مشكلتي مع البلاس في المسنجر

طيب اختي مسحي النك نيم مع الرسالة الشخصية

كتبي في النك نيم اي شي سهل او حطي نقطه بس

بعدها نصبي البلاس وشوفي الوضع​

 

لا انا عملتها توقعت منه لكن مو منه خلاص مو مهم طفشت منه ماراح انصب البلاس وامري لله

مشكووور اخوي فارس ع وقفتك معي وربي ماقصرت يالذيب

 

العفو اختي

وعذرا ماقدرت افيدك بشي​

 

:er: والـــــ ح ـــل طفشني هالـبلاس

 

اختي ممكن تقولين لنا متى اول مرة واجهتي هالمشكلة

وايش البرامج الي ثبتيها قبل خروج المشكلة​

 

من شهر تقريبـــا وبالنسبـه للبرامـج مانصبت اي برنامج غير معروف

 

اختي عطلي برنامج الحماية قبل تنزيل الاداة​

(1)
عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب​

http://download.bleepingcomputer.com/sUBs/ComboFix.exe​

[/B]

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
(2)
واعمل تقرير للهايجاك
http://www.zyzoom.net/soft/security/...HijackThis.exe
اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم​

​

 

:er: عملت امس وبنفس الموضوع

 

ادري اختي بس في جهازك ملفات ضارة ولازم تشغليها الحين​

بس مثل ماقلت لك لازم تعطلين برنامج الحماية اول شي ونزلي الاداة من جديد​

 

اختي برنامج k-lite codec pack اي اصدار الي مثبتته انتي​

 

6.4.9.1

 

طيب الحين طبقي الخطوات الي قلت لك في المشاركة السابقة​

 

صبر ابحمل الاداه اللي عطيتني واجرب

 

في انتظارك​

 

