alhajes
زيزوومي جديد
غير متصل
السلام عليكم ورحمة الله وبركاته
انا عندي مشاكل في الجهاز من جهة التعليق ومن جهة الكاسبر لايحدث جربت جميع الوسائل لكن لاجدوى
وقد عملت تقريري لجهازي ارجو الافااااااااااااادة
وهذا هو
Deckard's System Scanner v20071014.68
Run by user on 2009-01-18 00:29:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
System Restore is disabled; attempting to re-enable...success.
Backed up registry hives.
Performed disk cleanup.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2009-01-18 00:32:10
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\TUProgSt.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\system32\WLTRAY.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\DellTPad\ApntEx.exe
C:\Program Files\DellTPad\hidfind.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Documents and Settings\user\Desktop\dss.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إحصائيات مضاد فيروسات المواقع - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ******) -
O17 - HKLM\Software\..\Telephony: DomainName =
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain =
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain =
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain =
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\system32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\system32\TUProgSt.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\system32\WLTRYSVC.EXE
--
End of file - 7816 bytes
-- File Associations -----------------------------------------------------------
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser %1,%*
.reg - regfile - shell\open\command - regedit.exe %1
.scr - scrfile - shell\open\command - "%1" %*
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
S3 CSRBC (CSRBC.Sys CSR test driver) - c:\windows\system32\drivers\csrbcxp.sys <Not Verified; CSR, plc; CsrUsb Device Driver>
S3 PEEK5 (PEEK5 Protocol Driver) - c:\aircrack-ng-0.6.2-win\bin\peek5.sys <Not Verified; WildPackets, Inc.; WildPackets Capture Framework>
S3 uti3mtk2 (AVZ Kernel Driver) - c:\windows\system32\drivers\uti3mtk2.sys <Not Verified; ; AVZ Driver>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 o2flash (O2Micro Flash Memory Card Service) - "c:\program files\o2micro flash memory card driver\o2flash.exe" <Not Verified; O2Micro International; O2 MS1/MP1 Service>
S3 getPlus(R) Helper -
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Scheduled Tasks -------------------------------------------------------------
2009-01-18 00:00:01 484 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job
-- Files created between 2008-12-18 and 2009-01-18 -----------------------------
2009-01-16 20:57:07 7456 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2009-01-16 20:57:07 562720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2009-01-16 20:56:41 0 d-------- C:\Program Files\Kaspersky Lab
2009-01-16 20:56:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-01-16 02:29:54 0 dr-h----- C:\Documents and Settings\user\Recent
2009-01-15 22:56:44 0 d-------- C:\Documents and Settings\All Users.WIN2\Application Data
2009-01-15 22:56:44 0 d-------- C:\Documents and Settings\All Users.WIN2\Application Data\RFA_Backups
2009-01-15 22:56:39 0 d-------- C:\Zyzoom_RFA_Platinum
2009-01-15 22:52:04 0 d-------- C:\WINDOWS\SoftwareDistribution
2009-01-15 18:49:40 0 d-------- C:\Documents and Settings\user\Application Data\CyberScrub
2009-01-15 18:48:30 0 d-------- C:\Zyzoom_system_cleaner
2009-01-15 01:51:15 0 --a------ C:\osy3.sys
2009-01-15 01:47:13 0 d-------- C:\Documents and Settings\user\Application Data\Grisoft
2009-01-15 01:47:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2009-01-15 01:47:03 0 d-------- C:\Zyzoom_AVG_Anti-Spyware_Plus_7.5.1.43_Portable
