هذا التقرير الاول عبودي
ComboFix 08-08-16.01 - yasirinho 08/17/2008 14:14:24.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.312 [GMT 3:00]
Running from: C:\Documents and Settings\yasirinho\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My
C:\Documents and Settings\yasirinho\Application Data\Microsoft\SystemCertificates\My
.
((((((((((((((((((((((((( Files Created from 2008-07-17 to 2008-08-17 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-17 11:16 3,052 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-08-17 11:16 270,368 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-08-17 11:16 11,172 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-08-17 11:16 1,157,664 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-08-17 11:15 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\Orbit
2008-08-17 11:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-08-17 11:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-15 18:41 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\Alien Skin
2008-08-15 18:38 147,456 ----a-w C:\WINDOWS\AVUNTOOL.EXE
2008-08-15 18:12 --------- d-----w C:\Program Files\Alien Skin
2008-08-15 18:10 44,544 ------w C:\WINDOWS\AWuninstall.exe
2008-08-15 17:32 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-15 17:20 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\GRETECH
2008-08-15 17:19 --------- d-----w C:\Program Files\The KMPlayer
2008-08-15 17:09 65,109 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-08-15 17:09 6,112 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-08-15 16:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-15 16:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-15 16:21 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-15 15:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-15 14:57 --------- d-----w C:\Program Files\MSBuild
2008-08-15 14:57 --------- d-----w C:\Program Files\Microsoft Works
2008-08-15 14:52 --------- d-----w C:\Program Files\Circle Developement
2008-08-15 12:01 --------- d-----w C:\Program Files\Google
2008-08-15 01:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\LICENSE ADMIN OPTION BIB
2008-08-15 01:29 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\Uniblue
2008-08-15 01:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Uniblue
2008-08-15 01:11 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-08-15 00:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-08-15 00:54 --------- d-----w C:\Program Files\malaksoft
2008-08-15 00:54 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\Mp3finddart
2008-08-15 00:53 --------- d-----w C:\Program Files\Mp3finddart
2008-08-15 00:53 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-15 00:53 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\URSoft
2008-08-15 00:51 --------- d-----w C:\Program Files\Windows Live
2008-08-15 00:50 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\TuneUp Software
2008-08-15 00:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-08-15 00:49 --------- d-----w C:\Program Files\Uniblue
2008-08-15 00:49 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-15 00:45 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{A850D4D9-871B-4234-908D-21C457767270}
2008-08-15 00:44 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\GrabPro
2008-08-15 00:41 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-08-15 00:40 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-15 00:20 --------- d-----w C:\Program Files\TOSHIBA
2008-08-15 00:17 --------- d-----w C:\Program Files\Intel
2008-08-15 00:16 --------- d-----w C:\Program Files\Atheros
2008-08-15 00:06 --------- d-----w C:\Program Files\Java
2008-08-15 00:05 --------- d-----w C:\Program Files\Common Files\Java
2008-08-15 00:05 --------- d-----w C:\Documents and Settings\yasirinho\Application Data\toshiba
2008-08-15 00:04 --------- d-----w C:\Program Files\Sonic
2008-08-14 23:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-14 23:47 --------- d-----w C:\Program Files\Realtek AC97
2008-08-14 23:42 --------- d-----w C:\Program Files\ltmoh
2008-08-14 22:08 --------- d-----w C:\Program Files\DVD-RAM
2008-08-14 22:08 --------- d-----w C:\Program Files\Apoint2K
2008-08-14 22:05 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-08-14 20:12 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-29 17:20 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat
2008-07-21 15:34 121,872 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
.
------- Sigcheck -------
06/23/2008 06:40 PM 657920 3e201a6b2afee8d24c7d7d3fdf459df2 C:\WINDOWS\SoftwareDistribution\Download\1be58cfb416090b0812f9195c94097a8\sp2gdr\wininet.dll
06/23/2008 07:13 PM 665600 6d51ccbaa2000ab8ae57039b032f40cb C:\WINDOWS\SoftwareDistribution\Download\1be58cfb416090b0812f9195c94097a8\sp2qfe\wininet.dll
06/23/2008 06:10 PM 664576 e8d6a238ff6a49ea3d70616334989646 C:\WINDOWS\SoftwareDistribution\Download\1be58cfb416090b0812f9195c94097a8\sp3gdr\wininet.dll
06/23/2008 05:54 PM 665088 201b198b2fcfa87849cb19e0ed53e22a C:\WINDOWS\SoftwareDistribution\Download\1be58cfb416090b0812f9195c94097a8\sp3qfe\wininet.dll
05/10/2006 08:23 AM 656896 2d38385877cb32db7c3d2271d2dc84db C:\WINDOWS\SoftwareDistribution\Download\427a20bec038cd2e039f83303338fb0d\sp2gdr\wininet.dll
05/10/2006 08:25 AM 662016 4bc88c82ed023c36f906111864c16bf6 C:\WINDOWS\SoftwareDistribution\Download\427a20bec038cd2e039f83303338fb0d\sp2qfe\wininet.dll
08/22/2007 04:11 PM 657408 aa24845a20df9825164900ea3e7e1b91 C:\WINDOWS\SoftwareDistribution\Download\ceab216a296ef016caed174a0e77e284\sp2gdr\wininet.dll
08/22/2007 03:56 PM 664064 631aea3de7379bed883cbe0c54400e4b C:\WINDOWS\SoftwareDistribution\Download\ceab216a296ef016caed174a0e77e284\sp2qfe\wininet.dll
