تقرير الاداة
ComboFix 09-06-11.06 - vista 06/12/2009 17:04.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1256.966.1025.18.894.250 [GMT 3:00]
Running from: c:\users\vista\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Internet Security *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\winitn.dll
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2009-05-12 to 2009-06-12 )))))))))))))))))))))))))))))))
.
2009-06-10 18:04 . 2009-04-24 16:22 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-10 18:00 . 2009-04-21 12:04 2028032 ----a-w- c:\windows\system32\win32k.sys
2009-06-10 18:00 . 2009-04-23 12:56 696832 ----a-w- c:\windows\system32\localspl.dll
2009-06-10 18:00 . 2009-04-23 13:01 788992 ----a-w- c:\windows\system32\rpcrt4.dll
2009-05-25 12:07 . 2007-08-31 01:20 192000 ----a-w- c:\windows\system32\drivers\usbhub.sys
2009-05-25 12:07 . 2007-08-31 01:20 73216 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-05-25 12:07 . 2007-08-31 01:20 224768 ----a-w- c:\windows\system32\drivers\usbport.sys
2009-05-25 12:07 . 2007-08-31 02:16 8704 ----a-w- c:\windows\system32\hcrstco.dll
2009-05-25 12:07 . 2007-08-31 01:20 19456 ----a-w- c:\windows\system32\drivers\usbohci.sys
2009-05-25 12:07 . 2007-08-31 01:19 38400 ----a-w- c:\windows\system32\drivers\usbehci.sys
2009-05-25 12:07 . 2007-08-31 01:19 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2009-05-25 12:03 . 2007-12-16 22:50 1060920 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-05-25 12:03 . 2007-12-16 09:56 41984 ----a-w- c:\windows\system32\drivers\monitor.sys
2009-05-25 12:03 . 2008-10-22 03:43 95232 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-05-25 12:03 . 2008-10-22 03:43 241152 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-05-25 12:03 . 2008-10-22 03:43 160768 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-05-25 12:03 . 2007-10-26 11:14 211000 ----a-w- c:\windows\system32\drivers\volsnap.sys
2009-05-25 12:03 . 2008-01-19 05:08 109624 ----a-w- c:\windows\system32\drivers\ataport.sys
2009-05-25 12:03 . 2008-01-19 05:07 45112 ----a-w- c:\windows\system32\drivers\pciidex.sys
2009-05-25 12:03 . 2008-01-19 05:06 21560 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-05-25 12:03 . 2008-01-19 05:06 15928 ----a-w- c:\windows\system32\drivers\pciide.sys
2009-05-25 12:03 . 2008-01-19 03:06 154624 ----a-w- c:\windows\system32\drivers\nwifi.sys
2009-05-25 12:02 . 2007-06-21 02:15 223232 ----a-w- c:\windows\system32\SLC.dll
2009-05-25 12:02 . 2007-06-21 02:12 2605568 ----a-w- c:\windows\system32\SLsvc.exe
2009-05-25 12:02 . 2007-06-21 02:15 57856 ----a-w- c:\windows\system32\SLUINotify.dll
2009-05-25 12:02 . 2007-06-21 02:15 566784 ----a-w- c:\windows\system32\SLCommDlg.dll
2009-05-25 12:02 . 2007-06-21 02:15 33280 ----a-w- c:\windows\system32\slwmi.dll
2009-05-25 12:02 . 2007-06-21 02:15 39936 ----a-w- c:\windows\system32\slcinst.dll
2009-05-25 12:02 . 2007-06-21 02:12 351232 ----a-w- c:\windows\system32\SLUI.exe
2009-05-25 12:02 . 2007-06-21 02:12 186368 ----a-w- c:\windows\system32\SLLUA.exe
2009-05-25 12:02 . 2007-06-21 02:12 268288 ----a-w- c:\windows\system32\mcbuilder.exe
2009-05-25 12:01 . 2008-08-28 03:24 712192 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-05-25 12:01 . 2008-08-28 03:24 347136 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-05-25 12:01 . 2008-08-28 03:24 425472 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-05-25 12:00 . 2008-11-27 04:42 269824 ----a-w- c:\windows\system32\schannel.dll
2009-05-25 12:00 . 2006-12-20 06:03 229888 ----a-w- c:\windows\system32\msshsq.dll
2009-05-17 19:42 . 2009-05-17 19:42 -------- d-----w- c:\users\vista\AppData\Roaming\Uniblue
2009-05-17 19:42 . 2008-12-22 08:53 2567617 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\Uniblue RegistryBooster.exe
2009-05-17 19:41 . 2009-05-17 19:41 -------- d-----w- c:\program files\Uniblue
2009-05-17 19:41 . 2008-08-26 16:48 497496 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\AF01B0B\6383BC9B\XceedZip.dll
2009-05-17 19:41 . 2008-08-26 16:48 413696 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\52CD59C9\6383BC9B\update.dll
2009-05-17 19:41 . 2008-08-26 16:48 99624 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\7390E4F0\6383BC9B\StartRegistryBooster.exe
2009-05-17 19:41 . 2008-08-26 16:48 757760 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\2B86F085\6383BC9B\UBVarRB.dll
2009-05-17 19:41 . 2008-08-26 16:48 6676480 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\4E45A1A4\6383BC9B\RegistryBooster.dll
2009-05-17 19:41 . 2008-08-26 16:48 2019624 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\7CE1607E\6383BC9B\RegistryBooster.exe
2009-05-17 19:41 . 2008-08-26 16:48 111912 -c--a-w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}\registrybooster2\65B92A91\6383BC9B\KillRBProcess.exe
2009-05-17 19:40 . 2009-05-17 19:42 -------- dc-h--w- c:\programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-12 01:45 . 2009-02-19 22:44 -------- d-----w- c:\programdata\Kaspersky Lab
2009-06-11 23:42 . 2006-12-05 05:23 81136 ----a-w- c:\windows\system32\perfc001.dat
2009-06-11 23:42 . 2006-12-05 05:23 460662 ----a-w- c:\windows\system32\perfh001.dat
2009-06-11 05:12 . 2009-02-20 00:29 540704 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-11 05:12 . 2009-02-20 00:29 5024 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-11 05:12 . 2009-02-20 00:29 36636 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-11 05:12 . 2009-02-20 00:29 4282912 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-09 13:32 . 2009-03-21 21:50 7268 ----a-w- c:\users\vista\AppData\Local\d3d9caps.dat
