.
--------------------------\\\ Start Report Of HijackThis ---------------
.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:10:40, on 8/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\winsersec.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\ClocX\ClocX.exe
C:\Documents and Settings\ahc\My Documents\VistaDriveIcon\DrvIcon.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\sdaemon.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AvaFind\AvaFind.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ahc\سطح المكتب\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.exe
C:\DOCUME~1\ahc\LOCALS~1\Temp\bntoz\runn.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\ahc\LOCALS~1\Temp\bntoz\HijackThis.exe
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: AskBar BHO - {5A074B21-F830-49de-A31B-5BB9D7F6B407} - C:\Program Files\AskBar\bar\bin\askBar.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: CEventSink Class - {B7154C4D-87C0-4A2C-AB64-DA132BAC2EE6} - C:\Program Files\Hotspot Shield\AnchorFree\ie\AFBho.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O3 - Toolbar: Ask Toolbar - {5A074B29-F830-49de-A31B-5BB9D7F6B407} - C:\Program Files\AskBar\bar\bin\askBar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
O4 - HKLM\..\Run: [DrvIcon] C:\Documents and Settings\ahc\My Documents\VistaDriveIcon\DrvIcon.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SDaemon] C:\WINDOWS\sdaemon.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SWd] C:\WINDOWS\winwd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AvaFind] "C:\Program Files\AvaFind\AvaFind.exe" /minimized
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Save Image to Folder - res://C:\Program Files\AskBar\bar\bin\askBar.dll/saveimagetofolder.html
O8 - Extra context menu item: &Save Image to MyStuff - res://C:\Program Files\AskBar\bar\bin\askBar.dll/saveimages.html
O8 - Extra context menu item: &Save Link to Folder - res://C:\Program Files\AskBar\bar\bin\askBar.dll/saveltof.html
O8 - Extra context menu item: &Save Link to MyStuff - res://C:\Program Files\AskBar\bar\bin\askBar.dll/savelink.html
O8 - Extra context menu item: &Save Page to Folder... - res://C:\Program Files\AskBar\bar\bin\askBar.dll/savepagetofolder.html
O8 - Extra context menu item: &Save this Page to MyStuff - res://C:\Program Files\AskBar\bar\bin\askBar.dll/savewebpage.html
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: تخصيص القائمه - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: حفظ النماذج - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: شريط ادوات روبوفورم - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: ملئ النماذج - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: املأ النماذج - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: ملئ النماذج - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: حفظ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: حفظ النماذج - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: روبوفورم - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: شريط ادوات روبوفورم - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\Documents and Settings\ahc\سطح المكتب\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\Documents and Settings\ahc\سطح المكتب\ICleaner.exe (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: winser - Unknown owner - C:\WINDOWS\system32\winsersec.exe
--
End of file - 10566 bytes
.
.
--------------------------\\\ End Report Of Of HijackThis ---------------
.
.
.
.
--------------------------\\\ Start Report Of Running Processes ---------------
.
==================================================
Process Name : smss.exe
ProcessID : 576
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows NT Session Manager
Company : Microsoft Corporation
Window Title :
File Size : 50,688
File Created Date : 6/17/1425 21:56:30
File Modified Date : 6/17/1425 21:56:30
Filename : C:\WINDOWS\System32\smss.exe
Base Address : 0x48580000
Created On : 8/13/1429 03:23:18
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 388 K
Mem Usage Peak : 480 K
Page Faults : 213
Pagefile Usage : 168 K
Pagefile Peak Usage : 1644 K
File Attributes : A
==================================================
==================================================
Process Name : csrss.exe
ProcessID : 636
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Client Server Runtime Process
Company : Microsoft Corporation
Window Title :
File Size : 6,144
File Created Date : 6/17/1425 21:56:08
File Modified Date : 6/17/1425 21:56:08
Filename : C:\WINDOWS\system32\csrss.exe
Base Address : 0x4A680000
Created On : 8/13/1429 03:23:22
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4284 K
Mem Usage Peak : 4912 K
Page Faults : 6928
Pagefile Usage : 1932 K
Pagefile Peak Usage : 2680 K
File Attributes : A
==================================================
==================================================
Process Name : winlogon.exe
ProcessID : 660
Priority : High
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows NT Logon Application
Company : Microsoft Corporation
Window Title :
File Size : 501,248
File Created Date : 6/17/1425 21:56:36
