:11 17801 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-07-16 21:10 . 2005-05-31 10:00 192512 ----a-w- c:\windows\system32\AegisI5.exe
2009-07-16 21:09 . 2005-05-31 10:12 385024 ----a-w- c:\windows\system32\athcfg11.dll
2009-07-16 21:09 . 2005-05-31 10:10 77824 ----a-w- c:\windows\system32\athcfg11res.dll
2009-07-16 21:09 . 2005-05-31 10:10 249856 ----a-w- c:\windows\system32\wgapi.dll
2009-07-16 21:09 . 2005-05-31 10:09 237568 ----a-w- c:\windows\system32\wcapi.dll
2009-07-16 21:09 . 2005-05-31 10:00 1396835 ----a-w- c:\windows\system32\AegisE5.dll
2009-07-16 21:09 . 2009-07-16 21:09 -------- d-----w- c:\program files\Atheros
2009-07-16 21:09 . 2009-07-16 21:09 -------- d-----w- C:\temp
2009-07-16 21:06 . 2007-01-11 10:20 194304 ----a-r- c:\windows\system32\drivers\RTL8187.sys
2009-07-15 07:07 . 2008-04-16 04:05 729088 ----a-r- c:\windows\system32\hposwia_p01a.dll
2009-07-15 07:07 . 2008-04-16 04:05 974848 ----a-r- c:\windows\system32\hpost_p01a.dll
2009-07-15 07:07 . 2008-02-28 10:08 303104 ----a-r- c:\windows\system32\hposc_p01a.dll
2009-07-15 07:07 . 2008-04-13 21:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-07-15 07:07 . 2008-04-13 21:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-07-15 06:50 . 2009-07-15 06:50 -------- d-----w- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-07-15 06:50 . 2009-07-15 06:50 -------- d-----w- c:\program files\Hewlett-Packard
2009-07-15 06:50 . 2009-07-15 06:50 -------- d-----w- c:\program files\Common Files\HP
2009-07-15 06:45 . 2008-04-16 04:05 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
2009-07-15 06:43 . 2008-04-16 04:05 49920 ----a-r- c:\windows\system32\drivers\HPZid412.sys
2009-07-15 06:43 . 2008-06-06 17:49 118272 ----a-w- c:\windows\system32\hpz3l692.dll
2009-07-15 06:43 . 2008-04-16 04:05 271704 ----a-r- c:\windows\system32\hpzids01.dll
2009-07-15 06:41 . 2008-04-16 04:05 372736 ----a-r- c:\windows\system32\hppldcoi.dll
2009-07-15 06:41 . 2008-04-16 04:05 21568 ----a-r- c:\windows\system32\drivers\HPZius12.sys
2009-07-15 06:40 . 2008-04-13 21:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-07-15 06:40 . 2008-04-13 21:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-07-15 06:35 . 2009-07-15 06:35 -------- d-----w- c:\windows\system32\wbem\Repository
2009-07-14 07:30 . 2009-07-15 07:21 182571 ----a-w- c:\windows\hpoins30.dat
2009-07-14 07:30 . 2008-06-18 06:22 844 ------w- c:\windows\hpomdl30.dat
2009-07-12 12:20 . 2009-07-12 12:20 -------- d-----w- C:\spoolerlogs
2009-07-12 12:19 . 2009-07-12 12:19 -------- d-----w- c:\documents and settings\All Users\Application Data\WEBREG
2009-07-12 12:04 . 2009-07-12 12:17 -------- d-----w- c:\documents and settings\dell\Application Data\HP
2009-07-12 11:38 . 2009-07-15 06:51 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-07-12 11:38 . 2009-07-12 11:38 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-07-12 11:35 . 2009-07-15 06:53 -------- d-----w- c:\program files\HP
2009-07-07 13:24 . 2009-07-07 13:29 -------- d-----w- c:\windows\system32\SupportAppXL
2009-06-18 22:45 . 2009-06-18 22:45 198064 ----a-w- c:\documents and settings\dell\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-06-18 22:42 . 2009-06-18 22:43 2926768 ----a-w- c:\documents and settings\dell\Application Data\IDM\idmupdt.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 17:13 . 2008-12-29 17:34 2275872 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-07-17 17:13 . 2008-12-29 17:34 20956 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-07-17 17:13 . 2008-07-13 00:11 -------- d-----w- c:\documents and settings\dell\Application Data\DMCache
2009-07-17 17:12 . 2008-12-29 17:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-07-17 17:10 . 2008-12-29 17:34 581664 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-07-17 17:10 . 2008-12-29 17:34 5164 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-07-17 13:59 . 2001-09-19 12:00 59878 ----a-w- c:\windows\system32\perfc001.dat
2009-07-17 13:59 . 2001-09-19 12:00 331342 ----a-w- c:\windows\system32\perfh001.dat
2009-07-16 21:18 . 2009-05-28 22:49 -------- d-----w- c:\program files\Hotspot_Shield
2009-07-16 21:09 . 2008-07-12 23:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-08 14:29 . 2008-07-13 00:11 -------- d-----w- c:\documents and settings\dell\Application Data\IDM
2009-06-22 18:53 . 2008-07-12 23:43 99104 ----a-w- c:\documents and settings\dell\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-18 22:45 . 2008-07-13 00:11 -------- d-----w- c:\program files\Internet Download Manager
2009-06-16 23:58 . 2009-06-16 23:58 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-16 23:58 . 2007-07-13 00:22 -------- d-----w- c:\program files\Common Files\Real
2009-06-05 12:46 . 2009-05-28 22:48 -------- d-----w- c:\program files\Hotspot Shield
2009-05-29 03:21 . 2009-05-29 03:21 -------- d-----w- c:\program files\Ares
2009-05-28 23:00 . 2009-05-28 23:00 0 ----a-w- c:\windows\system32\cd.dat
2009-05-28 22:49 . 2009-05-28 22:49 -------- d-----w- c:\program files\Conduit
2009-05-27 16:03 . 2009-05-27 16:03 0 ----a-w- c:\documents and settings\dell\Application Data\IDM\DwnlData\dell\idmmkb_95\idmmkb.dll
2009-05-22 21:53 . 2008-12-29 17:35 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-22 21:53 . 2008-12-29 17:35 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-22 21:42 . 2009-05-22 21:42 -------- d-----w- c:\program files\BandRich