2009-01-13 20:39:55 9488 -ra------ C:\WINDOWS\kill.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
2009-01-13 20:39:09 0 --a------ C:\WINDOWS\system32\WinWare.sys
2009-01-13 20:33:36 0 d-------- C:\Program Files\Common Files\delet
2009-01-13 14:30:57 0 d-------- C:\Documents and Settings\Administrator\Application Data\Reallusion
2009-01-13 14:30:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\tmp
2009-01-12 14:32:25 7168 --a------ C:\WINDOWS\system32\drivers\uti3mtk2.sys <Not Verified; ; AVZ Driver>
2009-01-12 01:22:01 0 d-------- C:\Documents and Settings\LocalService\Desktop
2009-01-10 15:06:08 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20>
2009-01-10 15:06:07 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
2009-01-10 15:06:07 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2009-01-10 15:06:07 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2009-01-10 15:06:07 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2009-01-10 15:06:07 0 d-------- C:\Program Files\Common Files\Ahead
2009-01-10 15:06:06 0 d-------- C:\Program Files\Ahead
2009-01-10 00:48:37 0 d-------- C:\aircrack-ng-0.6.2-win
2009-01-05 23:45:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\Templates
2009-01-05 16:12:04 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2009-01-05 16:12:04 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\Recent
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2009-01-05 16:12:04 0 d-------- C:\Documents and Settings\Administrator\My Documents
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2009-01-05 16:12:04 0 d-------- C:\Documents and Settings\Administrator\Favorites
2009-01-05 16:12:04 0 d-------- C:\Documents and Settings\Administrator\Desktop
2009-01-05 16:12:04 0 d--hs---- C:\Documents and Settings\Administrator\******s
2009-01-05 16:12:04 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2009-01-05 16:12:04 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2009-01-05 16:12:03 786432 --a------ C:\Documents and Settings\Administrator\NTUSER.DAT
2009-01-05 16:11:36 0 d--hs---- C:\WINDOWS\CSC
2009-01-04 12:01:17 0 d-------- C:\kav
2009-01-02 22:14:58 0 d-------- C:\Program Files\Akram
2009-01-02 00:29:42 0 dr-hs---- C:\resycled
2008-12-31 15:11:28 0 d-------- C:\Program Files\SuperAudiotool
2008-12-31 14:59:10 0 d-------- C:\Program Files\Cooolsoft
2008-12-27 23:45:33 110592 --a------ C:\WINDOWS\system32\CT Mystified.scr <Not Verified; Camtech 2000; CT Mystified>
2008-12-27 23:45:33 0 d-------- C:\Program Files\Camtech
2008-12-27 13:16:10 46 --a------ C:\WINDOWS\system32\winitn.dll
2008-12-27 13:16:09 987136 --a------ C:\WINDOWS\system32\agsaamh.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioCDGrabber2.dll Module>
2008-12-27 13:16:09 331776 --a------ C:\WINDOWS\system32\agsaama.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioPlayer3 Module>
2008-12-27 13:16:07 46 --a------ C:\WINDOWS\system32\kakle.dll
2008-12-27 13:16:05 196608 --a------ C:\WINDOWS\system32\maag.dll <Not Verified; NCT Company Ltd.; NCTWMAFile2 ActiveX DLL>
2008-12-27 13:16:05 1212416 --a------ C:\WINDOWS\system32\ckll.dll <Not Verified; NCT Company Ltd.; NCTAudioInformation2 ActiveX DLL>
2008-12-27 13:16:05 1245184 --a------ C:\WINDOWS\system32\bkll.dll <Not Verified; NCT Company Ltd.; NCTRMFile ActiveX DLL>
2008-12-27 13:16:05 1986560 --a------ C:\WINDOWS\system32\akll.dll <Not Verified; NCT Company Ltd.; NCTAudioFile2 ActiveX DLL>
2008-12-27 13:16:05 2535424 --a------ C:\WINDOWS\system32\agsaamj.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioCompress3 Module>
2008-12-27 13:16:05 90112 --a------ C:\WINDOWS\system32\agsaami.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFormatSettings3 Module>
2008-12-27 13:16:05 610304 --a------ C:\WINDOWS\system32\agsaamg.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFile3 Module>