File Modified Date : 6/17/1425 21:56:36
Filename : C:\WINDOWS\system32\winlogon.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:23
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 3536 K
Mem Usage Peak : 11416 K
Page Faults : 7383
Pagefile Usage : 6508 K
Pagefile Peak Usage : 7180 K
File Attributes : A
==================================================
==================================================
Process Name : services.exe
ProcessID : 704
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Services and Controller app
Company : Microsoft Corporation
Window Title :
File Size : 108,032
File Created Date : 6/17/1425 21:56:30
File Modified Date : 6/17/1425 21:56:30
Filename : C:\WINDOWS\system32\services.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:25
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4060 K
Mem Usage Peak : 4216 K
Page Faults : 1447
Pagefile Usage : 2104 K
Pagefile Peak Usage : 2372 K
File Attributes : A
==================================================
==================================================
Process Name : lsass.exe
ProcessID : 716
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : LSA Shell (Export Version)
Company : Microsoft Corporation
Window Title :
File Size : 13,312
File Created Date : 6/17/1425 21:56:18
File Modified Date : 6/17/1425 21:56:18
Filename : C:\WINDOWS\system32\lsass.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:25
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1424 K
Mem Usage Peak : 5844 K
Page Faults : 3166
Pagefile Usage : 3812 K
Pagefile Peak Usage : 4012 K
File Attributes : A
==================================================
==================================================
Process Name : winsersec.exe
ProcessID : 864
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title :
File Size : 53,248
File Created Date : 3/5/1426 22:37:32
File Modified Date : 3/5/1426 22:37:32
Filename : C:\WINDOWS\system32\winsersec.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:27
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1404 K
Mem Usage Peak : 1404 K
Page Faults : 344
Pagefile Usage : 460 K
Pagefile Peak Usage : 460 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 884
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:27
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4956 K
Mem Usage Peak : 5076 K
Page Faults : 1462
Pagefile Usage : 3220 K
Pagefile Peak Usage : 23552 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 944
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:27
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 4204 K
Mem Usage Peak : 4204 K
Page Faults : 1178
Pagefile Usage : 1944 K
Pagefile Peak Usage : 1988 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1108
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\System32\svchost.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:28
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 20300 K
Mem Usage Peak : 25244 K
Page Faults : 13702
Pagefile Usage : 14072 K
Pagefile Peak Usage : 20792 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1224
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:28
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 3236 K
Mem Usage Peak : 3272 K
Page Faults : 896
Pagefile Usage : 1352 K
Pagefile Peak Usage : 1440 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1368
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:29
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 4464 K
Mem Usage Peak : 4472 K
Page Faults : 1171
Pagefile Usage : 1920 K
Pagefile Peak Usage : 1944 K
File Attributes : A
==================================================
==================================================
Process Name : spoolsv.exe
ProcessID : 1548
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Spooler SubSystem App
Company : Microsoft Corporation
Window Title :
File Size : 57,856
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\system32\spoolsv.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:31
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4728 K
Mem Usage Peak : 4816 K
Page Faults : 1333
Pagefile Usage : 3248 K
Pagefile Peak Usage : 3556 K
File Attributes : A
==================================================
==================================================
Process Name : Explorer.EXE
ProcessID : 1796
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows Explorer
Company : Microsoft Corporation
Window Title : Programs
File Size : 1,029,632
File Created Date : 6/17/1425 21:56:12
File Modified Date : 6/17/1425 21:56:12
Filename : C:\WINDOWS\Explorer.EXE
Base Address : 0x01000000
Created On : 8/13/1429 03:23:33
Visible Windows : 3
Hidden Windows : 62
User Name : GUEST\ahc
Mem Usage : 34368 K
Mem Usage Peak : 38592 K
Page Faults : 119338
Pagefile Usage : 37972 K
Pagefile Peak Usage : 42576 K
File Attributes : A
==================================================
==================================================
Process Name : RTHDCPL.EXE
ProcessID : 1900
Priority : Normal
Product Name : Realtek HD Audio Sound Effect Manager
Version : 2.1.3.7
Description : Realtek HD Audio Control Panel
Company : Realtek Semiconductor Corp.