2009-05-20 19:54 . 2009-05-20 19:54 33840 ----a-w- c:\windows\system32\drivers\HssDrv.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHot0.dll" [2009-07-16 2215960]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2009-07-16 21:18 2215960 ----a-w- c:\program files\Hotspot_Shield\tbHot0.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHot0.dll" [2009-07-16 2215960]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHot0.dll" [2009-07-16 2215960]
[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-11-14 09:22 3186440 ----a-w- c:\program files\Protector Suite QL\farchns.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-11-14 09:22 3186440 ----a-w- c:\program files\Protector Suite QL\farchns.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-27 2815408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-07 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-09 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-09 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-09 137752]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-12-14 159744]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2007-11-14 49416]
"OEM13Mon.exe"="c:\windows\OEM13Mon.exe" [2008-01-07 36864]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2008-07-13 77824]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-10 206088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-16 198160]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"ACU"="c:\program files\Atheros\ACU.exe" [2005-05-31 303104]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-11-06 16855552]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-13 113664]
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-3-22 483328]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-11-14 09:07 96008 ----a-w- c:\windows\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"427:UDP"= 427:UDP:SLP_Port(427)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [11/12/2008 10:20 ص 87264]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [01/06/2009 09:13 م 331312]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [13/07/2008 02:28 ص 48472]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [13/07/2008 02:28 ص 43480]
R3 OEM13Afx;Provides a software interface to control audio effects of OEM013 camera.;c:\windows\system32\drivers\OEM13Afx.sys [13/07/2008 02:31 ص 141376]
R3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\drivers\OEM13Vfx.sys [13/07/2008 02:31 ص 7424]
R3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\drivers\OEM13Vid.sys [13/07/2008 02:31 ص 235840]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [17/07/2009 12:06 ص 194304]
S2 gupdate1c9ae4ed25791ea;خدمة تحديث Google (gupdate1c9ae4ed25791ea);c:\program files\Google\Update\GoogleUpdate.exe [26/03/2009 11:09 م 133104]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [23/05/2009 12:42 ص 104448]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [01/06/2009 09:58 م 34352]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
2009-07-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-26 20:09]
2009-07-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-26 20:09]
2009-06-21 c:\windows\Tasks\OGADaily.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
2009-07-17 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAVerify.exe [2008-12-31 14:04]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1561552
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-17 20:13
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):04,8e,45,6a,31,ba,01,a2,a3,35,ee,3f,78,3b,20,2c,bd,f5,b7,16,9b,
a2,ee,74,6d,70,9c,61,13,4b,c8,f9,b5,a7,34,ae,87,76,7f,28,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):23,fa,fc,39,3a,53,bc,a1,5c,97,cd,af,b3,1e,87,90,30,08,5a,20,76,
5e,c0,b8,4d,9c,93,23,28,65,fc,14,4c,80,37,f6,22,b2,68,35,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{d5ad8781-0062-44aa-8faf-eb71ad4ce9f7}]
@Denied: (Full) (Everyone)
"Model"=dword:000000c4
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{eb7154b9-7d71-48c9-b9c5-d10590f06f24}]
@Denied: (Full) (Everyone)
"Model"=dword:00000082
"Therad"=dword:0000001e
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,97,f7,64,a9,33,81,62,59,96,cc,7b,00,4d,5e,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1692)
c:\windows\system32\vrlogon.dll
c:\windows\system32\athgina.dll
c:\windows\system32\athcfg11.dll
c:\windows\system32\athcfg11Res.dll
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\bio.dll
c:\program files\Protector Suite QL\qlbase.dll
c:\program files\Protector Suite QL\otp.dll
c:\program files\Protector Suite QL\psqltray.dll
- - - - - - - > 'lsass.exe'(1748)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infql2.dll
- - - - - - - > 'explorer.exe'(2224)
c:\program files\Protector Suite QL\farchns.dll
c:\program files\Protector Suite QL\infql2.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\acs.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\WgaTray.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\hidfind.exe
c:\program files\DellTPad\ApntEx.exe
c:\program files\Protector Suite QL\psqltray.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
c:\program files\Hotspot Shield\bin\openvpntray.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\windows\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 2009-07-17 20:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-17 17:16
Pre-Run: 33,332,809,728 bytes free
Post-Run: 33,735,290,880 bytes free
294 --- E O F --- 2009-03-28 04:21
