تقرير خاص فقط للاخ الغالي بوب

ComboFix 08-09-27.01 - badr 09/28/2008 5:10:02.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.676 [GMT 3:00]
Running from: F:\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-28 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))) ))))))))))))
.
2008-09-27 20:34 --------- d-----w C:\Documents and Settings\badr\Application Data\uTorrent
2008-09-27 20:00 --------- d-----w C:\Documents and Settings\badr\Application Data\Media Player Classic
2008-09-27 19:59 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-27 07:14 --------- d-----w C:\Program Files\ESET
2008-09-27 03:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-27 03:02 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-27 03:02 --------- d-----w C:\Program Files\Google
2008-09-27 03:01 --------- d-----w C:\Program Files\phoneboob
2008-09-27 03:01 --------- d-----w C:\Documents and Settings\badr\Application Data\SiteAdvisor
2008-09-27 03:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Poke admin tons bike
2008-09-27 03:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\F-Secure
2008-09-27 03:00 --------- d-----w C:\Program Files\uTorrent
2008-09-27 03:00 --------- d-----w C:\Program Files\QuickTime
2008-09-27 03:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-09-27 03:00 --------- d-----w C:\Program Files\K-Lite Codec Pack(2)
2008-09-27 03:00 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-27 03:00 --------- d-----w C:\Program Files\Avant Browser(2)
2008-09-27 03:00 --------- d-----w C:\Program Files\Avant Browser
2008-09-27 03:00 --------- d-----w C:\Program Files\Adobe(2)
2008-09-27 03:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab(2)
2008-09-27 03:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2008-09-27 02:59 --------- d-----w C:\Program Files\URUSoft
2008-09-27 02:56 --------- d-----w C:\Program Files\AwalNet Toolbar
2008-09-27 02:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-09-27 02:54 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-27 02:54 --------- d-----w C:\Program Files\Circle Developement
2008-09-27 02:54 --------- d-----w C:\Documents and Settings\badr\Application Data\phoneboob
2008-09-27 02:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-09-26 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-09-26 02:34 --------- d-----w C:\Program Files\Dell
2008-09-26 00:39 --------- d-----w C:\Documents and Settings\badr\Application Data\Orbit
2008-09-26 00:34 --------- d-----w C:\Program Files\BitComet
2008-09-25 16:10 --------- d-----w C:\Documents and Settings\badr\Application Data\Media Player Classic(2)
2008-09-14 23:37 --------- d-----w C:\Documents and Settings\badr\Application Data\vlc
2008-09-14 23:36 --------- d-----w C:\Program Files\VideoLAN
2008-09-13 08:12 --------- d-----w C:\Program Files\Softwin
2008-09-13 08:12 --------- d-----w C:\Program Files\Common Files\Softwin
2008-09-13 07:00 --------- d-----w C:\Documents and Settings\badr\Application Data\ESET
2008-09-13 06:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-09-12 21:39 --------- d-----w C:\Program Files\Windows Live
2008-09-12 21:18 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-12 21:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-12 20:32 --------- d-----w C:\Documents and Settings\badr\Application Data\F-Secure
2008-09-12 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
2008-09-12 18:48 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-09-12 18:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-09-12 18:47 --------- d-----w C:\Program Files\Symantec
2008-09-12 04:36 --------- d-----w C:\Documents and Settings\badr\Application Data\Vso
2008-09-12 04:35 81,920 ----a-w C:\Documents and Settings\badr\Application Data\ezpinst.exe
2008-09-12 04:35 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-09-12 04:35 47,360 ----a-w C:\Documents and Settings\badr\Application Data\pcouffin.sys
2008-09-11 18:45 --------- d-----w C:\Program Files\Java
2008-09-09 18:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Hagel Technologies
2008-09-09 02:58 --------- d-----w C:\Program Files\CyberLink
2008-09-09 02:54 --------- d-----w C:\Documents and Settings\badr\Application Data\Ahead
2008-09-08 21:40 --------- d-----w C:\Program Files\Sun
2008-09-08 20:53 --------- d-----w C:\Program Files\Opera 9.5 beta
2008-09-08 08:04 --------- d-sh--r C:\Program Files\MSNCS
2008-09-07 22:59 --------- d-----w C:\Documents and Settings\badr\Application Data\Avant Profiles
2008-09-07 01:10 --------- d-----w C:\Documents and Settings\badr\Application Data\McAfee
2008-09-05 20:17 131,584 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2008-09-05 20:15 3,676,322 ----a-w C:\WINDOWS\java\Packages\20O73VR9.ZIP
2008-09-05 16:25 --------- d-----w C:\Documents and Settings\badr\Application Data\Apple Computer
2008-09-05 14:49 --------- d-----w C:\Documents and Settings\badr\Application Data\DivX
2008-09-05 03:52 --------- d-----w C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-09-05 00:17 --------- d-----w C:\Program Files\Alwil Software
2008-09-04 23:43 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IDM
2008-09-04 22:20 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DMCache
2008-09-04 21:48 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Ahead
2008-09-04 21:43 --------- d-----w C:\Program Files\Internet Download Manager
2008-09-04 21:16 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DivX
2008-09-04 04:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-09-03 23:40 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SACore
2008-09-03 21:44 155,995 ----a-w C:\WINDOWS\java\Packages\2TBRDFVH.ZIP
2008-09-03 20:46 --------- d-----w C:\Program Files\AskTBar
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