Window Title :
File Size : 16,132,608
File Created Date : 8/5/1429 15:48:40
File Modified Date : 6/26/1428 04:07:14
Filename : C:\WINDOWS\RTHDCPL.EXE
Base Address : 0x00400000
Created On : 8/13/1429 03:23:40
Visible Windows : 0
Hidden Windows : 53
User Name : GUEST\ahc
Mem Usage : 22668 K
Mem Usage Peak : 22668 K
Page Faults : 9040
Pagefile Usage : 20112 K
Pagefile Peak Usage : 20148 K
File Attributes : R
==================================================
==================================================
Process Name : egui.exe
ProcessID : 1948
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title :
File Size : 1,398,016
File Created Date : 12/12/1428 05:21:06
File Modified Date : 1/10/1428 11:46:46
Filename : C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 6324 K
Mem Usage Peak : 6528 K
Page Faults : 2541
Pagefile Usage : 1860 K
Pagefile Peak Usage : 2080 K
File Attributes : A
==================================================
==================================================
Process Name : FixCamera.exe
ProcessID : 1968
Priority : Normal
Product Name : CameraFixer Application
Version : 1, 0, 1, 1
Description : CameraFixer MFC Application
Company :
Window Title :
File Size : 20,480
File Created Date : 8/6/1429 03:16:22
File Modified Date : 6/26/1428 13:09:48
Filename : C:\WINDOWS\FixCamera.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 2676 K
Mem Usage Peak : 2768 K
Page Faults : 1505424
Pagefile Usage : 772 K
Pagefile Peak Usage : 836 K
File Attributes : A
==================================================
==================================================
Process Name : tsnpstd3.exe
ProcessID : 1976
Priority : Normal
Product Name : tsnp2std
Version : 1, 1, 5, 10
Description : tsnp2std Microsoft
Company :
Window Title :
File Size : 270,336
File Created Date : 8/6/1429 03:16:20
File Modified Date : 4/4/1428 06:37:02
Filename : C:\WINDOWS\tsnpstd3.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 4144 K
Mem Usage Peak : 4144 K
Page Faults : 1101
Pagefile Usage : 2432 K
Pagefile Peak Usage : 2432 K
File Attributes : A
==================================================
==================================================
Process Name : vsnpstd3.exe
ProcessID : 1984
Priority : Normal
Product Name : CameraMonitor Application
Version : 1, 1, 5, 11
Description : CameraMonitor Application
Company :
Window Title :
File Size : 835,584
File Created Date : 8/6/1429 03:16:20
File Modified Date : 4/23/1428 10:18:26
Filename : C:\WINDOWS\vsnpstd3.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 0
Hidden Windows : 2
User Name : GUEST\ahc
Mem Usage : 3064 K
Mem Usage Peak : 3064 K
Page Faults : 824
Pagefile Usage : 1008 K
Pagefile Peak Usage : 1008 K
File Attributes : A
==================================================
==================================================
Process Name : ClocX.exe
ProcessID : 1992
Priority : Low
Product Name : ClocX Application
Version : 1, 4, 2, 3
Description : ClocX
Company : BonSoft
Window Title : ClocX
File Size : 103,936
File Created Date : 2/23/1425 14:12:18
File Modified Date : 2/23/1425 14:12:18
Filename : C:\Program Files\ClocX\ClocX.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 1
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 3524 K
Mem Usage Peak : 3596 K
Page Faults : 50302
Pagefile Usage : 1280 K
Pagefile Peak Usage : 1348 K
File Attributes : A
==================================================
==================================================
Process Name : DrvIcon.exe
ProcessID : 2000
Priority : Low
Product Name : Vista Drive Icon
Version : 1.03.0123
Description : Changes "My Computer" drive icons to Windows Vista drive icons.
