هذا التقرير
ComboFix 09-07-29.01 - xp 07/29/2009 21:24.1.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1023.770 [GMT 3:00]
Running from: c:\documents and settings\xp\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\xp\Application Data\wiaserva.log
C:\t35335u.exe
c:\windows\Installer\15ec9a2.msi
c:\windows\system32\kakle.dll
Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected
Restored copy from - c:\system volume information\_restore{4D2CD2A5-57D8-4C36-9E70-8B9C12363399}\RP46\A0006979.sys
.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.
2009-07-29 02:38 . 2009-07-29 02:38 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-29 02:38 . 2009-07-29 02:38 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\Help
2009-07-29 02:38 . 2009-07-29 02:38 -------- d-----w- c:\program files\Common Files\xing shared
2009-07-26 12:29 . 2009-07-26 12:29 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-07-26 12:29 . 2009-07-29 02:37 -------- d-----w- c:\program files\PopCap Games
2009-07-26 12:29 . 2009-07-28 18:32 14 ----a-w- c:\windows\popcinfot.dat
2009-07-26 12:29 . 2009-07-26 12:29 0 ----a-w- c:\windows\popcreg.dat
2009-07-19 17:49 . 2009-07-19 17:49 390664 ----a-w- c:\documents and settings\xp\Application Data\Real\RealPlayer\setup\AU_setup.exe
2009-07-17 15:02 . 2009-07-17 15:02 -------- d-----w- c:\documents and settings\xp\Application Data\SoftInform
2009-07-17 15:01 . 2009-07-17 15:01 -------- d-----w- c:\program files\SoftInform
2009-07-17 13:55 . 2009-07-17 13:55 -------- d-----w- c:\documents and settings\xp\Application Data\URSoft
2009-07-17 13:55 . 2009-07-29 02:02 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-17 13:54 . 2009-07-17 14:13 -------- d-----w- c:\program files\Your Uninstaller 2008
2009-07-17 07:15 . 2009-07-17 07:15 -------- d-----w- c:\documents and settings\xp\Application Data\Uniblue
2009-07-17 07:15 . 2009-06-18 10:12 2568234 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\Uniblue RegistryBooster.exe
2009-07-17 07:15 . 2009-07-17 07:15 -------- d-----w- c:\program files\Uniblue
2009-07-17 07:15 . 2008-08-26 16:48 757760 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\2B86F085\6383BC9B\UBVarRB.dll
2009-07-17 07:15 . 2008-08-26 16:48 6676480 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\4E45A1A4\6383BC9B\RegistryBooster.dll
2009-07-17 07:15 . 2008-08-26 16:48 497496 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\AF01B0B\6383BC9B\XceedZip.dll
2009-07-17 07:15 . 2008-08-26 16:48 413696 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\52CD59C9\6383BC9B\update.dll
2009-07-17 07:15 . 2008-08-26 16:48 99624 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\7390E4F0\6383BC9B\StartRegistryBooster.exe
2009-07-17 07:15 . 2008-08-26 16:48 2019624 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\7CE1607E\6383BC9B\RegistryBooster.exe
2009-07-17 07:15 . 2008-08-26 16:48 111912 -c--a-w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}\registrybooster2\65B92A91\6383BC9B\KillRBProcess.exe
2009-07-16 14:02 . 2009-07-17 07:15 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
2009-07-15 16:36 . 2009-07-26 05:43 -------- d-----w- c:\program files\RealDrawPRO5
2009-07-15 13:32 . 2004-08-03 20:10 38016 -c--a-w- c:\windows\system32\dllcache\bthmodem.sys
2009-07-15 13:32 . 2004-08-03 20:10 38016 ----a-w- c:\windows\system32\drivers\bthmodem.sys
