معذرة أخي الحبيب على تأخر الرد لأني كنت مسافرا وهذا هو تقرير البرنامج وأحب أن أذكر لك أن مضاد الفيروسات وهو البت ديفاندر قد استأذنني 6 مرات تقريبا لمحاولة هذا البرانامج لتغيير مفاتيح الرجيستري وقد أذنت له في الوصول إليها لثقتي بك وكذلك كشف مضاد الفيروسات عندي فيروسا أثناء فحص البرنامج وقام بإقافه واستمر البرنامج في الفحص ولم يعد تشغيل الجهاز بل أعطاني تقرير الفحص مباشرةوهذا هو ComboFix 08-07-07.3 - alshehab 07/08/2008 14:16:51.1 - NTFSx86 Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1256.1.1025.18.127 [GMT 3:00] Running from: C:\Users\alshehab\Documents\Downloads\Programs\ComboFix.exe * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\system32\kakle.dll C:\Windows\system32\winitn.dll C:\Windows\system32\x64 . ((((((((((((((((((((((((( Files Created from 2008-06-08 to 2008-07-08 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-08 11:25 81,984 ----a-w C:\Windows\System32\bdod.bin 2008-07-08 11:13 --------- d-----w C:\Users\alshehab\AppData\Roaming\DMCache 2008-07-08 08:59 --------- d-----w C:\Program Files\Spyware Doctor 2008-07-06 12:17 --------- d-----w C:\ProgramData\Bluetooth 2008-07-06 12:05 --------- d-----w C:\Program Files\lg_swupdate 2008-07-05 22:02 --------- d---a-w C:\ProgramData\TEMP 2008-07-05 04:41 86,792 ----a-w C:\Windows\system32\drivers\bdfndisf.sys 2008-07-02 06:19 --------- d-----w C:\ProgramData\McAfee 2008-07-02 04:35 --------- d-----w C:\Program Files\BitComet 2008-06-30 13:40 --------- d-----w C:\Program Files\Paltalk Messenger 2008-06-30 04:06 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-06-30 02:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-30 00:31 --------- d-----w C:\ProgramData\Symantec 2008-06-29 23:22 --------- d-----w C:\Program Files\Debugging Tools for Windows 2008-06-29 21:00 --------- d-----w C:\Program Files\Google 2008-06-29 15:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-29 15:26 --------- d-----w C:\Program Files\Uniblue 2008-06-24 13:58 --------- d-----w C:\Users\alshehab\AppData\Roaming\Skype 2008-06-24 08:40 --------- d-----w C:\Users\alshehab\AppData\Roaming\SlimBrowser 2008-06-22 08:27 --------- d-----w C:\ProgramData\Microsoft Help 2008-06-17 12:18 --------- d-----w C:\Program Files\SlimBrowser 2008-06-16 20:13 64,512 ---ha-w C:\Users\alshehab\AppData\Roaming\dach100.dll 2008-06-16 20:03 --------- d-----w C:\ProgramData\Kaspersky Lab 2008-06-16 00:10 --------- d-----w C:\Program Files\JetAudio 2008-06-15 22:28 --------- d-----w C:\Program Files\Windows Mail 2008-06-06 15:59 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-06-02 20:04 --------- d-----w C:\Program Files\IObit 2008-06-01 11:41 --------- d-----w C:\Users\alshehab\AppData\Roaming\IDM 2008-05-30 17:46 --------- d-----w C:\Program Files\Internet Download Manager 2008-05-25 02:15 --------- d-----w C:\Users\alshehab\AppData\Roaming\COWON 2008-05-25 02:14 --------- d-----w C:\Program Files\Common Files\COWON 2008-05-24 10:44 --------- d-----w C:\Program Files\Apple Software Update 2008-05-10 03:30 858,112 ----a-w C:\Windows\System32\RacEngn.dll 2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll 2008-05-10 01:21 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys 2008-04-29 03:50 181,760 ----a-w C:\Windows\System32\fsquirt.exe 2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-04-17 12:33 691 ----a-w C:\Users\alshehab\AppData\Roaming\GetValue.vbs 2008-04-17 12:33 35 ----a-w C:\Users\alshehab\AppData\Roaming\SetValue.bat 2008-04-17 12:33 2,670 ----a-w C:\Windows\System32\tmp.reg 2008-04-13 07:49 73,216 ----a-w C:\Windows\ST6UNST.EXE 2008-04-13 07:49 249,856 ------w C:\Windows\Setup1.exe 2008-04-11 23:47 139,264 ----a-w C:\Windows\System32\unzip.exe 2007-12-11 08:20 174 --sha-w C:\Program Files\desktop.ini 2007-12-19 22:53 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-12-19 22:53 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\.IE5\index.dat 2008-03-31 11:48 80 --sh--r C:\Windows\System32\8DFD35A111.