Company : artArmin
Window Title : DrvIcon
File Size : 45,056
File Created Date : 8/5/1429 23:40:07
File Modified Date : 6/19/1428 17:59:02
Filename : C:\Documents and Settings\ahc\My Documents\VistaDriveIcon\DrvIcon.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 1
Hidden Windows : 2
User Name : GUEST\ahc
Mem Usage : 3388 K
Mem Usage Peak : 3388 K
Page Faults : 860
Pagefile Usage : 1164 K
Pagefile Peak Usage : 1164 K
File Attributes : A
==================================================
==================================================
Process Name : UnlockerAssistant.exe
ProcessID : 2008
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title :
File Size : 15,872
File Created Date : 2/20/1429 16:33:24
File Modified Date : 2/20/1429 16:33:24
Filename : C:\Program Files\Unlocker\UnlockerAssistant.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:41
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 2116 K
Mem Usage Peak : 2116 K
Page Faults : 539
Pagefile Usage : 724 K
Pagefile Peak Usage : 724 K
File Attributes : A
==================================================
==================================================
Process Name : sdaemon.exe
ProcessID : 2020
Priority : Normal
Product Name : Tropical Software sdaemon
Version : 6.4
Description : sdaemon
Company : Tropical Software
Window Title :
File Size : 111,104
File Created Date : 3/10/1426 21:57:14
File Modified Date : 3/10/1426 21:57:14
Filename : C:\WINDOWS\sdaemon.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:42
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 2552 K
Mem Usage Peak : 2552 K
Page Faults : 665
Pagefile Usage : 868 K
Pagefile Peak Usage : 868 K
File Attributes : A
==================================================
==================================================
Process Name : GrooveMonitor.exe
ProcessID : 2028
Priority : Normal
Product Name : GrooveMonitor Utility
Version : 12.0.4518.1014
Description : GrooveMonitor Utility
Company : Microsoft Corporation
Window Title :
File Size : 31,016
File Created Date : 10/4/1427 21:47:42
File Modified Date : 10/4/1427 21:47:42
Filename : C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:42
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 6324 K
Mem Usage Peak : 6324 K
Page Faults : 1622
Pagefile Usage : 2848 K
Pagefile Peak Usage : 2848 K
File Attributes : A
==================================================
==================================================
Process Name : igfxpers.exe
ProcessID : 2040
Priority : Normal
Product Name : Intel(R) Common User Interface
Version : 6.14.10.4785
Description : persistence Module
Company : Intel Corporation
Window Title :
File Size : 131,072
File Created Date : 8/5/1429 15:44:53
File Modified Date : 6/26/1428 04:07:29
Filename : C:\WINDOWS\system32\igfxpers.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:42
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 3196 K
Mem Usage Peak : 3216 K
Page Faults : 820
Pagefile Usage : 1036 K
Pagefile Peak Usage : 1072 K
File Attributes : AR
==================================================
==================================================
Process Name : igfxtray.exe
ProcessID : 160
Priority : Normal
Product Name : Intel(R) Common User Interface
Version : 6.14.10.4785
Description : igfxTray Module
Company : Intel Corporation
Window Title :
File Size : 131,072
File Created Date : 8/5/1429 15:44:53
File Modified Date : 6/26/1428 04:07:33
Filename : C:\WINDOWS\system32\igfxtray.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:42
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 3500 K
Mem Usage Peak : 3512 K
Page Faults : 897
Pagefile Usage : 1096 K
Pagefile Peak Usage : 4276 K
File Attributes : AR
==================================================
==================================================
Process Name : hkcmd.exe
ProcessID : 164
Priority : Normal
Product Name : Intel(R) Common User Interface
Version : 6.14.10.4785
Description : hkcmd Module
Company : Intel Corporation
Window Title :
File Size : 155,648
File Created Date : 8/5/1429 15:44:53
File Modified Date : 6/26/1428 04:07:28
Filename : C:\WINDOWS\system32\hkcmd.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:42
Visible Windows : 0
Hidden Windows : 12
User Name : GUEST\ahc
Mem Usage : 3296 K
Mem Usage Peak : 3308 K
Page Faults : 846
Pagefile Usage : 1072 K
Pagefile Peak Usage : 1204 K
File Attributes : AR
==================================================
==================================================
Process Name : igfxsrvc.exe
ProcessID : 204
Priority : Normal
Product Name : Intel(R) Common User Interface
Version : 6.14.10.4785
Description : igfxsrvc Module
Company : Intel Corporation
Window Title :
File Size : 245,760
File Created Date : 8/5/1429 15:44:53
File Modified Date : 6/26/1428 04:07:32
Filename : C:\WINDOWS\system32\igfxsrvc.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:43
Visible Windows : 0
Hidden Windows : 0
User Name : GUEST\ahc
Mem Usage : 3524 K
Mem Usage Peak : 3548 K
Page Faults : 909
Pagefile Usage : 1348 K
Pagefile Peak Usage : 1388 K
File Attributes : AR
==================================================
==================================================
Process Name : realsched.exe
ProcessID : 208
Priority : Normal
Product Name : RealPlayer (32-bit)
Version : 0.1.0.4279
Description : RealNetworks Scheduler
Company : RealNetworks, Inc.
