ما ظبطت اخي ابو ريما
مرفق تقريري حسب طلب الأخ ماكس
.
--------------------------\\\ Start Report Of HijackThis ---------------
.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:36 م, on 25/08/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\FSCapture.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bntoz\runn.exe
C:\WINDOWS\system32\cmd.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bntoz\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Privacy Suite] "C:\Documents and Settings\Administrator\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\Administrator\Application Data\CyberScrub\Privacy Suite"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: "إضافة إلى حاجب الدعايات" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: ShaPlus Google Translator - res://C:\Program Files\ShaPlus Google Translator\GoogleTranslator.dll/ie.htm
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Almyasystem - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} -
(file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
--
End of file - 5497 bytes
.
.
--------------------------\\\ End Report Of Of HijackThis ---------------
.
.
.
.
--------------------------\\\ Start Report Of Running Processes ---------------
.
==================================================
Process Name : smss.exe
ProcessID : 1040
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Windows NT Session Manager
Company : Microsoft Corporation
Window Title :
File Size : 50,688
File Created Date : 03/08/2004 11:56:30 م
File Modified Date : 14/04/2008 04:00:03 م
Filename : C:\WINDOWS\System32\smss.exe
Base Address : 0x48580000
Created On : 25/08/2008 10:35:26 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 388 K
Mem Usage Peak : 680 K
Page Faults : 298
Pagefile Usage : 172 K
Pagefile Peak Usage : 1664 K
File Attributes : AC
==================================================
==================================================
Process Name : csrss.exe
ProcessID : 1392
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Client Server Runtime Process
Company : Microsoft Corporation
Window Title :
File Size : 6,144
File Created Date : 03/08/2004 11:56:08 م
File Modified Date : 14/04/2008 03:59:49 م
Filename : C:\WINDOWS\system32\csrss.exe
Base Address : 0x4A680000
Created On : 25/08/2008 10:35:28 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4004 K
Mem Usage Peak : 4448 K
Page Faults : 4584
Pagefile Usage : 1804 K
Pagefile Peak Usage : 1804 K
File Attributes : AC
==================================================
==================================================
Process Name : winlogon.exe
ProcessID : 1416
Priority : High
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2113)
Description : Windows NT Logon Application
Company : Microsoft Corporation
Window Title :
File Size : 506,880
File Created Date : 03/08/2004 11:56:36 م
File Modified Date : 14/04/2008 04:00:06 م
Filename : C:\WINDOWS\system32\winlogon.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:30 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 1964 K
Mem Usage Peak : 12376 K
Page Faults : 6577
Pagefile Usage : 7092 K
Pagefile Peak Usage : 7524 K
File Attributes : AC
==================================================
==================================================
Process Name : services.exe
ProcessID : 1472
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Services and Controller app
Company : Microsoft Corporation
Window Title :
File Size : 108,544
File Created Date : 03/08/2004 11:56:30 م
File Modified Date : 14/04/2008 04:00:02 م
Filename : C:\WINDOWS\system32\services.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:33 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 4160 K
Mem Usage Peak : 4296 K
Page Faults : 1457
Pagefile Usage : 2336 K
Pagefile Peak Usage : 2580 K
File Attributes : AC
==================================================
==================================================
Process Name : lsass.exe
ProcessID : 1484
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2113)
Description : LSA Shell (Export Version)
Company : Microsoft Corporation
Window Title :
File Size : 13,312
File Created Date : 03/08/2004 11:56:18 م
File Modified Date : 14/04/2008 03:59:55 م
Filename : C:\WINDOWS\system32\lsass.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:33 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 6944 K
Mem Usage Peak : 7188 K
Page Faults : 2215
Pagefile Usage : 4596 K
Pagefile Peak Usage : 4896 K
File Attributes : AC
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1672
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 03/08/2004 11:56:32 م