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/09/2008 03:03 AM 1232896] "IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [05/13/2008 09:29 AM 929712] "DriveDiscoveryMemoryResident"="C:\Program Files\NotsoSoftware\DriveDiscovery\NSSMR.exe" [01/30/2007 12:30 PM 462848] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [03/25/2008 09:38 AM 2196280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KeybdUtility"="C:\Program Files\LG Software\On Screen Display\HotKey.exe" [03/22/2007 06:57 AM 2655800] "BatteryMiser 5"="C:\Program Files\LG Software\BatteryMiser\BatteryMiser5.exe" [02/22/2007 09:56 PM 337464] "BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [10/09/2007 03:46 PM 61440] "BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [07/05/2008 07:40 AM 368640] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ PalTalk.lnk - C:\Program Files\Paltalk Messenger\paltalk.exe [2008-05-09 01:17:29 10452992] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "PromptOnSecureDesktop"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{26F5978F-6493-4ee3-B114-C0C3ACCF9D4D}"= "C:\Windows\system32\bmpsap.dll" [12/12/2006 01:58 AM 114688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= msaud32_divx.acm [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk] backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^alshehab^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^AntiCrash.lnk] backup=C:\Windows\pss\AntiCrash.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^alshehab^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Battery Doubler.lnk] backup=C:\Windows\pss\Battery Doubler.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^alshehab^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^delvista.exe] backup=C:\Windows\pss\delvista.exe.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^alshehab^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Hare.lnk] backup=C:\Windows\pss\Hare.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^alshehab^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Zoom.lnk] backup=C:\Windows\pss\Zoom.lnk.Startup backupExtension=.Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Booster HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SensorsViewPro31 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedBitVideoAccelerator [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] --a------ 03/25/2008 09:38 AM 2196280 C:\Program Files\BitComet\BitComet.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "HotKeysCmds"=C:\Windows\system32\hkcmd.exe "RtHDVCpl"=RtHDVCpl.exe "Persistence"=C:\Windows\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{3A14282A-F0C7-4EF0-8F0E-4038320FF61D}"= UDP:25406:BitComet 25406 TCP "{61989107-C59A-4BDD-86E7-59AC4541F82B}"= TCP:25406:BitComet 25406 UDP "TCP Query User{CB33F367-3FF4-4CA5-BD44-CEA541EE7931}C:\\bitcomet\\bitcomet.exe"= UDP:C:\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{D4909392-5B1D-4D72-8867-0F4F43C1A673}C:\\bitcomet\\bitcomet.exe"= TCP:C:\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{F9536AA1-9F9B-4F89-B9C9-C0C9D3BB7E30}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "UDP Query User{11219474-2F3C-4786-9D49-D2810E9E9DC4}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath "{1CDAF947-3719-4024-B99F-E9803773F514}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{430CD710-3D29-4428-8624-31E3E2BD2A20}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{6172547E-E917-45C3-828D-695E57FE9789}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{562F07D7-2CF2-4DF0-9744-E61296C39DB9}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{AB121698-6FA0-417E-AD50-0329B8B3B3F5}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{C3CE4C90-BB5F-4D35-894A-617918042AB3}C:\\program files\\mobily connect card\\mobily connect card.exe"= UDP:C:\program files\mobily connect card\mobily connect card.exe:Mobily Connect Card "UDP Query User{84B4F799-7208-428B-A93D-815F6AA8CD86}C:\\program files\\mobily connect card\\mobily connect card.exe"= TCP:C:\program files\mobily connect card\mobily connect card.exe:Mobily Connect Card "{6C7478C3-4F6A-4097-9E06-DBFA0C2F3A11}"= C:\Program Files\Windows Live\Messenger\wlcsdk.exe:Windows Live Messenger (Phone) "{258439D4-B9FA-47DB-987F-31ED07786612}"= UDP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{EA0BCBBF-CD7F-45AD-9EB5-BFFF8B1BBD93}"= TCP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{0610371F-DF83-4ED6-A83A-15503BF57A72}"= UDP:C:\Program Files\Proxy Switcher Standard\ProxySwitcher.exe
roxy Switcher "{E0B217F3-F50B-408A-96F8-82A3845CC116}"= TCP:C:\Program Files\Proxy Switcher Standard\ProxySwitcher.exe