Window Title :
File Size : 185,896
File Created Date : 8/5/1429 17:04:38
File Modified Date : 8/5/1429 17:04:38
Filename : C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:43
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 224 K
Mem Usage Peak : 2616 K
Page Faults : 3883
Pagefile Usage : 1028 K
Pagefile Peak Usage : 1060 K
File Attributes : A
==================================================
==================================================
Process Name : ctfmon.exe
ProcessID : 432
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : CTF Loader
Company : Microsoft Corporation
Window Title :
File Size : 15,360
File Created Date : 6/17/1425 21:56:08
File Modified Date : 6/17/1425 21:56:08
Filename : C:\WINDOWS\system32\ctfmon.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:43
Visible Windows : 0
Hidden Windows : 4
User Name : GUEST\ahc
Mem Usage : 3148 K
Mem Usage Peak : 3148 K
Page Faults : 890
Pagefile Usage : 1008 K
Pagefile Peak Usage : 1012 K
File Attributes : A
==================================================
==================================================
Process Name : AvaFind.exe
ProcessID : 444
Priority : Normal
Product Name : Ava Find
Version : 1.5.0.218
Description : Ava Find
Company : Think Less Do More Services
Window Title :
File Size : 295,936
File Created Date : 11/14/1424 02:57:30
File Modified Date : 4/13/1425 09:48:04
Filename : C:\Program Files\AvaFind\AvaFind.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:44
Visible Windows : 0
Hidden Windows : 7
User Name : GUEST\ahc
Mem Usage : 4876 K
Mem Usage Peak : 12288 K
Page Faults : 59766
Pagefile Usage : 7360 K
Pagefile Peak Usage : 7496 K
File Attributes : A
==================================================
==================================================
Process Name : IDMan.exe
ProcessID : 472
Priority : Normal
Product Name : Internet Download Manager (IDM)
Version : 5.14.3.0
Description : Internet Download Manager (IDM)
Company : Tonec Inc.
Window Title :
File Size : 2,610,608
File Created Date : 7/26/1429 14:07:45
File Modified Date : 7/27/1429 11:16:58
Filename : C:\Program Files\Internet Download Manager\IDMan.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:44
Visible Windows : 0
Hidden Windows : 5
User Name : GUEST\ahc
Mem Usage : 11492 K
Mem Usage Peak : 11940 K
Page Faults : 5442
Pagefile Usage : 4720 K
Pagefile Peak Usage : 5212 K
File Attributes : A
==================================================
==================================================
Process Name : msmsgs.exe
ProcessID : 488
Priority : Normal
Product Name : Messenger
Version : 4.7.3000
Description : Windows Messenger
Company : Microsoft Corporation
Window Title :
File Size : 1,667,584
File Created Date : 8/5/1429 14:26:01
File Modified Date : 6/17/1425 22:09:14
Filename : C:\Program Files\Messenger\msmsgs.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:44
Visible Windows : 0
Hidden Windows : 6
User Name : GUEST\ahc
Mem Usage : 2024 K
Mem Usage Peak : 5228 K
Page Faults : 1807
Pagefile Usage : 1616 K
Pagefile Peak Usage : 1632 K
File Attributes :
==================================================
==================================================
Process Name : crypserv.exe
ProcessID : 344
Priority : High
Product Name : CrypKey Software Licensing System
Version : 5.2
Description : CrypKey NT Service
Company : Kenonic Controls Ltd.
