Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:25 م, on 12/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Armor2net\Armor2net Personal 

Firewall\Armor2net.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\RFA\rfagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\RFA\reg1aid.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\الوندوز\برنامج الهايجاك\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet 

Explorer\Main,Default_Page_URL = 

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet 

Explorer\Main,Default_Search_URL = 

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 

http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: RealPlayer Download and Record Plugin for Internet 

Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program 

Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - 

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009

\ievkbd.dll
O2 - BHO: A2NPopUpKiller Class - {8A321C7D-9CED-45A8-870D-

DAE843A45FD0} - C:\Program Files\Armor2net\Armor2net Personal 

Firewall\PopUpKiller.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-

5164760863C6} - C:\Program Files\Common Files\Microsoft 

Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-

BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-

EABFE594F69C} - C:\Program Files\Java\jre6

\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program 

Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SMSERIAL] C:\Program 

Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program 

Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir 

PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Armor2net] C:\Program 

Files\Armor2net\Armor2net Personal Firewall\Armor2net.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common 

Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky 

Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!

\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [AFProg] C:\Program Files\Hotspot 

Shield\AnchorFree\ctrl\AFController.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32

\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32

\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32

\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32

\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - 

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: *** traffic protection statistics - {1F460357

-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky 

Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-

D9FCDDC9D600} - C:\Program Files\Windows 

Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - 

{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows 

Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-

0050045C3C96} - C:\Program Files\Yahoo!

\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-

11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!

\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-

00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-

11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program 

files\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program 

files\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program 

files\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program 

files\armor2net\armor2net personal firewall\netdog.dll
O10 - Unknown file in Winsock LSP: c:\program 

files\armor2net\armor2net personal firewall\netdog.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo 

Upload Tool) - 

http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WU***Control 

Class) - 

http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl

ient/wu***_site.cab?1238713295984
O16 - DPF: {B0067CA5-2C37-4C6B-AAEC-5E2CE8635061} (FontDown 

Class) - http://www.qurancomplex.com/Downloads/FontSmooth.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom 

Class) - 

http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.

cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave 

Flash Object) - 

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflas

h.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8803A67-C2AE-4142-9F7E

-3F4C66989D91}: NameServer = 212.119.64.2 212.119.64.3
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1

\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler 

(AntiVirScheduler) - Unknown owner - C:\Program 

Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file 

missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard 

(AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir 

PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: avp - Kaspersky Lab - C:\Program Files\Kaspersky 

Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - 

C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: خدمة تحديث Google (gupdate1c9b8801097a78e) 

(gupdate1c9b8801097a78e) - Google Inc. - C:\Program 

Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - 

Macrovision Corporation - C:\Program Files\Common 

Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun 

Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - 

TuneUp Software GmbH - C:\WINDOWS\System32

\TuneUpDefragService.exe
O24 - Desktop Component 1: (no name) - http://www.ta7a.com/

--
End of file - 8012 bytes