08/04/2004 12:55 AM 689152 c738ab256d55a0ace7f4f4ce1a1c0f31 C:\WINDOWS\system32\wininet.dll
08/04/2004 12:55 AM 654848 1e1cef80a11bdab92b2a83f885d214d5 C:\WINDOWS\system32\dllcache\wininet.dll
07/30/2007 07:19 PM 68440 84d9a61860272d6177d46c86b8431557 C:\WINDOWS\system32\wuauclt.exe
07/30/2007 07:19 PM 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uniblue PowerSuite"="C:\Program Files\Uniblue\PowerSuite\PowerSuite.exe" [12/11/2007 11:00 AM 3202832]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [08/16/2007 04:19 PM 5728112]
"locks burn"="C:\DOCUME~1\YASIRI~1\APPLIC~1\MP3FIN~1\Viewtrust.exe" [08/15/2008 04:36 AM 498688]
"Uniblue SpyEraser"="C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" [12/11/2007 11:00 AM 1260296]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ACU"="C:\Program Files\Atheros\ACU.exe" [07/11/2005 04:04 PM 311296]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [03/24/2004 06:40 PM 196608]
"HWSetup"="C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [05/01/2004 01:45 PM 28672]
"PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [08/30/2005 11:53 AM 1077329]
"SVPWUTIL"="C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" [05/01/2004 01:45 PM 65536]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [08/25/2005 07:11 PM 53248]
"Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [04/05/2005 04:25 PM 73728]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [05/12/2005 10:31 AM 118784]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [04/13/2005 03:48 AM 36975]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [07/20/2005 07:09 AM 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [07/20/2005 07:06 AM 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [07/20/2005 07:10 AM 114688]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [09/06/2005 02:04 PM 671744]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM 31016]
"RemoteControl"="D:\PDVDServ.exe" [11/02/2004 08:24 PM 32768]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [07/29/2008 08:20 PM 206088]
"AGRSMMSG"="AGRSMMSG.exe" [12/22/2004 09:10 PM 88358 C:\WINDOWS\agrsmmsg.exe]
"TCtryIOHook"="TCtrlIOHook.exe" [08/22/2005 04:49 PM 28672 C:\WINDOWS\system32\TCtrlIOHook.exe]
"TFncKy"="TFncKy.exe" [BU]
"TPSMain"="TPSMain.exe" [08/11/2005 02:33 PM 266240 C:\WINDOWS\system32\TPSMain.exe]
"Zooming"="ZoomingHook.exe" [06/06/2005 09:58 AM 24576 C:\WINDOWS\system32\ZoomingHook.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:56 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Orbitdownloader\\orbitdm.exe"=
"D:\\Orbitdownloader\\orbitnet.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [01/29/2008 06:29 PM]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [03/13/2008 07:02 PM]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/30/2008 06:06 PM]
.
s of the 'Scheduled Tasks' folder
2008-08-17 C:\WINDOWS\Tasks\1-Click Maintenance.job
- D:\ [01/01/1980 12:00 AM]
2008-08-15 C:\WINDOWS\Tasks\Uniblue SpyEraser.job
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe [12/11/2007 11:00 AM]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-CursorFX - D:\شكل الفاره\Stardock\CursorFX\CursorFX.exe
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
O8 -: &Download by Orbit - D:\Orbitdownloader\orbitmxt.dll/201
O8 -: &Grab video by Orbit - D:\Orbitdownloader\orbitmxt.dll/204
O8 -: Do&wnload selected by Orbit - D:\Orbitdownloader\orbitmxt.dll/203
O8 -: Down&load all by Orbit - D:\Orbitdownloader\orbitmxt.dll/202
O8 -: ت&صدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-17 14:17:11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\Apoint2K\ApntEx.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
D:\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
D:\Orbitdownloader\orbitnet.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\WINDOWS\system32\wbem\wmiadap.exe
.
**************************************************************************
.
Completion time: 08/17/2008 14:22:38 - machine was rebooted [yasirinho]
ComboFix-quarantined-files.txt 2008-08-17 11:22:35
Pre-Run: 13,974,130,688 bytes free
Post-Run: 13,965,422,592 bytes free
199 --- E O F --- 2008-08-17 00:45:13
وهذا تقرير الهايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:28:45 م, on 17/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Atheros\ACU.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\PDVDServ.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
D:\شكل الفاره\Stardock\CursorFX\CursorFX.exe
D:\Orbitdownloader\orbitdm.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
D:\Orbitdownloader\orbitnet.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\yasirinho\سطح المكتب\تقرير الهايجاك.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\Orbitdownloader\GrabPro.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RemoteControl] D:\PDVDServ.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Uniblue PowerSuite] C:\Program Files\Uniblue\PowerSuite\PowerSuite.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [locks burn] C:\DOCUME~1\YASIRI~1\APPLIC~1\MP3FIN~1\Viewtrust.exe
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Orbit.lnk = D:\Orbitdownloader\orbitdm.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Download by Orbit - res://D:\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://D:\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://D:\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: احصائيات حماية حركة مرور الشبكة - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
--
End of file - 8372 bytes
وبلييز قلي ايش مشكلة التعليق والبطء والتهنيق بالجهاز طبعا حذفت الدكتور سباي وير ..
لك كل الحب عبودي وعذرنا اذا تعبناك ..