2008-12-27 13:16:05 372736 --a------ C:\WINDOWS\system32\agsaamc.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFileWMA3 Module>
2008-12-27 13:16:05 53760 --a------ C:\WINDOWS\system\ppacklib.dll <Not Verified; ; ZLib.DLL>
2008-12-27 13:15:54 0 d-------- C:\WINDOWS\system32\RMBin
2008-12-27 01:07:51 0 d-------- C:\Program Files\PowerQuest
2008-12-26 17:53:32 0 d-------- C:\Program Files\Common Files\Adobe AIR
2008-12-24 23:15:04 0 d-------- C:\WINDOWS\system32\CatRoot_bak
2008-12-23 11:17:44 0 d-------- C:\WINDOWS\system32\PreInstall
2008-12-23 11:17:42 0 d--h----- C:\WINDOWS\$hf_mig$
2008-12-22 10:29:19 0 d-------- C:\Documents and Settings\user\Application Data\CyberLink
2008-12-21 14:45:58 2288128 --a------ C:\WINDOWS\system32\TUKernel.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-12-21 14:27:18 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-12-20 21:22:34 0 d-------- C:\Documents and Settings\user\Application Data\Media Player Classic
2008-12-20 14:08:30 0 d-------- C:\Program Files\Ares
2008-12-19 23:07:58 0 d-------- C:\Documents and Settings\user\Application Data\tmp
2008-12-19 23:07:58 0 d-------- C:\Documents and Settings\user\Application Data\Reallusion
2008-12-19 23:07:01 0 d-------- C:\Documents and Settings\user\Application Data\Creative
2008-12-19 23:03:19 76 -r-hs---- C:\WINDOWS\CT4CET.bin
2008-12-19 23:02:50 0 d-------- C:\Program Files\Common Files\Reallusion
2008-12-19 23:01:15 0 d-------- C:\Program Files\Creative Live! Cam
2008-12-19 23:00:45 0 d-------- C:\Program Files\Creative
2008-12-19 00:58:01 0 d-------- C:\Documents and Settings\user\Application Data\TuneUp Software
2008-12-19 00:57:47 0 d-------- C:\Program Files\TuneUp Utilities 2009
2008-12-19 00:57:47 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-12-19 00:56:45 0 d--hs---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-19 00:49:06 0 d-------- C:\Documents and Settings\user\Application Data\COWON
2008-12-19 00:48:37 0 d-------- C:\My Music
2008-12-19 00:47:18 5 --a------ C:\WINDOWS\system32\SySCut.dat
2008-12-19 00:46:52 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2008-12-19 00:46:30 0 d-------- C:\Program Files\Common Files\COWON
2008-12-19 00:46:29 0 d-------- C:\Program Files\JetAudio
2008-12-18 21:53:01 0 d-------- C:\Documents and Settings\user\Application Data\Help
-- Find3M Report ---------------------------------------------------------------
2009-01-13 20:33:36 0 d-------- C:\Program Files\Common Files
2009-01-07 01:03:50 0 d-------- C:\Program Files\MSN Messenger
2009-01-07 01:03:50 0 d-------- C:\Program Files\Messenger Plus! Live
2009-01-06 16:31:02 0 d-------- C:\Documents and Settings\user\Application Data\Adobe
2009-01-02 22:15:27 237568 --a------ C:\WINDOWS\system32\lame_enc.dll
2009-01-02 00:27:17 0 d-------- C:\Program Files\Golden Al-Wafi Translator
2008-12-27 01:07:30 0 d-------- C:\Program Files\Common Files\InstallShield
2008-12-26 17:52:44 0 d-------- C:\Program Files\Common Files\Adobe
2008-12-25 18:12:19 0 d-------- C:\Program Files\Messenger
2008-12-19 23:02:50 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-12-19 23:01:09 0 d-------- C:\Program Files\Dell
2008-12-18 21:57:20 0 d-------- C:\Documents and Settings\user\Application Data\Real
2008-12-17 11:16:39 0 d-------- C:\Program Files\Java
2008-12-17 11:02:24 0 d-------- C:\Documents and Settings\user\Application Data\Sun
2008-12-17 10:59:43 0 d-------- C:\Documents and Settings\user\Application Data\Macromedia
2008-12-17 10:33:06 0 --a------ C:\WINDOWS\nsreg.dat
2008-12-17 10:33:06 0 d-------- C:\Documents and Settings\user\Application Data\Mozilla
2008-12-16 23:11:36 0 d-------- C:\Documents and Settings\user\Application Data\Toshiba