ComboFix 08-08-14.02 - o0oNOOONEo0o 08/15/2008 8:04:14.2 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.55 [GMT 3:00] Running from: C:\Documents and Settings\o0oNOOONEo0o\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\npptools.dll . ((((((((((((((((((((((((( Files Created from 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-14 21:37 354,560 ----a-w C:\WINDOWS\system32\TuneUpDefragService.exe 2008-08-14 19:37 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-08-14 19:32 --------- d-----w C:\Program Files\Your Uninstaller 2008 2008-08-14 19:32 --------- d-----w C:\Documents and Settings\o0oNOOONEo0o\Application Data\URSoft 2008-08-14 19:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-14 06:47 --------- d-----w C:\Program Files\MSN Messenger 2008-08-13 16:38 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-13 04:37 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-13 04:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-08-08 15:28 --------- d-----w C:\Program Files\MultiTranse 2008-07-21 22:05 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll 2008-07-21 22:05 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll 2008-07-21 22:05 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll 2008-07-21 22:05 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll 2008-07-21 22:05 196,608 ----a-w C:\WINDOWS\system32\maag.dll 2008-07-21 22:05 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll 2008-07-21 22:05 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll 2008-07-21 22:05 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll 2008-07-21 22:05 --------- d-----w C:\Program Files\Real_SC 2008-07-20 04:17 --------- d-----w C:\Program Files\SWiSHmax 2008-07-20 01:09 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-07-19 22:32 --------- d-----w C:\Program Files\No-IP 2008-07-19 07:29 --------- d-----w C:\Documents and Settings\o0oNOOONEo0o\Application Data\U3 2008-07-19 04:28 --------- d-----w C:\Documents and Settings\o0oNOOONEo0o\Application Data\TeamViewer 2008-07-15 04:47 --------- d-----w C:\Program Files\DynGate 2008-07-15 04:46 --------- d-----w C:\Program Files\TeamViewer 2008-07-15 03:28 --------- d-----w C:\Program Files\Common Files\xing shared 2008-07-15 02:31 --------- d-----w C:\Program Files\Mobiola Web Camera for S60 3Ed 2008-07-13 19:32 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-12 16:08 --------- d-----w C:\Program Files\TuneUp Utilities 2008 2008-07-12 16:08 --------- d-----w C:\Documents and Settings\o0oNOOONEo0o\Application Data\TuneUp Software 2008-07-12 16:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-07-11 17:40 --------- d-----w C:\Program Files\Alwil Software 2008-07-11 17:16 --------- d-----w C:\Program Files\AAQ 2008-07-11 17:14 --------- d-----w C:\Program Files\TechSmith 2008-07-11 17:14 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-07-11 17:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\TechSmith 2008-07-11 17:06 --------- d-----w C:\Program Files\Foxit Software 2008-07-11 17:06 --------- d-----w C:\Program Files\ADSoft 2008-07-11 17:06 --------- d-----w C:\Documents and Settings\o0oNOOONEo0o\Application Data\ADSoft 2008-07-11 17:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\ADSoft 2008-07-11 15:39 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-07-11 15:39 --------- d-----w C:\Documents and Settings\o0oNOOONEo0o\Application Data\Media Player Classic 2008-07-11 05:27 --------- d-----w C:\Program Files\Windows Live 2008-07-11 05:22 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-07-11 05:22 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-07-11 05:22 --------- d-----w C:\Program Files\Real 2008-07-11 05:22 --------- d-----w C:\Program Files\Common Files\Real 2008-07-11 05:17 --------- d-----w C:\Program Files\Texas Instruments Inc 2008-07-11 05:16 --------- d-----w C:\Program Files\Synaptics 2008-07-11 05:16 --------- d-----w C:\Program Files\HPQ 2008-07-11 05:14 --------- d-----w C:\Program Files\Intel 2008-07-11 05:12 --------- d-----w C:\Program Files\Analog Devices 2008-07-11 05:11 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-11 05:11 --------- d-----w C:\Program Files\Hewlett-Packard 2008-07-11 05:09 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-11 05:07 --------- d-----w C:\Program Files\Broadcom . ------- Sigcheck ------- 09/09/2006 01:02 AM 2198144 ba08992ecfb4b23b9204add12ab385ea C:\WINDOWS\system32\ntkrnlpa.exe 02/28/2007 01:15 AM 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2QFE\ntkrnlpa.exe 02/28/2007 11:38 AM 2057600 515d30e2c90a3665a2739309334c9283 C:\WINDOWS\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2GDR\ntkrnlpa.exe 09/08/2006 11:01 PM 2321024 ef63859e4fd9cb3ec31a111481f4b1b6 C:\WINDOWS\system32\ntoskrnl.exe 06/21/2002 04:18 AM 1944448 5e718d127a177621bf891f6daa5dc55f C:\WINDOWS\Resources\Themes\RVSilver\windows_xp_themes_05\Bootscreen\ntoskrnl.exe 04/10/2002 10:14 PM 1984256 956c3de5637f1e0d56a23121500f9ce2 C:\WINDOWS\Resources\Themes\RVSilver\windows_xp_themes_02\Continuum\Bootscreen\ntoskrnl.exe 02/28/2007 12:55 PM 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2QFE\ntoskrnl.exe 02/28/2007 12:10 PM 2180352 582a8dbaa58c3b1f176eb2817daee77c C:\WINDOWS\SoftwareDistribution\Download\10e16e65c532d077de7c89a212bd8df8\SP2GDR\ntoskrnl.exe 09/09/2006 12:48 AM 1616896 7f9583eff8102bce8bd6716744018f83 C:\WINDOWS\explorer.exe 06/13/2007 01:23 PM 1033216 97bd6515465659ff8f3b7be375b2ea87 C:\WINDOWS\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\SP2GDR\explorer.exe 06/13/2007 02:26 PM 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\SoftwareDistribution\Download\44d74c37f0595a363bcec5e9229d8564\SP2QFE\explorer.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-13_19.36.51.34 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 17:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE - 2008-08-13 16:01:46 29,926 ----a-r C:\WINDOWS\Installer\{CACE46A6-D098-40B3-911D-A7334E336714}\MsblIco.Exe + 2008-08-15 01:47:02 29,926 ----a-r C:\WINDOWS\Installer\{CACE46A6-D098-40B3-911D-A7334E336714}\MsblIco.Exe + 2008-08-14 19:56:22 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\ntuser.dat - 2006-09-08 21:51:46 571,184 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll + 2008-03-20 15:06:36 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll + 2008-08-14 20:28:40 21,260 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat + 2008-03-20 11:41:20 14,640 ------w C:\WINDOWS\system32\spmsg.dll - 2008-02-27 10:15:14 28,416 ----a-w C:\WINDOWS\system32\uxtuneup.dll + 2008-04-04 11:51:32 28,416 ----a-w C:\WINDOWS\system32\uxtuneup.dll + 2008-08-15 05:06:56 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_6e8.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 11:56 PM 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [08/16/2007 04:19 PM 5728112] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [05/20/2005 09:11 AM 925696] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [03/31/2006 04:01 PM 761946] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [06/06/2006 10:09 AM 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [06/06/2006 10:06 AM 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [06/06/2006 10:10 AM 118784] "BluetoothAuthenticationAgent"="bthprops.cpl" [08/03/2004 11:56 PM 110592 C:\WINDOWS\system32\bthprops.cpl] "AGRSMMSG"="AGRSMMSG.exe" [12/12/2005 03:00 PM 88203 C:\WINDOWS\AGRSMMSG.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ SnagIt 8.lnk - C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe [2007-05-01 11:11:48 6395464] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-07-13 22:33:46 113664] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\ [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli scecli [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*isabledxpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [07/19/2008 05:35 PM] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [07/19/2008 05:37 PM] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/03/2004 11:56 PM] R3 BTCAMDRV;Mobiola Web Camera driver;C:\WINDOWS\system32\DRIVERS\BTCamDrv.sys [11/01/2006 06:45 PM] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [08/15/2008 12:37 AM] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66c82f0e-5564-11dd-b468-000a3a5b877a}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66c82f0f-5564-11dd-b468-000a3a5b877a}] \Shell\Autoplay\Command - smss.exe \Shell\AutoRun\command - smss.exe \Shell\Explore\Command - smss.exe \Shell\Open\Command - smss.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C0A683BA-0908-97B9-E04C-03A3BFAF1BB3}] C:\Program Files\Movie Maker\Unstall00.exe s . s of the 'Scheduled Tasks' folder 2008-08-15 C:\WINDOWS\Tasks\1-Click Maintenance.job - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [02/29/2008 02:24 PM] . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\o0oNOOONEo0o\Application Data\Mozilla\Firefox\Profiles\gjuufy0i.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-15 08:07:07 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Completion time: 08/15/2008 8:10:13 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-15 05:10:08 ComboFix2.txt 2008-08-13 16:37:10 Pre-Run: 14,226,276,352 bytes free Post-Run: 14,180,335,616 bytes free 200

 

لمن كان يفحص طلعت لي نافذه ان الويندوز فيه خطاآ

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:12:39 ص, on 15/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\o0oNOOONEo0o\Desktop\Zyzoom_HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4129 bytes

 

ركبي البلاس وسوي لي تقرير هايجاك​

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:21:34 ص, on 15/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 8\SnagPriv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\o0oNOOONEo0o\Desktop\Zyzoom_HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4096 bytes