2009-07-15 13:28 . 2004-08-03 19:58 100992 -c--a-w- c:\windows\system32\dllcache\bthpan.sys
2009-07-15 13:28 . 2004-08-03 19:58 100992 ----a-w- c:\windows\system32\drivers\bthpan.sys
2009-07-15 13:28 . 2004-08-03 20:10 59648 -c--a-w- c:\windows\system32\dllcache\rfcomm.sys
2009-07-15 13:28 . 2004-08-03 20:10 59648 ----a-w- c:\windows\system32\drivers\rfcomm.sys
2009-07-15 13:28 . 2004-08-03 20:10 17024 -c--a-w- c:\windows\system32\dllcache\bthenum.sys
2009-07-15 13:28 . 2004-08-03 20:10 17024 ----a-w- c:\windows\system32\drivers\BthEnum.sys
2009-07-15 13:28 . 2004-08-03 21:56 27136 -c--a-w- c:\windows\system32\dllcache\irmon.dll
2009-07-15 13:28 . 2004-08-03 21:56 27136 ----a-w- c:\windows\system32\irmon.dll
2009-07-15 13:28 . 2004-08-03 21:56 152576 -c--a-w- c:\windows\system32\dllcache\irftp.exe
2009-07-15 13:28 . 2004-08-03 21:56 152576 ----a-w- c:\windows\system32\irftp.exe
2009-07-15 13:28 . 2004-08-03 21:56 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2009-07-15 13:28 . 2004-08-03 21:56 8192 ----a-w- c:\windows\system32\wshirda.dll
2009-07-15 13:27 . 2004-08-03 20:10 274304 -c--a-w- c:\windows\system32\dllcache\bthport.sys
2009-07-15 13:27 . 2004-08-03 20:10 274304 ----a-w- c:\windows\system32\drivers\bthport.sys
2009-07-15 13:27 . 2004-08-03 20:10 18944 -c--a-w- c:\windows\system32\dllcache\bthusb.sys
2009-07-15 13:27 . 2004-08-03 20:10 18944 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2009-07-15 12:24 . 2009-07-15 12:24 -------- d-----w- c:\documents and settings\xp\Application Data\Apple Computer
2009-07-15 12:16 . 2009-07-15 12:18 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-07-15 07:02 . 2009-07-15 07:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-07-15 07:02 . 2009-07-15 07:02 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\Apple
2009-07-15 07:02 . 2009-07-15 07:02 -------- d-----w- c:\program files\Apple Software Update
2009-07-15 07:02 . 2009-07-15 07:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-07-15 07:01 . 2009-07-15 07:01 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\Apple Computer
2009-07-14 10:30 . 2009-07-15 07:02 -------- d-----w- c:\program files\QuickTime
2009-07-09 20:37 . 2009-07-29 02:05 117760 ----a-w- c:\documents and settings\xp\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-07-09 20:37 . 2009-07-09 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-07-09 17:49 . 2009-07-09 17:49 -------- d-----w- c:\windows\system32\wbem\Repository
2009-07-09 16:57 . 2009-07-09 17:49 -------- d-----w- c:\program files\NoAdware
2009-07-07 11:18 . 2009-07-07 11:18 -------- d-----w- c:\documents and settings\xp\Contacts
2009-07-06 13:33 . 2009-07-29 02:38 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-06 13:33 . 2009-07-06 13:33 -------- d-----w- c:\documents and settings\xp\Application Data\SUPERAntiSpyware.com
2009-07-06 13:31 . 2009-07-06 13:31 -------- d-----w- c:\program files\CCleaner
2009-07-06 13:19 . 2009-07-06 13:19 -------- d-----w- c:\windows\Sun
2009-07-05 22:14 . 2009-07-05 22:14 17408 ----a-w- C:\jqgxbbjv.exe
2009-07-05 01:35 . 2009-07-05 01:35 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-07-03 09:36 . 2009-07-03 09:36 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\ESET
2009-07-03 01:55 . 2009-07-03 01:55 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\Identities
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 18:31 . 2001-08-23 12:00 92416 ----a-w- c:\windows\system32\drivers\beep.sys