2008-12-16 17:51:13 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-12-16 17:39:27 0 d-------- C:\Program Files\Windows Live
2008-12-16 17:33:10 0 d-------- C:\Program Files\CyberLink
2008-12-16 17:32:16 0 d-------- C:\Program Files\Common Files\xing shared
2008-12-16 17:32:15 0 d-------- C:\Program Files\Real
2008-12-16 17:32:11 0 d-------- C:\Program Files\Common Files\Real
2008-12-16 17:22:33 0 d-------- C:\Program Files\K-Lite Codec Pack
2008-12-16 17:15:06 0 d-------- C:\Program Files\Toshiba
2008-12-16 16:53:45 0 d-------- C:\Program Files\Realtek
2008-12-16 16:35:38 22729 --a------ C:\newkey
2008-12-16 16:35:35 0 d-------- C:\Documents and Settings\user\Application Data\InstallShield
2008-12-16 16:30:09 0 d-------- C:\Program Files\DellTPad
2008-12-16 16:28:15 0 d-------- C:\Program Files\O2Micro Flash Memory Card Driver
2008-12-16 16:24:40 0 d-------- C:\Program Files\Intel
2008-12-16 16:20:50 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-12-16 15:58:38 0 d-------- C:\Program Files\Microsoft Works
2008-12-16 15:58:30 0 d-------- C:\Program Files\MSBuild
2008-12-16 15:48:17 0 d-------- C:\Documents and Settings\user\Application Data\Identities
2008-12-16 15:43:41 0 d-------- C:\Program Files\microsoft frontpage
2008-12-16 15:43:23 0 --a------ C:\MSDOS.SYS
2008-12-16 15:43:23 0 --a------ C:\IO.SYS
2008-12-16 15:43:23 0 --a------ C:\CONFIG.SYS
2008-12-16 15:43:23 0 --a------ C:\AUTOEXEC.BAT
2008-12-16 15:42:14 0 d--h----- C:\Program Files\WindowsUpdate
2008-12-16 15:41:21 0 d-------- C:\Program Files\Common Files\MSSoap
2008-12-16 15:41:11 0 d-------- C:\Program Files\Movie Maker
2008-12-16 15:40:18 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-12-16 15:39:54 0 d-------- C:\Program Files\Online Services
2008-12-16 15:39:43 0 d-------- C:\Program Files\MSN Gaming Zone
2008-12-16 15:39:34 0 d-------- C:\Program Files\Windows NT
2008-12-16 07:26:11 0 d-------- C:\Program Files\Common Files\ODBC
2008-12-16 07:26:08 0 d-------- C:\Program Files\Common Files\SpeechEngines
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
06/12/2008 09:33 AM 75128 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
12/17/2008 11:16 AM 34816 --a------ C:\Program Files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
12/17/2008 11:16 AM 73728 --a------ C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [11/06/2007 09:50 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/04/2005 05:43 AM C:\WINDOWS\Alcmtr.exe]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [12/14/2007 10:44 PM]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [10/10/2007 06:17 AM]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [01/10/2008 04:02 AM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [01/10/2008 04:01 AM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [01/10/2008 04:02 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [12/16/2008 05:31 PM]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [12/18/2007 12:43 AM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"ares"="C:\Program Files\Ares\Ares.exe" [12/17/2008 05:08 AM]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/12/2008 11:07:04 ê]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [12/01/2007 07:43:46 *]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b6076c2-cb29-11dd-ba0d-806d6172696f}]
AutoRun\command- F:\umenu.exe
-- End of Deckard's System Scanner: finished at 2009-01-18 00:33:11 ------------
انا عندي مشاكل في الجهاز من جهة التعليق ومن جهة الكاسبر لايحدث جربت جميع الوسائل لكن لاجدوى
وقد عملت تقريري لجهازي ارجو الافااااااااااااادة
وهذا هو
Deckard's System Scanner v20071014.68
Run by user on 2009-01-18 00:29:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
System Restore is disabled; attempting to re-enable...success.