File Modified Date : 14/04/2008 04:00:03 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:35 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 5108 K
Mem Usage Peak : 5156 K
Page Faults : 1387
Pagefile Usage : 3224 K
Pagefile Peak Usage : 23496 K
File Attributes : AC
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 1720
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 03/08/2004 11:56:32 م
File Modified Date : 14/04/2008 04:00:03 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:35 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 4572 K
Mem Usage Peak : 4572 K
Page Faults : 1280
Pagefile Usage : 2000 K
Pagefile Peak Usage : 2012 K
File Attributes : AC
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 176
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 03/08/2004 11:56:32 م
File Modified Date : 14/04/2008 04:00:03 م
Filename : C:\WINDOWS\System32\svchost.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:36 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 21932 K
Mem Usage Peak : 25492 K
Page Faults : 13229
Pagefile Usage : 14160 K
Pagefile Peak Usage : 17032 K
File Attributes : AC
==================================================
==================================================
Process Name : svchost.exe
ProcessID : 328
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Generic Host Process for Win32 Services
Company : Microsoft Corporation
Window Title :
File Size : 14,336
File Created Date : 03/08/2004 11:56:32 م
File Modified Date : 14/04/2008 04:00:03 م
Filename : C:\WINDOWS\system32\svchost.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:36 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 4764 K
Mem Usage Peak : 4764 K
Page Faults : 1249
Pagefile Usage : 1988 K
Pagefile Peak Usage : 1988 K
File Attributes : AC
==================================================
==================================================
Process Name : Explorer.EXE
ProcessID : 936
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 6.00.2900.5512 (xpsp.080413-2105)
Description : Windows Explorer
Company : Microsoft Corporation
Window Title : Programs
File Size : 1,031,168
File Created Date : 03/08/2004 11:56:12 م
File Modified Date : 14/04/2008 03:59:52 م
Filename : C:\WINDOWS\Explorer.EXE
Base Address : 0x01000000
Created On : 25/08/2008 10:35:38 م
Visible Windows : 3
Hidden Windows : 38
User Name : العالمية\Administrator
Mem Usage : 24872 K
Mem Usage Peak : 25236 K
Page Faults : 15632
Pagefile Usage : 16332 K
Pagefile Peak Usage : 16664 K
File Attributes : AC
==================================================
==================================================
Process Name : spoolsv.exe
ProcessID : 1000
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-0852)
Description : Spooler SubSystem App
Company : Microsoft Corporation
Window Title :
File Size : 57,856
File Created Date : 03/08/2004 11:56:32 م
File Modified Date : 14/04/2008 04:00:03 م
Filename : C:\WINDOWS\system32\spoolsv.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:35:39 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 5320 K
Mem Usage Peak : 5324 K
Page Faults : 1721
Pagefile Usage : 3556 K
Pagefile Peak Usage : 3656 K
File Attributes : AC
==================================================
==================================================
Process Name : guard.exe
ProcessID : 1112
Priority : Normal
Product Name : AVG Anti-Spyware
Version : 7, 5, 1, 22
Description : AVG Anti-Spyware guard
Company : GRISOFT s.r.o.
Window Title :
File Size : 312,880
File Created Date : 30/05/2007 12:31:10 م
File Modified Date : 30/05/2007 12:31:10 م
Filename : C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:35:40 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 19168 K
Mem Usage Peak : 49708 K
Page Faults : 71766
Pagefile Usage : 43024 K
Pagefile Peak Usage : 54332 K
File Attributes : AC
==================================================
==================================================
Process Name : avp.exe
ProcessID : 1264
Priority : Normal
Product Name : Kaspersky Anti-Virus
Version : 8.0.0.454
Description : Kaspersky Anti-Virus
Company : Kaspersky Lab
Window Title :
File Size : 206,088
File Created Date : 29/07/2008 05:20:28 م
File Modified Date : 29/07/2008 05:20:28 م
Filename : C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:35:42 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 55456 K
Mem Usage Peak : 114428 K
Page Faults : 114726
Pagefile Usage : 44404 K
Pagefile Peak Usage : 107028 K
File Attributes : AC
==================================================
==================================================
Process Name : avp.exe
ProcessID : 1432
Priority : Normal
Product Name : Kaspersky Anti-Virus