Window Title :
File Size : 65,536
File Created Date : 8/5/1429 22:56:42
File Modified Date : 8/19/1423 02:17:54
Filename : C:\WINDOWS\system32\crypserv.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:45
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1860 K
Mem Usage Peak : 1860 K
Page Faults : 473
Pagefile Usage : 864 K
Pagefile Peak Usage : 864 K
File Attributes : A
==================================================
==================================================
Process Name : ekrn.exe
ProcessID : 1024
Priority : Normal
Product Name : ESET Smart Security
Version : 3.0.621
Description : Eset Service
Company : ESET
Window Title :
File Size : 468,224
File Created Date : 12/12/1428 05:21:16
File Modified Date : 12/12/1428 05:21:16
Filename : C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:55
Visible Windows : 0
Hidden Windows : 2
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 33180 K
Mem Usage Peak : 43600 K
Page Faults : 38851
Pagefile Usage : 29636 K
Pagefile Peak Usage : 62196 K
File Attributes :
==================================================
==================================================
Process Name : openvpnas.exe
ProcessID : 1056
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title :
File Size : 49,664
File Created Date : 11/27/1427 03:08:10
File Modified Date : 11/27/1427 03:08:10
Filename : C:\Program Files\Hotspot Shield\bin\openvpnas.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:23:55
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1696 K
Mem Usage Peak : 1696 K
Page Faults : 419
Pagefile Usage : 512 K
Pagefile Peak Usage : 512 K
File Attributes : A
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1096
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 6/17/1425 21:56:32
File Modified Date : 6/17/1425 21:56:32
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:56
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4628 K
Mem Usage Peak : 4684 K
Page Faults : 1249
Pagefile Usage : 2752 K
Pagefile Peak Usage : 2860 K
File Attributes : A
==================================================
==================================================
Process Name : wdfmgr.exe
ProcessID : 1148
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.2.3790.1230 built by: dnsrv(bld4act)
Description : Windows User Mode Driver Manager
Company : Microsoft Corporation
Window Title :
File Size : 38,912
File Created Date : 12/18/1425 10:44:28
File Modified Date : 12/18/1425 10:44:28
Filename : C:\WINDOWS\system32\wdfmgr.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:23:56
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 1748 K
Mem Usage Peak : 1764 K
Page Faults : 438
Pagefile Usage : 1608 K
Pagefile Peak Usage : 1640 K
File Attributes : A
==================================================
==================================================
Process Name : alg.exe
ProcessID : 2352
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Application Layer Gateway Service
Company : Microsoft Corporation
Window Title :
File Size : 44,544
File Created Date : 6/17/1425 21:56:04
File Modified Date : 6/17/1425 21:56:04
Filename : C:\WINDOWS\System32\alg.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:24:02
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 3460 K
Mem Usage Peak : 3480 K
Page Faults : 897
Pagefile Usage : 1244 K
Pagefile Peak Usage : 1276 K
File Attributes : A
==================================================
==================================================
Process Name : IEMonitor.exe
ProcessID : 2912
Priority : Normal
Product Name : IEMonitor Application
Version : 5, 12, 8, 0
Description : Internet Download Manager agent for click monitoring in IE-based browsers
Company : Tonec Inc.
Window Title :
File Size : 251,312
File Created Date : 7/26/1429 14:03:26
File Modified Date : 2/11/1429 13:01:01
Filename : C:\Program Files\Internet Download Manager\IEMonitor.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:24:05
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 4612 K
Mem Usage Peak : 4620 K
Page Faults : 1224
Pagefile Usage : 2628 K
Pagefile Peak Usage : 2628 K
File Attributes : A
==================================================
==================================================
Process Name : firefox.exe
ProcessID : 2452
Priority : Normal
Product Name : Firefox
Version : 1.8.1.16: 2008070205
Description : Firefox
Company : Mozilla Corporation
Window Title : اخواني تعطل عندي خصائص شرط ابدا شوفو لي حل - الصفحة 2 - زيزوووم للأمن والحمايه - موزيلا فايرفوكس
File Size : 7,667,312
File Created Date : 8/9/1429 01:18:36
File Modified Date : 6/28/1429 18:45:00
Filename : C:\Program Files\Mozilla Firefox\firefox.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:25:38
Visible Windows : 1
Hidden Windows : 48
User Name : GUEST\ahc
Mem Usage : 163788 K
Mem Usage Peak : 181184 K
Page Faults : 852068
Pagefile Usage : 150432 K
Pagefile Peak Usage : 169368 K
File Attributes : A
==================================================
==================================================
Process Name : HijackThis.exe
ProcessID : 3952
Priority : Normal
Product Name : HijackThis
Version : 2.00.0002
Description : HijackThis
Company : Trend Micro Inc.