Backed up registry hives.
Performed disk cleanup.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2009-01-18 00:32:10
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\TUProgSt.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\system32\WLTRAY.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\DellTPad\ApntEx.exe
C:\Program Files\DellTPad\hidfind.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Documents and Settings\user\Desktop\dss.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إحصائيات مضاد فيروسات المواقع - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - (file missing)
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash ******) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O17 - HKLM\Software\..\Telephony: DomainName =
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain =
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain =
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain =
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\system32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\system32\TUProgSt.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\system32\WLTRYSVC.EXE
--
End of file - 7816 bytes
-- File Associations -----------------------------------------------------------
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser %1,%*
.reg - regfile - shell\open\command - regedit.exe %1
.scr - scrfile - shell\open\command - "%1" %*
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
S3 CSRBC (CSRBC.Sys CSR test driver) - c:\windows\system32\drivers\csrbcxp.sys <Not Verified; CSR, plc; CsrUsb Device Driver>
S3 PEEK5 (PEEK5 Protocol Driver) - c:\aircrack-ng-0.6.2-win\bin\peek5.sys <Not Verified; WildPackets, Inc.; WildPackets Capture Framework>
S3 uti3mtk2 (AVZ Kernel Driver) - c:\windows\system32\drivers\uti3mtk2.sys <Not Verified; ; AVZ Driver>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 o2flash (O2Micro Flash Memory Card Service) - "c:\program files\o2micro flash memory card driver\o2flash.exe" <Not Verified; O2Micro International; O2 MS1/MP1 Service>
S3 getPlus(R) Helper -
-- Device Manager: Disabled ----------------------------------------------------
No disabled devices found.
-- Scheduled Tasks -------------------------------------------------------------
2009-01-18 00:00:01 484 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job
-- Files created between 2008-12-18 and 2009-01-18 -----------------------------
2009-01-16 20:57:07 7456 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2009-01-16 20:57:07 562720 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2009-01-16 20:56:41 0 d-------- C:\Program Files\Kaspersky Lab
2009-01-16 20:56:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-01-16 02:29:54 0 dr-h----- C:\Documents and Settings\user\Recent
2009-01-15 22:56:44 0 d-------- C:\Documents and Settings\All Users.WIN2\Application Data
2009-01-15 22:56:44 0 d-------- C:\Documents and Settings\All Users.WIN2\Application Data\RFA_Backups
2009-01-15 22:56:39 0 d-------- C:\Zyzoom_RFA_Platinum
2009-01-15 22:52:04 0 d-------- C:\WINDOWS\SoftwareDistribution
2009-01-15 18:49:40 0 d-------- C:\Documents and Settings\user\Application Data\CyberScrub
2009-01-15 18:48:30 0 d-------- C:\Zyzoom_system_cleaner
2009-01-15 01:51:15 0 --a------ C:\osy3.sys
2009-01-15 01:47:13 0 d-------- C:\Documents and Settings\user\Application Data\Grisoft
2009-01-15 01:47:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2009-01-15 01:47:03 0 d-------- C:\Zyzoom_AVG_Anti-Spyware_Plus_7.5.1.43_Portable
2009-01-13 20:39:55 9488 -ra------ C:\WINDOWS\kill.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System>
2009-01-13 20:39:09 0 --a------ C:\WINDOWS\system32\WinWare.sys