Version : 8.0.0.454
Description : Kaspersky Anti-Virus
Company : Kaspersky Lab
Window Title :
File Size : 206,088
File Created Date : 29/07/2008 05:20:28 م
File Modified Date : 29/07/2008 05:20:28 م
Filename : C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:35:45 م
Visible Windows : 0
Hidden Windows : 6
User Name : العالمية\Administrator
Mem Usage : 2112 K
Mem Usage Peak : 8196 K
Page Faults : 9010
Pagefile Usage : 5772 K
Pagefile Peak Usage : 6032 K
File Attributes : AC
==================================================
==================================================
Process Name : alg.exe
ProcessID : 2668
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-0852)
Description : Application Layer Gateway Service
Company : Microsoft Corporation
Window Title :
File Size : 44,544
File Created Date : 03/08/2004 11:56:04 م
File Modified Date : 14/04/2008 03:59:46 م
Filename : C:\WINDOWS\System32\alg.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:36:19 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 3904 K
Mem Usage Peak : 3912 K
Page Faults : 1016
Pagefile Usage : 1404 K
Pagefile Peak Usage : 1416 K
File Attributes : AC
==================================================
==================================================
Process Name : FSCapture.exe
ProcessID : 2760
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title : FastStone Capture
File Size : 1,123,840
File Created Date : 25/08/2008 07:36:18 م
File Modified Date : 24/05/2007 06:35:06 م
Filename : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\FSCapture.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:36:20 م
Visible Windows : 3
Hidden Windows : 12
User Name : العالمية\Administrator
Mem Usage : 6032 K
Mem Usage Peak : 7264 K
Page Faults : 3697
Pagefile Usage : 5024 K
Pagefile Peak Usage : 5160 K
File Attributes : AC
==================================================
==================================================
Process Name : iexplore.exe
ProcessID : 3632
Priority : Normal
Product Name : Windows® Internet Explorer
Version : 7.00.6000.16705 (vista_gdr.080618-1506)
Description : Internet Explorer
Company : Microsoft Corporation
Window Title : أداة المكنسة لزيزووم لاتعمل ؟؟؟؟ - زيزوووم للأمن والحمايه - Windows Internet Explorer
File Size : 625,664
File Created Date : 19/08/2008 01:04:53 م
File Modified Date : 23/06/2008 09:18:36 ص
Filename : C:\Program Files\Internet Explorer\iexplore.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:36:36 م
Visible Windows : 1
Hidden Windows : 26
User Name : العالمية\Administrator
Mem Usage : 19272 K
Mem Usage Peak : 40144 K
Page Faults : 19796
Pagefile Usage : 27852 K
Pagefile Peak Usage : 27960 K
File Attributes : AC
==================================================
==================================================
Process Name : ctfmon.exe
ProcessID : 3672
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2105)
Description : CTF Loader
Company : Microsoft Corporation
Window Title :
File Size : 15,360
File Created Date : 03/08/2004 11:56:08 م
File Modified Date : 14/04/2008 03:59:49 م
Filename : C:\WINDOWS\system32\ctfmon.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:36:37 م
Visible Windows : 0
Hidden Windows : 5
User Name : العالمية\Administrator
Mem Usage : 3468 K
Mem Usage Peak : 3672 K
Page Faults : 1066
Pagefile Usage : 1112 K
Pagefile Peak Usage : 1520 K
File Attributes : AC
==================================================
==================================================
Process Name : wuauclt.exe
ProcessID : 4044
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 7.2.6001.784 (winmain_oob/wu_wsuswlc(wmbla).080718-1904)
Description : Windows Update Automatic Updates
Company : Microsoft Corporation
Window Title :
File Size : 53,448
File Created Date : 20/08/2008 09:10:03 م
File Modified Date : 18/07/2008 07:10:42 م
Filename : C:\WINDOWS\system32\wuauclt.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:36:41 م
Visible Windows : 0
Hidden Windows : 0
User Name : NT AUTHORITY\SYSTEM
Mem Usage : 10216 K
Mem Usage Peak : 11044 K
Page Faults : 3383
Pagefile Usage : 7796 K
Pagefile Peak Usage : 8756 K
File Attributes : AC
==================================================
==================================================
Process Name : iexplore.exe
ProcessID : 2724
Priority : Normal
Product Name : Windows® Internet Explorer
Version : 7.00.6000.16705 (vista_gdr.080618-1506)
Description : Internet Explorer
Company : Microsoft Corporation
Window Title : HijackThis Logfileauswertung - Windows Internet Explorer
File Size : 625,664
File Created Date : 19/08/2008 01:04:53 م
File Modified Date : 23/06/2008 09:18:36 ص