Window Title : Trend Micro HijackThis - v2.0.2
File Size : 396,288
File Created Date : 8/6/1429 02:33:32
File Modified Date : 11/8/1428 16:50:46
Filename : C:\Documents and Settings\ahc\سطح المكتب\HijackThis.exe
Base Address : 0x00400000
Created On : 8/13/1429 03:43:50
Visible Windows : 2
Hidden Windows : 3
User Name : GUEST\ahc
Mem Usage : 2476 K
Mem Usage Peak : 12744 K
Page Faults : 9366
Pagefile Usage : 5168 K
Pagefile Peak Usage : 7092 K
File Attributes : A
==================================================
==================================================
Process Name : NOTEPAD.exe
ProcessID : 1804
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : المفكرة
Company : Microsoft Corporation
Window Title : hijackthis - المفكرة
File Size : 69,120
File Created Date : 6/17/1425 21:56:24
File Modified Date : 6/17/1425 21:56:24
Filename : C:\WINDOWS\system32\NOTEPAD.exe
Base Address : 0x01000000
Created On : 8/13/1429 03:45:22
Visible Windows : 1
Hidden Windows : 0
User Name : GUEST\ahc
Mem Usage : 500 K
Mem Usage Peak : 3964 K
Page Faults : 1122
Pagefile Usage : 1328 K
Pagefile Peak Usage : 1328 K
File Attributes : A
==================================================
==================================================
Process Name : runn.exe
ProcessID : 3040
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title :
File Size : 71,680
File Created Date : 8/13/1429 01:10:39
File Modified Date : 1/23/1429 22:24:25
Filename : C:\DOCUME~1\ahc\LOCALS~1\Temp\bntoz\runn.exe
Base Address : 0x00400000
Created On : 8/13/1429 04:10:39
Visible Windows : 0
Hidden Windows : 0
User Name : GUEST\ahc
Mem Usage : 1988 K
Mem Usage Peak : 2000 K
Page Faults : 566
Pagefile Usage : 676 K
Pagefile Peak Usage : 760 K
File Attributes : A
==================================================
==================================================
Process Name : cmd.exe
ProcessID : 3052
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : Windows Command Processor
Company : Microsoft Corporation
Window Title :
File Size : 388,608
File Created Date : 6/17/1425 21:56:06
File Modified Date : 6/17/1425 21:56:06
Filename : C:\WINDOWS\system32\cmd.exe
Base Address : 0x4AD00000
Created On : 8/13/1429 04:10:39
Visible Windows : 0
Hidden Windows : 1
User Name : GUEST\ahc
Mem Usage : 2784 K
Mem Usage Peak : 2852 K
Page Faults : 788
Pagefile Usage : 2076 K
Pagefile Peak Usage : 2152 K
File Attributes : A
==================================================
==================================================
Process Name : wmiprvse.exe
ProcessID : 1212
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Description : WMI
Company : Microsoft Corporation
Window Title :
File Size : 218,112
File Created Date : 8/5/1429 15:26:49
File Modified Date : 6/17/1425 21:56:36
Filename : C:\WINDOWS\system32\wbem\wmiprvse.exe
Base Address : 0x01000000
Created On : 8/13/1429 04:10:39
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 5492 K
Mem Usage Peak : 5492 K
Page Faults : 1400
Pagefile Usage : 2956 K
Pagefile Peak Usage : 2956 K
File Attributes : A
==================================================
==================================================
Process Name : CProcess.exe
ProcessID : 1220
Priority : Normal
Product Name : CurrProcess
Version : 1.11
Description : CurrProcess
Company : NirSoft
Window Title :
File Size : 35,840
File Created Date : 8/13/1429 01:10:38
File Modified Date : 6/8/1426 04:46:34
Filename : C:\DOCUME~1\ahc\LOCALS~1\Temp\bntoz\CProcess.exe
Base Address : 0x00400000
Created On : 8/13/1429 04:10:40
Visible Windows : 0
Hidden Windows : 0
User Name : GUEST\ahc
Mem Usage : 2032 K
Mem Usage Peak : 2092 K
Page Faults : 1002
Pagefile Usage : 904 K
Pagefile Peak Usage : 984 K
File Attributes : A
==================================================
.
.
--------------------------\\\ End Report Of Running Processes ---------------
.
.
.
.
--------------------------\\\ Windows XP Startup List ---------------
.