2009-01-13 20:33:36 0 d-------- C:\Program Files\Common Files\delet
2009-01-13 14:30:57 0 d-------- C:\Documents and Settings\Administrator\Application Data\Reallusion
2009-01-13 14:30:56 0 d-------- C:\Documents and Settings\Administrator\Application Data\tmp
2009-01-12 14:32:25 7168 --a------ C:\WINDOWS\system32\drivers\uti3mtk2.sys <Not Verified; ; AVZ Driver>
2009-01-12 01:22:01 0 d-------- C:\Documents and Settings\LocalService\Desktop
2009-01-10 15:06:08 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20>
2009-01-10 15:06:07 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
2009-01-10 15:06:07 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2009-01-10 15:06:07 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2009-01-10 15:06:07 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7>
2009-01-10 15:06:07 0 d-------- C:\Program Files\Common Files\Ahead
2009-01-10 15:06:06 0 d-------- C:\Program Files\Ahead
2009-01-10 00:48:37 0 d-------- C:\aircrack-ng-0.6.2-win
2009-01-05 23:45:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\Templates
2009-01-05 16:12:04 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2009-01-05 16:12:04 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\Recent
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2009-01-05 16:12:04 0 d-------- C:\Documents and Settings\Administrator\My Documents
2009-01-05 16:12:04 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2009-01-05 16:12:04 0 d-------- C:\Documents and Settings\Administrator\Favorites
2009-01-05 16:12:04 0 d-------- C:\Documents and Settings\Administrator\Desktop
2009-01-05 16:12:04 0 d--hs---- C:\Documents and Settings\Administrator\******s
2009-01-05 16:12:04 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2009-01-05 16:12:04 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2009-01-05 16:12:03 786432 --a------ C:\Documents and Settings\Administrator\NTUSER.DAT
2009-01-05 16:11:36 0 d--hs---- C:\WINDOWS\CSC
2009-01-04 12:01:17 0 d-------- C:\kav
2009-01-02 22:14:58 0 d-------- C:\Program Files\Akram
2009-01-02 00:29:42 0 dr-hs---- C:\resycled
2008-12-31 15:11:28 0 d-------- C:\Program Files\SuperAudiotool
2008-12-31 14:59:10 0 d-------- C:\Program Files\Cooolsoft
2008-12-27 23:45:33 110592 --a------ C:\WINDOWS\system32\CT Mystified.scr <Not Verified; Camtech 2000; CT Mystified>
2008-12-27 23:45:33 0 d-------- C:\Program Files\Camtech
2008-12-27 13:16:10 46 --a------ C:\WINDOWS\system32\winitn.dll
2008-12-27 13:16:09 987136 --a------ C:\WINDOWS\system32\agsaamh.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioCDGrabber2.dll Module>
2008-12-27 13:16:09 331776 --a------ C:\WINDOWS\system32\agsaama.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioPlayer3 Module>
2008-12-27 13:16:07 46 --a------ C:\WINDOWS\system32\kakle.dll
2008-12-27 13:16:05 196608 --a------ C:\WINDOWS\system32\maag.dll <Not Verified; NCT Company Ltd.; NCTWMAFile2 ActiveX DLL>
2008-12-27 13:16:05 1212416 --a------ C:\WINDOWS\system32\ckll.dll <Not Verified; NCT Company Ltd.; NCTAudioInformation2 ActiveX DLL>
2008-12-27 13:16:05 1245184 --a------ C:\WINDOWS\system32\bkll.dll <Not Verified; NCT Company Ltd.; NCTRMFile ActiveX DLL>
2008-12-27 13:16:05 1986560 --a------ C:\WINDOWS\system32\akll.dll <Not Verified; NCT Company Ltd.; NCTAudioFile2 ActiveX DLL>
2008-12-27 13:16:05 2535424 --a------ C:\WINDOWS\system32\agsaamj.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioCompress3 Module>
2008-12-27 13:16:05 90112 --a------ C:\WINDOWS\system32\agsaami.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFormatSettings3 Module>
2008-12-27 13:16:05 610304 --a------ C:\WINDOWS\system32\agsaamg.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFile3 Module>