2009-07-29 02:38 . 2009-06-26 16:48 -------- d-----w- c:\program files\Common Files\Real
2009-07-29 02:37 . 2009-06-29 01:49 -------- d-----w- c:\documents and settings\xp\Application Data\COWON
2009-07-25 21:03 . 2009-06-26 16:45 -------- d-----w- c:\program files\JetAudio
2009-07-03 00:46 . 2009-06-26 16:56 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-29 02:15 . 2009-06-29 02:15 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-06-29 02:14 . 2009-06-29 02:14 -------- d-----w- c:\program files\REALTEK RTL8187 Wireless LAN Driver and Utility
2009-06-29 02:14 . 2009-06-26 14:47 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-29 02:14 . 2009-06-26 14:41 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-28 19:25 . 2009-06-28 19:25 94632 ----a-w- c:\documents and settings\xp\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-26 17:30 . 2009-06-26 17:30 -------- d-----w- c:\documents and settings\xp\Application Data\ACD Systems
2009-06-26 17:29 . 2009-06-26 17:28 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-06-26 17:28 . 2009-06-26 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-06-26 17:28 . 2009-06-26 17:28 -------- d-----w- c:\program files\ACD Systems
2009-06-26 17:23 . 2009-06-26 15:55 -------- d-----w- c:\program files\CyberLink
2009-06-26 17:19 . 2009-06-26 17:19 -------- d-----w- c:\program files\Java
2009-06-26 17:19 . 2009-06-26 17:19 -------- d-----w- c:\program files\Common Files\Java
2009-06-26 17:12 . 2009-06-26 17:12 196608 ----a-w- c:\windows\system32\maag.dll
2009-06-26 17:12 . 2009-06-26 17:12 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-06-26 17:12 . 2009-06-26 17:12 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-06-26 17:12 . 2009-06-26 17:12 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-06-26 17:12 . 2009-06-26 17:12 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-06-26 17:12 . 2009-06-26 17:12 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-06-26 17:12 . 2009-06-26 17:12 1986560 ----a-w- c:\windows\system32\akll.dll
2009-06-26 17:12 . 2009-06-26 17:12 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-06-26 17:12 . 2009-06-26 17:11 -------- d-----w- c:\program files\Real_SC
2009-06-26 17:00 . 2009-06-26 17:00 -------- d-----w- c:\program files\MSN Messenger
2009-06-26 16:59 . 2009-06-26 16:59 -------- d-----w- c:\program files\Nokia
2009-06-26 16:59 . 2009-06-26 16:59 -------- d-----w- c:\program files\Common Files\Nokia
2009-06-26 16:54 . 2009-06-26 15:12 -------- d-----w- c:\program files\Nero
2009-06-26 16:48 . 2009-06-26 15:12 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-26 16:48 . 2009-06-26 15:12 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-26 16:48 . 2009-06-26 16:48 -------- d-----w- c:\program files\Real
2009-06-26 16:48 . 2009-06-26 16:48 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 16:46 . 2009-06-26 16:46 -------- d-----w- c:\program files\Common Files\COWON
2009-06-26 16:15 . 2009-06-26 16:15 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-06-26 16:15 . 2009-06-26 16:15 172032 ------w- c:\windows\Setup1.exe
2009-06-26 16:15 . 2009-06-26 16:15 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-26 15:57 . 2009-06-26 15:57 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-06-26 15:53 . 2009-06-26 15:53 -------- d-----w- c:\program files\Yahoo!