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
autocheck autochk *
autocheck autochk *
Auto Check Utility
Microsoft Corporation
5.01.2600.2180
c:\windows\system32\autochk.exe
HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
rdpclip
rdpclip
RDP Clip Monitor
Microsoft Corporation
5.01.2600.2180
c:\windows\system32\rdpclip.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
Userinit Logon Application
Microsoft Corporation
5.01.2600.2180
c:\windows\system32\userinit.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exe
Explorer.exe
Windows Explorer
Microsoft Corporation
6.00.2900.2180
c:\windows\explorer.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RTHDCPL
RTHDCPL.EXE
Realtek HD Audio Control Panel
Realtek Semiconductor Corp.
2.01.0003.0007
c:\windows\rthdcpl.exe
SkyTel
SkyTel.EXE
Realtek Voice Manager
Realtek Semiconductor Corp.
2.00.0001.0017
c:\windows\skytel.exe
egui
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
3.00.0566.0000
c:\program files\eset\eset nod32 antivirus\egui.exe
FixCamera
C:\WINDOWS\FixCamera.exe
CameraFixer MFC Application
1.00.0001.0001
c:\windows\fixcamera.exe
tsnpstd3
C:\WINDOWS\tsnpstd3.exe
tsnp2std Microsoft
1.01.0005.0010
c:\windows\tsnpstd3.exe
snpstd3
C:\WINDOWS\vsnpstd3.exe
CameraMonitor Application
1.01.0005.0011
c:\windows\vsnpstd3.exe
ClocX
C:\Program Files\ClocX\ClocX.exe
ClocX
BonSoft
1.04.0002.0003
c:\program files\clocx\clocx.exe
DrvIcon
C:\Documents and Settings\ahc\My Documents\VistaDriveIcon\DrvIcon.exe
Changes "My Computer" drive icons to Windows Vista drive icons.
artArmin
1.03.0000.0123
c:\documents and settings\ahc\my documents\vistadriveicon\drvicon.exe
UnlockerAssistant
"C:\Program Files\Unlocker\UnlockerAssistant.exe"
c:\program files\unlocker\unlockerassistant.exe
SDaemon
C:\WINDOWS\sdaemon.exe
sdaemon
Tropical Software
6.04.0000.0000
c:\windows\sdaemon.exe
GrooveMonitor
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
GrooveMonitor Utility
Microsoft Corporation
12.00.4518.1014
c:\program files\microsoft office\office12\groovemonitor.exe
Persistence
C:\WINDOWS\system32\igfxpers.exe
persistence Module
Intel Corporation
6.14.0010.4785
c:\windows\system32\igfxpers.exe
IgfxTray
C:\WINDOWS\system32\igfxtray.exe
igfxTray Module
Intel Corporation
6.14.0010.4785
c:\windows\system32\igfxtray.exe
HotKeysCmds
C:\WINDOWS\system32\hkcmd.exe
hkcmd Module
Intel Corporation
6.14.0010.4785
c:\windows\system32\hkcmd.exe
TkBellExe
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
RealNetworks Scheduler
RealNetworks, Inc.
0.01.0000.4279
c:\program files\common files\real\update_ob\realsched.exe
SWd
C:\WINDOWS\winwd.exe
File not found: C:\WINDOWS\winwd.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
CTF Loader
Microsoft Corporation
5.01.2600.2180
c:\windows\system32\ctfmon.exe
AvaFind
"C:\Program Files\AvaFind\AvaFind.exe" /minimized
Ava Find
Think Less Do More Services
1.05.0000.0218
c:\program files\avafind\avafind.exe
IDMan
C:\Program Files\Internet Download Manager\IDMan.exe /onboot
Internet Download Manager (IDM)
Tonec Inc.
5.14.0003.0000
c:\program files\internet download manager\idman.exe
MSMSGS
"C:\Program Files\Messenger\msmsgs.exe" /background
Windows Messenger
Microsoft Corporation
4.07.0000.3000
c:\program files\messenger\msmsgs.exe
Task Scheduler
1-Click Maintenance.job
C:\Program Files\TuneUp Utilities 2008\OneClick.exe /schedulestart
TuneUp 1-Click Maintenance
TuneUp Software GmbH
7.00.7991.0225
c:\program files\tuneup utilities 2008\oneclick.exe
AppleSoftwareUpdate.job
C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task
Software Application
Apple Computer, Inc.
1.00.0000.0007
c:\program files\apple software update\softwareupdate.exe
.
.
----------- End Report ---------------
:no: .png)
.png)