2008-12-27 13:16:05 372736 --a------ C:\WINDOWS\system32\agsaamc.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFileWMA3 Module>
2008-12-27 13:16:05 53760 --a------ C:\WINDOWS\system\ppacklib.dll <Not Verified; ; ZLib.DLL>
2008-12-27 13:15:54 0 d-------- C:\WINDOWS\system32\RMBin
2008-12-27 01:07:51 0 d-------- C:\Program Files\PowerQuest
2008-12-26 17:53:32 0 d-------- C:\Program Files\Common Files\Adobe AIR
2008-12-24 23:15:04 0 d-------- C:\WINDOWS\system32\CatRoot_bak
2008-12-23 11:17:44 0 d-------- C:\WINDOWS\system32\PreInstall
2008-12-23 11:17:42 0 d--h----- C:\WINDOWS\$hf_mig$
2008-12-22 10:29:19 0 d-------- C:\Documents and Settings\user\Application Data\CyberLink
2008-12-21 14:45:58 2288128 --a------ C:\WINDOWS\system32\TUKernel.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-12-21 14:27:18 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-12-20 21:22:34 0 d-------- C:\Documents and Settings\user\Application Data\Media Player Classic
2008-12-20 14:08:30 0 d-------- C:\Program Files\Ares
2008-12-19 23:07:58 0 d-------- C:\Documents and Settings\user\Application Data\tmp
2008-12-19 23:07:58 0 d-------- C:\Documents and Settings\user\Application Data\Reallusion
2008-12-19 23:07:01 0 d-------- C:\Documents and Settings\user\Application Data\Creative
2008-12-19 23:03:19 76 -r-hs---- C:\WINDOWS\CT4CET.bin
2008-12-19 23:02:50 0 d-------- C:\Program Files\Common Files\Reallusion
2008-12-19 23:01:15 0 d-------- C:\Program Files\Creative Live! Cam
2008-12-19 23:00:45 0 d-------- C:\Program Files\Creative
2008-12-19 00:58:01 0 d-------- C:\Documents and Settings\user\Application Data\TuneUp Software
2008-12-19 00:57:47 0 d-------- C:\Program Files\TuneUp Utilities 2009
2008-12-19 00:57:47 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-12-19 00:56:45 0 d--hs---- C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-19 00:49:06 0 d-------- C:\Documents and Settings\user\Application Data\COWON
2008-12-19 00:48:37 0 d-------- C:\My Music
2008-12-19 00:47:18 5 --a------ C:\WINDOWS\system32\SySCut.dat
2008-12-19 00:46:52 3082 --a------ C:\WINDOWS\system32\affv11300p2now.sys
2008-12-19 00:46:30 0 d-------- C:\Program Files\Common Files\COWON
2008-12-19 00:46:29 0 d-------- C:\Program Files\JetAudio
2008-12-18 21:53:01 0 d-------- C:\Documents and Settings\user\Application Data\Help
-- Find3M Report ---------------------------------------------------------------
2009-01-13 20:33:36 0 d-------- C:\Program Files\Common Files
2009-01-07 01:03:50 0 d-------- C:\Program Files\MSN Messenger
2009-01-07 01:03:50 0 d-------- C:\Program Files\Messenger Plus! Live
2009-01-06 16:31:02 0 d-------- C:\Documents and Settings\user\Application Data\Adobe
2009-01-02 22:15:27 237568 --a------ C:\WINDOWS\system32\lame_enc.dll
2009-01-02 00:27:17 0 d-------- C:\Program Files\Golden Al-Wafi Translator
2008-12-27 01:07:30 0 d-------- C:\Program Files\Common Files\InstallShield
2008-12-26 17:52:44 0 d-------- C:\Program Files\Common Files\Adobe
2008-12-25 18:12:19 0 d-------- C:\Program Files\Messenger
2008-12-19 23:02:50 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-12-19 23:01:09 0 d-------- C:\Program Files\Dell
2008-12-18 21:57:20 0 d-------- C:\Documents and Settings\user\Application Data\Real
2008-12-17 11:16:39 0 d-------- C:\Program Files\Java
2008-12-17 11:02:24 0 d-------- C:\Documents and Settings\user\Application Data\Sun
2008-12-17 10:59:43 0 d-------- C:\Documents and Settings\user\Application Data\Macromedia
2008-12-17 10:33:06 0 --a------ C:\WINDOWS\nsreg.dat
2008-12-17 10:33:06 0 d-------- C:\Documents and Settings\user\Application Data\Mozilla