2009-06-26 15:16 . 2009-06-26 15:16 -------- d-----w- c:\documents and settings\xp\Application Data\Ahead
2009-06-26 15:13 . 2009-06-26 15:12 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-26 15:06 . 2009-06-26 15:06 -------- d-----w- c:\program files\ESET
2009-06-26 15:06 . 2009-06-26 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-06-26 15:00 . 2009-06-26 15:00 -------- d-----w- c:\program files\VIA Technologies, Inc
2009-06-26 14:59 . 2009-06-26 14:59 -------- d-----w- c:\program files\VIAudioi
2009-06-26 14:57 . 2009-06-26 14:47 -------- d-----w- c:\program files\Realtek
2009-06-26 14:47 . 2009-06-26 14:47 315392 ----a-w- c:\windows\HideWin.exe
2009-06-26 14:46 . 2009-06-26 14:36 15600 ----a-w- c:\windows\gdrv.sys
2009-06-26 14:41 . 2009-06-26 14:41 -------- d-----w- c:\program files\VIA
2009-06-25 20:49 . 2009-06-25 20:49 -------- d-----w- c:\program files\Microsoft.NET
2009-06-25 20:48 . 2009-06-25 20:48 -------- d-----w- c:\program files\Microsoft Works
2009-06-25 20:38 . 2009-06-25 20:38 -------- d-----w- c:\program files\CONEXANT
2009-06-25 20:05 . 2009-06-25 19:57 166455 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-25 20:01 . 2009-06-25 20:01 27264 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 19:58 . 2009-06-25 19:58 -------- d-----w- c:\program files\microsoft frontpage
2009-06-25 19:55 . 2009-06-25 19:55 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.
------- Sigcheck -------
[-] 2009-07-29 02:09 92416 170E3F4AF66F86E0AC575C00FE45B99B c:\windows\system32\dllcache\beep.sys
[-] 2009-07-29 18:32 92416 170E3F4AF66F86E0AC575C00FE45B99B c:\windows\system32\drivers\beep.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 190696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 1443072]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2009-06-26 77824]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-19 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\xp\Start Menu\Programs\Startup\
lecsys32.exe [2004-8-4 16896]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-26 113664]
AudioDeck.lnk - c:\program files\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe [2009-6-26 581632]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 09:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21/12/2007 08:21 ص 33800]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [29/06/2009 05:14 ص 194304]
S1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [25/06/2009 11:55 م 13696]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/06/2009 11:01 ص 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23/06/2009 11:01 ص 72944]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21/12/2007 08:21 ص 468224]
S3 autorun;autorun;\??\c:\huadio.tmp --> c:\huadio.tmp [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23/06/2009 11:01 ص 7408]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [29/06/2009 05:14 ص 13532]
S3 Vsp;Vsp;c:\windows\system32\drivers\vsp.sys [26/06/2009 06:00 م 3351]
.
Contents of the 'Scheduled Tasks' folder
2009-07-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
mStart Page = hxxp://www.yahoo.com
uInternet Connection Wizard,ShellNext = iexplore
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-07-29 21:31
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun]
"ImagePath"="\??\C:\huadio.tmp"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Beep]
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\s-1-5-21-823518204-879983540-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{23A2B666-D187-94D8-BD63-D555D26272C8}*]
"iaojbjijgjpfdmdgph"=hex:6a,61,70,69,6f,66,64,6b,62,63,70,69,70,63,67,68,69,6a,
6c,63,00,6e
"hamghhkjfjbdnjbd"=hex:6a,61,70,69,6f,66,64,6b,62,63,70,69,70,63,67,68,69,6a,
6c,63,00,6e
"hakekblibfainfmc"=hex:6d,64,67,68,6c,65,64,6c,69,6a,69,6f,6a,6d,64,66,6e,66,
63,66,61,6a,63,70,70,6c,69,66,62,64,6a,68,6a,61,67,64,6d,63,6a,69,6d,6c,66,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(744)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
- - - - - - - > 'explorer.exe'(1304)
c:\windows\system32\msi.dll
.
Completion time: 2009-07-29 21:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-29 18:33
Pre-Run: 34,183,045,120 bytes free
Post-Run: 34,328,563,712 bytes free
237
لكن لمن بدا التشغيل اخترت ان النظام يشغل عادي طلع لوحة زرقاء فيها خطا ووعدت التشغيل ودخلت من السيف مود