2009-05-26 20:30 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-05-26 20:30 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-05-26 20:30 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-26 20:30 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-05-24 22:05 . 2009-02-20 00:31 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-24 22:05 . 2009-02-20 00:31 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-05 15:00 . 2009-02-15 15:04 -------- d-----w- c:\users\vista\AppData\Roaming\Free Download Manager
2009-04-24 16:14 . 2009-06-10 18:03 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-04-24 16:14 . 2009-06-10 18:03 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 16:11 . 2009-06-10 18:03 72704 ----a-w- c:\windows\system32\admparse.dll
2009-04-24 13:53 . 2009-06-10 18:03 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-04-24 12:25 . 2009-06-10 18:03 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-04-20 23:13 . 2009-02-14 19:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-03-17 19:57 . 2009-03-17 19:57 823296 ----a-w- c:\windows\system32\agsaamh.dll
2009-03-17 19:57 . 2009-03-17 19:57 680061 ----a-w- c:\windows\system32\agsaame.dll
2009-03-17 19:57 . 2009-03-17 19:57 655360 ----a-w- c:\windows\system32\agsaamd.dll
2009-03-17 19:57 . 2009-03-17 19:57 638976 ----a-w- c:\windows\system32\agsaamb.dll
2009-03-17 19:57 . 2009-03-17 19:57 196608 ----a-w- c:\windows\system32\agsaamc.dll
2009-03-17 19:57 . 2009-03-17 19:57 1839104 ----a-w- c:\windows\system32\agsaamg.dll
2009-03-17 19:57 . 2009-03-17 19:57 315392 ----a-w- c:\windows\system32\agsaama.dll
2009-03-17 19:57 . 2003-08-07 11:01 237568 ----a-w- c:\windows\system32\lame_enc.dll
2009-03-17 03:16 . 2009-05-25 12:04 14848 ----a-w- c:\windows\system32\apilogen.dll
2009-03-17 03:16 . 2009-05-25 12:04 25600 ----a-w- c:\windows\system32\amxread.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-08-16 5728112]
"Uniblue RegistryBooster 2009"="c:\program files\uniblue\registrybooster\StartRegistryBooster.exe" [2008-08-26 99624]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [2007-09-28 247088]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-29 894248]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-15 136600]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-15 185896]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-02-20 206088]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-09-19 4702208]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-08-03 1826816]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-2-15 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\adialhk.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DB5634CA-D20B-4ED2-960C-738D2B4724B1}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{EBBB2BA9-91B5-4EB0-A08B-4CA2E0A1AB7E}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{54E80C05-9660-492C-85DA-8994F267138C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9BC48865-F3D1-4549-92C7-75E3BA13F7D8}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{4EBCC5B6-568D-4A81-A1D5-EA3321087400}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{EE0C7FDA-84FF-4100-BCF2-54730F3DC5C3}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [29/01/08 05:29 م 33808]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [09/07/08 05:28 م 20496]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\System32\drivers\klfltdev.sys [13/03/08 06:02 م 26640]
R3 US30Kbd;US30Kbd;c:\windows\System32\drivers\US30Kbd2K.sys [04/09/08 06:18 م 9216]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Device Detector - DevDetect.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = socks=
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الفيديو بواسطة Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: تحميل الكل بواسطة Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: تحميل المحددة بواسطة Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: تحميل بواسطة Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} - hxxp://98.126.41.66:1999/ReadUid.CAB
FF - ProfilePath - c:\users\vista\AppData\Roaming\Mozilla\Firefox\Profiles\pg2vnrm4.default\
---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
FF - user.js: network.proxy.http_port - 0
FF - user.js: network.proxy.ssl -
FF - user.js: network.proxy.ssl_port - 0
FF - user.js: network.proxy.ftp -
FF - user.js: network.proxy.ftp_port - 0
FF - user.js: network.proxy.gopher -
FF - user.js: network.proxy.gopher_port - 0
FF - user.js: network.proxy.socks_version - 5
FF - user.js: network.proxy.socks -
FF - user.js: network.proxy.socks_port - 0
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-06-12 17:10
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-06-12 17:14
ComboFix-quarantined-files.txt 2009-06-12 14:14
Pre-Run: 27,493,613,568 bytes free
Post-Run: 27,560,841,216 bytes free
196 --- E O F --- 2009-06-11 05:06
تقررير الهايجاك .. وجاتني نفس الرسالة
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:33:03 م, on 12/06/09
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16851)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\lg_swupdate\GiljabiStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Users\vista\Desktop\HiJackThis(2).exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\vista\Downloads\HiJackThis(2).exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\StartRegistryBooster.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الفيديو بواسطة Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: تحميل الكل بواسطة Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: تحميل المحددة بواسطة Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: تحميل بواسطة Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) -
O16 - DPF: {B7FDB0C3-4724-46D2-B8DB-6FA1DC63F7CA} (ReadUid.UserControlMacEntry) -
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: US30Service - Unknown owner - C:\Program Files\Universal Shield 4.2\US30Service.exe
--
End of file - 6507 bytes