2008-12-16 23:11:36 0 d-------- C:\Documents and Settings\user\Application Data\Toshiba
2008-12-16 17:51:13 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2008-12-16 17:39:27 0 d-------- C:\Program Files\Windows Live
2008-12-16 17:33:10 0 d-------- C:\Program Files\CyberLink
2008-12-16 17:32:16 0 d-------- C:\Program Files\Common Files\xing shared
2008-12-16 17:32:15 0 d-------- C:\Program Files\Real
2008-12-16 17:32:11 0 d-------- C:\Program Files\Common Files\Real
2008-12-16 17:22:33 0 d-------- C:\Program Files\K-Lite Codec Pack
2008-12-16 17:15:06 0 d-------- C:\Program Files\Toshiba
2008-12-16 16:53:45 0 d-------- C:\Program Files\Realtek
2008-12-16 16:35:38 22729 --a------ C:\newkey
2008-12-16 16:35:35 0 d-------- C:\Documents and Settings\user\Application Data\InstallShield
2008-12-16 16:30:09 0 d-------- C:\Program Files\DellTPad
2008-12-16 16:28:15 0 d-------- C:\Program Files\O2Micro Flash Memory Card Driver
2008-12-16 16:24:40 0 d-------- C:\Program Files\Intel
2008-12-16 16:20:50 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-12-16 15:58:38 0 d-------- C:\Program Files\Microsoft Works
2008-12-16 15:58:30 0 d-------- C:\Program Files\MSBuild
2008-12-16 15:48:17 0 d-------- C:\Documents and Settings\user\Application Data\Identities
2008-12-16 15:43:41 0 d-------- C:\Program Files\microsoft frontpage
2008-12-16 15:43:23 0 --a------ C:\MSDOS.SYS
2008-12-16 15:43:23 0 --a------ C:\IO.SYS
2008-12-16 15:43:23 0 --a------ C:\CONFIG.SYS
2008-12-16 15:43:23 0 --a------ C:\AUTOEXEC.BAT
2008-12-16 15:42:14 0 d--h----- C:\Program Files\WindowsUpdate
2008-12-16 15:41:21 0 d-------- C:\Program Files\Common Files\MSSoap
2008-12-16 15:41:11 0 d-------- C:\Program Files\Movie Maker
2008-12-16 15:40:18 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-12-16 15:39:54 0 d-------- C:\Program Files\Online Services
2008-12-16 15:39:43 0 d-------- C:\Program Files\MSN Gaming Zone
2008-12-16 15:39:34 0 d-------- C:\Program Files\Windows NT
2008-12-16 07:26:11 0 d-------- C:\Program Files\Common Files\ODBC
2008-12-16 07:26:08 0 d-------- C:\Program Files\Common Files\SpeechEngines
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
06/12/2008 09:33 AM 75128 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
12/17/2008 11:16 AM 34816 --a------ C:\Program Files\Java\jre6\bin\jp2ssv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper ******s\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
12/17/2008 11:16 AM 73728 --a------ C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [11/06/2007 09:50 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/04/2005 05:43 AM C:\WINDOWS\Alcmtr.exe]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe" [12/14/2007 10:44 PM]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [10/10/2007 06:17 AM]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [01/10/2008 04:02 AM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [01/10/2008 04:01 AM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [01/10/2008 04:02 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [12/16/2008 05:31 PM]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [07/09/2001 11:50 AM]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [12/18/2007 12:43 AM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"ares"="C:\Program Files\Ares\Ares.exe" [12/17/2008 05:08 AM]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16/12/2008 11:07:04 ê]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [12/01/2007 07:43:46 *]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b6076c2-cb29-11dd-ba0d-806d6172696f}]
AutoRun\command- F:\umenu.exe
-- End of Deckard's System Scanner: finished at 2009-01-18 00:33:11 ------------
.png)
.png)
