مشكلة في الهايجاك

[جنوبي الهوى]

السلام عليكم ..
يوجد مشكلة في الهايجاك..بيوصل لمكان معين وبيوقف ...ضغطت على زر switch to ولكن لا فائدة

 

[MAAX]

اهلااا بك

بما ان الوندوز فيستا يجب عن تشغيله بهذه الطريقة

وتاكد من اغلاق كافة التطبيقات قبل البدء بالحذف​

 

[السّاجد لله]

جرب اغلق كل البرامج قبل عمل التقرير
​

 

[جنوبي الهوى]

اهلااا بك

بما ان الوندوز فيستا يجب عن تشغيله بهذه الطريقة

وتاكد من اغلاق كافة التطبيقات قبل البدء بالحذف​

الويندوز xp يالغالي :i:

 

[السّاجد لله]

اعمل التالي بالاضافة للحل الي عطيته الك اعلا بعد اذن الغالي ماكس

من ابدأ ختر run واكتب الامر التالي

msconfig

ثم اوكي

ستظهر شاشة التطبيق

system configuration utility ​

اعمل كما يلي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​

ثم وافق على اعادة التغشيل​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ثم جرب اعمل تقرير وشوف
​

​

 

[جنوبي الهوى]

تقرير الهايجاك

الحمدلله ..انحلت المشكلة يا شباب
هذا تقرير الهايجاك ..ارجو فحصه
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:39:46 م, on 27/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Semtech\Semtech Pointing Device\iact.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bndmss.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Semtech\Semtech Pointing Device\iact.exe
C:\WINDOWS\system32\XP-BFD659DD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe, explorer.exe
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [iact] C:\Program Files\Semtech\Semtech Pointing Device\\iact user
O4 - HKLM\..\Run: [RRT-Auto] C:\Documents and Settings\BVX-Messi\Desktop\RRT.exe auto
O4 - HKLM\..\Run: [Barsaka] explorer.exe
O4 - HKLM\..\Run: [XP-BFD659DD] C:\WINDOWS\system32\XP-BFD659DD.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User '?')
O4 - HKUS\S-1-5-21-1659004503-1592454029-1177238915-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - S-1-5-21-1659004503-1592454029-1177238915-500 Startup: ،،،،،،.lnk = C:\WINDOWS\system32\XP-BFD659DD.EXE (User '?')
O4 - Startup: ،،،،،،.lnk = C:\WINDOWS\system32\XP-BFD659DD.EXE
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE66BB1-4BCC-4D69-8672-52FD24121774}: NameServer = 172.10.0.1 91.142.48.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{E422ED2B-D445-459F-98C6-C2310C2CAAD6}: NameServer = 192.168.70.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Windows Network Data Management System Service (BNDMSS) - Unknown owner - C:\WINDOWS\system32\bndmss.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iact - Unknown owner - C:\Program Files\Semtech\Semtech Pointing Device\iact.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 5668 bytes

 

[السّاجد لله]

اخي جهازك فيه اصابات اعمل التالي

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم


اعمل تقرير للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات .. ويظهر لك تقرير اعمل تحديد الكل ==> انسخه والصقه بردك القادم

اوزلا اعمل الفحص بالكومبو وهذا مهم جدا ثم الهاي جاك
​

 

[جنوبي الهوى]

تقرير اداة الكمبو
ComboFix 08-11-27.01 - BVX-Messi 11/27/2008 17:52:50.2 - NTFSx86
Running from: c:\documents and settings\BVX-Messi\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\com.run
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\dp1.fne
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\eAPI.fne
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\internet.fne
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\krnln.fnr
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\RegEx.fnr
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\shell.fne
c:\docume~1\BVX-ME~1\LOCALS~1\Temp\E_4\spec.fne
c:\windows\system32\com.run
c:\windows\system32\dp1.fne
c:\windows\system32\eAPI.fne
c:\windows\system32\explorer.exe
c:\windows\system32\internet.fne
c:\windows\system32\krnln.fnr
c:\windows\system32\og.dll
c:\windows\system32\og.edt
c:\windows\system32\RegEx.fnr
c:\windows\system32\shell.fne
c:\windows\system32\spec.fne
c:\windows\system32\ul.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BNDMSS
-------\Service_BNDMSS


((((((((((((((((((((((((( Files Created from 2008-10-27 to 2008-11-27 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-27 15:54 --------- d-----w c:\program files\microsoft frontpage
2008-11-27 15:46 208,346 ----a-w c:\documents and settings\BVX-Messi\skp66.exe
2008-11-27 13:57 --------- d-----w c:\program files\Trend Micro
2008-11-27 09:53 --------- d-----w c:\program files\Common Files\Windows Live
2008-11-26 11:12 --------- d-----w c:\program files\dvbdream
2008-11-26 10:52 --------- d-----w c:\documents and settings\BVX-Messi\Application Data\MiniDm
2008-11-24 16:05 --------- d-----w c:\program files\Foffanna©
2008-11-23 21:15 --------- d-----w c:\program files\Common Files\Elecard
2008-11-22 09:29 --------- d-----w c:\documents and settings\BVX-Messi\Application Data\IEPro
2008-11-20 10:16 36,892 ----a-w c:\windows\bassmod.dll
2008-11-20 10:13 --------- d-----w c:\program files\eBook Workshop
2008-11-19 13:36 --------- d-----w c:\program files\MSNTweaker
2008-11-18 12:15 --------- d-----w c:\program files\GlobFX
2008-11-17 16:01 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-16 16:10 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-16 16:07 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-16 15:53 --------- d-----w c:\program files\Semtech
2008-11-16 15:51 --------- d-----w c:\program files\Synaptics
2008-11-16 15:50 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-16 15:48 --------- d-----w c:\program files\Marvell
2008-11-16 15:45 17,119 ----a-w c:\windows\system32\drivers\AegisP.sys
2008-11-16 15:45 --------- d-----w c:\documents and settings\BVX-Messi\Application Data\Intel
2008-11-16 15:44 --------- d-----w c:\program files\Intel
2008-11-16 15:44 --------- d-----w c:\documents and settings\All Users\Application Data\Intel
2008-11-16 15:36 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-16 15:36 --------- d-----w c:\program files\ATI Technologies
2008-11-15 11:23 --------- d-----w c:\program files\CCleaner
2006-11-25 12:11 180,190 --sh--r c:\windows\system32\fooool.exe
.

------- Sigcheck -------

05/05/2008 11:45 AM 665600 44aea5a47244ff2611f9b3926dea6fa2 c:\windows\system32\wininet.dll

05/30/2008 09:56 AM 2343424 9a64fdd5bd8ce0018af03e31b4beaa71 c:\windows\system32\ntoskrnl.exe

01/27/2008 04:04 PM 1524224 e24cd37d23a71dbb9a484a50eb255462 c:\windows\explorer.exe

04/14/2008 07:42 PM 288734 d8473d3f42d0c7e295503b7ddba288c0 c:\windows\system32\wuauclt.exe

04/14/2008 07:42 PM 203746 8fa8ee10428af904876bd5ee251cf410 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 07:42 PM 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [04/14/2008 05:42 AM 1872860]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iact"="c:\program files\Semtech\Semtech Pointing Device\\iact user" [X]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [12/07/2004 09:10 PM 344064]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [10/15/2004 11:27 AM 385024]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [10/15/2004 11:31 AM 356352]
"XP-BFD659DD"="c:\windows\system32\XP-BFD659DD.EXE" [11/21/2008 08:14 PM 1689048]
"AGRSMMSG"="AGRSMMSG.exe" [11/09/2004 10:19 AM 88358 c:\windows\AGRSMMSG.exe]
"Barsaka"="explorer.exe" [01/27/2008 04:04 PM 1524224 c:\windows\explorer.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 07:42 PM 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="move" [X]

c:\documents and settings\BVX-Messi\Start Menu\Programs\Startup\
??????.lnk - c:\windows\system32\XP-BFD659DD.EXE [11/21/2008 8:14:29 PM 1689048]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
10/15/2004 11:27 AM 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\bndmss.exe"=
"c:\\Documents and Settings\\BVX-Messi\\skp66.exe"=skp66.exe
"skp66.exe"= skp66.exe:BNDMSS

R2 iact;iact;c:\program files\Semtech\Semtech Pointing Device\iact.exe [12/17/2004 6:50:42 AM 179712]
R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [11/16/2008 5:38:43 PM 1268800]
R3 vadd;Value-added filter;c:\windows\system32\DRIVERS\vadd.sys [12/17/2004 7:54:04 AM 43008]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45dfb7bd-b567-11dd-ae35-0012f0504e97}]
\Shell\AutoRun\command - E:\fooool.exe
\Shell\explore\Command - E:\fooool.exe
\Shell\open\Command - E:\fooool.exe
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKLM-Run-RRT-Auto - c:\documents and settings\BVX-Messi\Desktop\RRT.exe
HKLM-Run-Cmaudio - cmicnfg.cpl
HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\BVX-Messi\Application Data\Mozilla\Firefox\Profiles\wowesbdt.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-11-27 18:03:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\OProtSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 11/27/2008 18:04:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-27 16:04:45

Pre-Run: 35,708,497,920 bytes free
Post-Run: 35,922,530,304 bytes free

154

 

[جنوبي الهوى]

تقرير الهايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:06:59 م, on 27/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Semtech\Semtech Pointing Device\iact.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Semtech\Semtech Pointing Device\iact.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [iact] C:\Program Files\Semtech\Semtech Pointing Device\\iact user
O4 - HKLM\..\Run: [Barsaka] explorer.exe
O4 - HKLM\..\Run: [XP-BFD659DD] C:\WINDOWS\system32\XP-BFD659DD.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O4 - Startup: ،،،،،،.lnk = C:\WINDOWS\system32\XP-BFD659DD.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BE66BB1-4BCC-4D69-8672-52FD24121774}: NameServer = 172.10.0.1 91.142.48.48
O17 - HKLM\System\CCS\Services\Tcpip\..\{E422ED2B-D445-459F-98C6-C2310C2CAAD6}: NameServer = 192.168.70.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iact - Unknown owner - C:\Program Files\Semtech\Semtech Pointing Device\iact.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

--
End of file - 4188 bytes