roxy Switcher "TCP Query User{CB2FDE67-540F-4E29-8B47-E783B6A763A5}C:\\program files\\autoshutdown\\autoshutdown.exe"= UDP:C:\program files\autoshutdown\autoshutdown.exe:AutoShutdown Utility Application "UDP Query User{5271C840-D5F2-418A-AC17-350771D474DF}C:\\program files\\autoshutdown\\autoshutdown.exe"= TCP:C:\program files\autoshutdown\autoshutdown.exe:AutoShutdown Utility Application "TCP Query User{B49297FF-2B4B-4525-A80F-2A7E5DDB10D9}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{657B7C2E-80E9-400C-9AB0-D341E6C0D4E2}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{DA190116-0061-43A5-9144-35BC6EE7E9E9}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{43572588-067B-435B-9432-1B030298008D}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{8C11F45B-8A37-4005-A9C4-8B950450FB38}"= UDP:C:\Program Files\Google\Google Talk\googletalk.exe:Google Talk "{9D37DDB7-CF66-4848-B1ED-11BD8807DB49}"= TCP:C:\Program Files\Google\Google Talk\googletalk.exe:Google Talk "TCP Query User{8F202947-9900-4E6A-A640-B522CA7C60EE}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{19883E0D-DDCD-4BF6-B939-2851B0CF9B96}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "{FC417246-B4CB-41EA-A764-035D6306F3E2}"= UDP:8891:BitComet 8891 TCP "{221B7A46-1195-453A-B5E0-D2F00C508627}"= TCP:8891:BitComet 8891 UDP "{BC325F1F-5404-4F0C-B3CD-071C090B5DA2}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{6B28D1F7-6101-4CC2-91B7-3F0E8686076B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{D782428E-8084-450B-B07B-40B004BD83FB}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{2535D284-94AA-458D-95E4-6AE068F69B8F}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{881D8D0E-FFC6-4715-9EAA-8C6DE494E86E}"= UDP:C:\Program Files\Ace Utilities\au.exe:Ace Utilities "{B15E14D5-A31E-4B26-B5B0-8819ADFF6CB3}"= TCP:C:\Program Files\Ace Utilities\au.exe:Ace Utilities [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\IEPro\\MiniDM.exe"= C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM R0 CLBStor;InstantBurn Storage Helper Driver;C:\Windows\system32\drivers\CLBStor.sys [11/29/2006 06:24 PM] R1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [09/20/2007 01:12 PM] R2 fgcldr;FGC Load Controller;C:\PROGRA~1\FORTRE~1\fgcldr.sys [12/12/2006 01:06 PM] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\bdfndisf.sys [07/05/2008 07:41 AM] R3 EUCR;USB Mass Storage;C:\Windows\system32\DRIVERS\EUCR6SK.SYS [03/19/2007 11:10 PM] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [11/22/2006 07:12 PM] S2 ntfont;ntfont driver;C:\Windows\system32\DRIVERS\ntfont.sys [06/08/2000 06:06 PM] S3 GoogleDesktopManager-093007-112848;Google Desktop Manager 5.5.709.30344;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [03/06/2008 10:09 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc bthsvcs REG_MULTI_SZ BthServ bdx REG_MULTI_SZ scan [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4d2b42f-1211-11dd-869e-00e091100f62}] \shell\AutoRun\command - 3wcxx91.cmd \shell\explore\Command - 3wcxx91.cmd \shell\open\Command - 3wcxx91.cmd *Newly Created Service* - CATCHME . s of the 'Scheduled Tasks' folder "2008-07-04 14:15:00 C:\Windows\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-07-08 08:28:07 C:\Windows\Tasks\GlaryInitialize.job" - C:\Program Files\Glary Utilities\initialize.exe "2008-04-25 23:18:56 C:\Windows\Tasks\Uniblue SpyEraser.job" - C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe . - - - - ORPHANS REMOVED - - - - WebBrowser-{2BA521AC-B9B9-4433-BA45-DBA2F02CBA5A} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-08 14:24:49 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 07/08/2008 14:29:46 ComboFix-quarantined-files.txt 2008-07-08 11:29:29 The system cannot find message text for message number 0x2379 in the message file for Application. Post-Run: 36,301,955,072 bytes free 219 --- E O F --- 2008-07-07 06:59:29
ثم فحصت بالهايجيك في الوضع الآمن وهذا هو التقرير
Logfile of HijackThis v1.99.1 Scan saved at 02:43:19 م, on 08/07/08 Platform: Unknown Windows (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Running processes: C:\Windows\Explorer.EXE C:\Users\alshehab\Desktop\برامج الصيانة\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001 O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [KeybdUtility] C:\Program Files\LG Software\On Screen Display\HotKey.exe O4 - HKLM\..\Run: [BatteryMiser 5] C:\Program Files\LG Software\BatteryMiser\BatteryMiser5.exe O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot O4 - HKCU\..\Run: [DriveDiscoveryMemoryResident] C:\Program Files\NotsoSoftware\DriveDiscovery\NSSMR.exe O4 - HKCU\..\Run: [BitComet] C:\Program Files\BitComet\BitComet.exe /tray O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing) O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing) O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)