((((((((((((((((((((((((((((( snapshot_Sat 09-27-2008_22.48.59.62 )))))))))))))))))))))))))))))))))))))))) )
.
- 2008-09-27 16:51:16 136,146 ----a-w C:\WINDOWS\system32\perfc001.dat
+ 2008-09-28 02:11:32 137,026 ----a-w C:\WINDOWS\system32\perfc001.dat
- 2008-09-27 16:51:16 37,114 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-09-28 02:11:32 37,114 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-09-27 16:51:16 426,756 ----a-w C:\WINDOWS\system32\perfh001.dat
+ 2008-09-28 02:11:32 428,232 ----a-w C:\WINDOWS\system32\perfh001.dat
- 2008-09-27 16:51:16 298,044 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-09-28 02:11:32 298,044 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))) ))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Win dows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon .exe" [08/04/2004 12:56 AM 15360]
"Google Update"="C:\Documents and Settings\badr\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [09/07/2008 08:24 PM 133104]
"Date Loud"="C:\DOCUME~1\badr\APPLIC~1\PHONEB~ 1\Memo Plan.exe" [09/26/2008 08:47 PM 648192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi ndows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray .exe" [11/15/2007 02:33 PM 141848]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd .exe" [11/15/2007 02:32 PM 166424]
"Persistence"="C:\WINDOWS\system32\igfxp ers.exe" [11/15/2007 02:33 PM 137752]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [05/10/2007 10:22 AM 405504]
"OEM02Mon.exe"="C:\WINDOWS\OEM02Mon. exe" [05/10/2007 11:01 AM 36864]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/25/2008 12:57 AM 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [02/25/2008 12:56 AM 155648]
"tons bike intra poll"="C:\Documents and Settings\All Users\Application Data\Poke admin tons bike\Bags Help.exe" [09/28/2008 05:07 AM 685568]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [02/20/2008 11:06 AM 1443072]
"BluetoothAuthenticationAgent"="bthprops .cpl" [08/04/2004 12:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\W indows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON .EXE" [08/04/2004 12:56 AM 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\wi ndows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\BgMonitor_{796 62E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
--a------ 10/09/2007 07:17 PM 2183168 C:\WINDOWS\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 12:56 AM 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\Dell QuickSet]
--a------ 07/03/2007 01:57 PM 1228800 C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\HotKeysCmds]
-ra------ 11/15/2007 02:32 PM 166424 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\IgfxTray]
-ra------ 11/15/2007 02:33 PM 141848 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\LanguageShortc ut]
C:\Program Files\CyberLink\PowerDVD\Language\Langua ge.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\NeroFilterChec k]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\OEM02Mon.exe]
-ra------ 05/10/2007 11:01 AM 36864 C:\WINDOWS\OEM02Mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\Persistence]
-ra------ 11/15/2007 02:33 PM 137752 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\QuickTime Task]
--a------ 02/25/2008 12:56 AM 155648 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\SigmatelSysTra yApp]
--a------ 05/10/2007 10:22 AM 405504 C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\startupreg\TkBellExe]
--a------ 02/25/2008 12:57 AM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\sh ared tools\msconfig\services]
"wltrysvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\ firewallpolicy\standardprofile\Authorize dApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.321\\English\\setup.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DR IVERS\epfwtdir.sys [02/20/2008 11:11 AM 33800]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;C:\WINDOWS\system32\drivers\Intc Hdmi.sys [05/04/2007 11:00 PM 105984]
R3 OEM02Afx;Provides a software interface to control audio effects of OEM002 camera.;C:\WINDOWS\system32\Drivers\OEM0 2Afx.sys [06/08/2007 11:00 AM 141376]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\WINDOWS\system32\DRIVERS\OEM02 Dev.sys [07/18/2007 11:02 AM 235520]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\WINDOWS\system32\DRIVERS\OEM02 Vfx.sys [03/06/2007 04:45 AM 7424]
S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [09/19/2001 03:00 PM 3584]
.
*******s of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\badr\Application Data\Mozilla\Firefox\Profiles\mtnxprrj.d efault\
.

**************************************** **********************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 05:11:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************** **********************************
.
Completion time: 09/28/2008 5:12:50
ComboFix-quarantined-files.txt 2008-09-28 02:12:42
ComboFix2.txt 2008-09-27 19:49:22
ComboFix3.txt 2008-09-09 20:49:34
ComboFix4.txt 2008-09-07 02:26:03

Pre-Run: 28,686,745,600 bytes free
Post-Run: 28,677,910,528 bytes free

203 --- E O F --- 2008-09-27 00:04:04


........................................ ........................................ ......................

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:13:32 ص, on 28/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\WINDOWS\OEM02Mon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\badr\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\CF4367.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
F:\HijackThis2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper .dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplu gin.dll
O2 - BHO: (no ****) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no ****) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\WINDOWS\OEM02Mon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAge nt
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [tons bike intra poll] C:\Documents and Settings\All Users\Application Data\Poke admin tons bike\Bags Help.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\badr\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Date Loud] C:\DOCUME~1\badr\APPLIC~1\PHONEB~1\Memo Plan.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Interne t Explorer\Control Panel present
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: ANB Direct - http://www.anb.com.sa/arabic/onlinebanking/classes.cab
O16 - DPF: {630F2610-7654-11D1-83E3-0080C71A8794} (ANB Direct) - http://www.anb.com.sa/arabic/onlinebanking/anb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1220638450343
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe

--
End of file - 5297 bytes