Filename : C:\Program Files\Internet Explorer\iexplore.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:37:58 م
Visible Windows : 1
Hidden Windows : 25
User Name : العالمية\Administrator
Mem Usage : 15752 K
Mem Usage Peak : 28824 K
Page Faults : 14547
Pagefile Usage : 18632 K
Pagefile Peak Usage : 18808 K
File Attributes : AC
==================================================
==================================================
Process Name : runn.exe
ProcessID : 1872
Priority : Normal
Product Name :
Version :
Description :
Company :
Window Title :
File Size : 71,680
File Created Date : 25/08/2008 07:38:32 م
File Modified Date : 31/01/2008 10:24:25 م
Filename : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bntoz\runn.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:38:32 م
Visible Windows : 0
Hidden Windows : 0
User Name : العالمية\Administrator
Mem Usage : 2416 K
Mem Usage Peak : 2420 K
Page Faults : 707
Pagefile Usage : 840 K
Pagefile Peak Usage : 916 K
File Attributes : AC
==================================================
==================================================
Process Name : cmd.exe
ProcessID : 896
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2111)
Description : Windows Command Processor
Company : Microsoft Corporation
Window Title :
File Size : 389,120
File Created Date : 03/08/2004 11:56:06 م
File Modified Date : 14/04/2008 03:59:48 م
Filename : C:\WINDOWS\system32\cmd.exe
Base Address : 0x4AD00000
Created On : 25/08/2008 10:38:32 م
Visible Windows : 0
Hidden Windows : 1
User Name : العالمية\Administrator
Mem Usage : 3400 K
Mem Usage Peak : 3464 K
Page Faults : 953
Pagefile Usage : 2224 K
Pagefile Peak Usage : 2300 K
File Attributes : AC
==================================================
==================================================
Process Name : wmiprvse.exe
ProcessID : 2108
Priority : Normal
Product Name : Microsoft® Windows® Operating System
Version : 5.1.2600.5512 (xpsp.080413-2108)
Description : WMI
Company : Microsoft Corporation
Window Title :
File Size : 218,112
File Created Date : 20/08/2008 09:08:14 م
File Modified Date : 14/04/2008 04:00:06 م
Filename : C:\WINDOWS\system32\wbem\wmiprvse.exe
Base Address : 0x01000000
Created On : 25/08/2008 10:38:35 م
Visible Windows : 0
Hidden Windows : 0
User Name :
Mem Usage : 6392 K
Mem Usage Peak : 6392 K
Page Faults : 1639
Pagefile Usage : 3480 K
Pagefile Peak Usage : 3480 K
File Attributes : AC
==================================================
==================================================
Process Name : CProcess.exe
ProcessID : 1948
Priority : Normal
Product Name : CurrProcess
Version : 1.11
Description : CurrProcess
Company : NirSoft
Window Title :
File Size : 35,840
File Created Date : 25/08/2008 07:38:32 م
File Modified Date : 14/07/2005 04:46:34 ص
Filename : C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bntoz\CProcess.exe
Base Address : 0x00400000
Created On : 25/08/2008 10:38:36 م
Visible Windows : 0
Hidden Windows : 0
User Name : العالمية\Administrator
Mem Usage : 2436 K
Mem Usage Peak : 2448 K
Page Faults : 801
Pagefile Usage : 972 K
Pagefile Peak Usage : 972 K
File Attributes : AC
==================================================
.
.
--------------------------\\\ End Report Of Running Processes ---------------
.
.
.
.
--------------------------\\\ Windows XP Startup List ---------------
.
HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute
autocheck autochk *
autocheck autochk *
Auto Check Utility
Microsoft Corporation
5.01.2600.5512
c:\windows\system32\autochk.exe
HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms
rdpclip
rdpclip
RDP Clip Monitor
Microsoft Corporation
5.01.2600.5512
c:\windows\system32\rdpclip.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
Userinit Logon Application
Microsoft Corporation
5.01.2600.5512
c:\windows\system32\userinit.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
Explorer.exe
Explorer.exe
Windows Explorer
Microsoft Corporation
6.00.2900.5512
c:\windows\explorer.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVP
"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
Kaspersky Anti-Virus
Kaspersky Lab
8.00.0000.0454
c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
CTF Loader
Microsoft Corporation
5.01.2600.5512
c:\windows\system32\ctfmon.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
Privacy Suite
"C:\Documents and Settings\Administrator\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\Administrator\Application Data\CyberScrub\Privacy Suite"
Privacy Suite (TM)
CyberScrub LLC
4.07.0000.0139
c:\documents and settings\administrator\application data\cleaner\cspseraser.exe
.
.
----------- End Report ---------------
k: