هل جهازي مصاب.؟

حاضر يالغالي
مو بس انت جننك انا طلع لي قرووووووووون
حذفت برااااامج كثيرررررررره قلت يمكن السبب لانهم حقين الجامعه وصار يعلق اكثر:$


بسوي الخطوت الي قلت وبرجع

 

لما حملت الاداء االاولى رحت الوضع الامن وشغلتهاا طلعت لي هذي الصوره تقريباا ضليت ربع ساعه وماتحرك شئ ورجعت هوونهذي الصووره http://www.up-00.com/hafiles/rmY57429.bmpهذا مو شغال عنديثم اعيدي تشغيل الجهاز وادخلي للوضع العادي وطبقي التاليبعد عمل المطلوبواعمل التاليحمل هالأداةDOWNLOADNOW

 

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 13:07:12, on 02/05/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16827)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Windows Live\Toolbar\wltuser.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\بوفاضل\My Documents\الملفات\HiJackThis.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dllO2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\RunOnce: [Privacy Suite] "C:\Documents and Settings\بوفاضل\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\بوفاضل\Application Data\CyberScrub\Privacy Suite" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (file missing)O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exeO9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exeO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dllO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...en/x86/client/wuweb_site.cab?1224066574453O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocxO16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file:///C:/Program%20Files/AutoCAD%202002/InstBanr.ocxO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocxO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)--End of file - 6423 bytesهذا تقرير الهاجيناك امممم طبعت حذفت الكاسبر من الوضع العام وبعدين لما رحت الوضع الامن ماضبطت هذي الخطووه والخطوه الثالثه مارضى يتحمل الاداه الرابعه نظفت الاجهازوهذا التقرير

 

طيب

الأن كيف وضع الجهاز ؟؟

 

وضعه تمااااااام بدون برنامج الحمايه

 

عبووووووووودي وضعه تمام بس المشكله اخليه بدون برنامج حمايه.؟

 

والله انا حاولت بكل الطرق :i:

مو حاب اعطيكي برنامج حماية وترجع لك المشكلة ونرجع نحذف من جديد :no:

 

اجل وشو الحل.؟

 

شوفي

اول شي

الفحص والتنظيف اون لاين بـ a-squared Web Malware Scanner 4.0

طبقي هذا الموضوع

وعطيني التقرير


واعملي هذا التقرير في الوضع الأمن







عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes



اثناء الفحص ممكن يعاد تشغيل الجهاز



وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى


وبعدها عطيني هايجاك من الوضع العادي


طبقي التقارير بالترتيب​

 

رجعنااا للفحص استغفر الله ربي العظيم خلاص بفحصه لما اجي لانه الحين انشغلت حبتين سوري والله

 

هذاا تقرير الاداهa-squared Web Malware Scanner v. 4.0Scan settings:Objects: Memory, Traces, Cookies, C:\, D:\Scan archives: OnHeuristics: OffADS Scan: OnScan start: 02/05/2009 05:56:01 مC:\Documents and Settings\بوفاضل\My Documents\الملفات\SmitfraudFix\Reboot.exe detected: Riskware.RiskTool.Win32.Reboot.f!A2C:\System Volume Information\_restore{158A5E2A-E331-4D75-B632-1FF7D9BD4413}\RP2\A0002158.exe detected: Riskware.RiskTool.Win32.Reboot.f!A2ScannedFiles: 55710Traces: 338733Cookies: 347Processes: 33FoundFiles: 2Traces: 8Cookies: 1Processes: 0Scan end: 02/05/2009 06:19:39 مScan time: 12:23:38 صhttp://up3.m5zn.com/download-2009-5-2-08-dh28mvndg.rar

 

هذا التقرير الاداه http://up3.m5zn.com/download-2009-5-2-08-jxi3fvpup.rar

 

الحقني اخوي اممممم كل مافتحت صفحه يقولي يوجد خطا: أرجو تشغيل الجافا سكريبت في المتصفح.

 

ComboFix 09-05-02.4 - بوفاضل 05/02/2009 18:43.4 - NTFSx86 MINIMALMicrosoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.446.273 [GMT 3:00]Running from: c:\documents and settings\بوفاضل\سطح المكتب\ComboFix.exeWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((( Files Created from 2009-04-02 to 2009-05-02 ))))))))))))))))))))))))))))))).2009-05-02 09:34 . 2009-05-02 10:01 32 --sha-w c:\windows\system32\drivers\fidbox2.dat2009-05-02 09:34 . 2009-05-02 10:01 32 --sha-w c:\windows\system32\drivers\fidbox.dat2009-04-29 08:15 . 2009-04-29 08:15 -------- d-----w c:\documents and settings\Administrator\سطح المكتب2009-04-29 08:15 . 2009-04-29 08:15 -------- d-----w c:\documents and settings\Administrator\قائمة ابدأ2009-04-29 08:15 . 2009-04-29 08:15 -------- d-----w c:\documents and settings\Administrator2009-04-28 21:04 . 2009-04-28 21:29 -------- d-----w c:\documents and settings\بوفاضل\DoctorWeb2009-04-28 21:04 . 2009-04-28 21:29 -------- d-----w c:\documents and settings\بوفاضل\DoctorWeb2009-04-28 11:43 . 2009-04-28 11:43 -------- d-sh--w C:\found.0042009-04-28 11:30 . 2009-04-28 11:30 -------- d-----w c:\documents and settings\بوفاضل\Application Data\CyberScrub2009-04-28 11:29 . 2009-05-02 10:00 -------- d-----w c:\documents and settings\بوفاضل\Application Data\cleaner2009-04-28 10:02 . 2009-04-28 10:37 -------- d-----w c:\windows\BDOSCAN82009-04-23 16:15 . 2009-03-10 19:18 453000 ----a-w c:\windows\system32\KB905474\wgasetup.exe2009-04-23 16:15 . 2009-04-24 09:41 -------- d-----w c:\windows\system32\KB9054742009-04-21 20:21 . 2009-04-21 20:21 -------- d-sh--w C:\found.0032009-04-19 15:12 . 2009-04-19 15:12 -------- d-----w c:\documents and settings\بوفاضل\Local Settings\Application Data\PGP Corporation2009-04-19 15:12 . 2009-04-19 15:12 -------- d-----w c:\documents and settings\بوفاضل\Application Data\PGP Corporation2009-04-19 15:12 . 2009-04-19 15:12 -------- d-----w c:\documents and settings\All Users\Application Data\PGP Corporation2009-04-16 13:38 . 2009-04-16 13:38 -------- d-----w c:\program files\Lavalys2009-04-16 13:38 . 2009-05-01 21:09 -------- d-----w c:\program files\AviSynth 2.52009-04-16 13:38 . 2009-04-16 13:42 -------- d-----w c:\program files\Easy RealMedia Tools2009-04-16 13:37 . 2009-05-01 21:19 -------- d-----w c:\documents and settings\بوفاضل\Local Settings\Application Data\WinAVI2009-04-16 13:36 . 2009-04-16 13:36 -------- d-----w c:\program files\WinAVI Video Converter 9.02009-04-16 13:36 . 2009-04-16 13:36 -------- d-----w c:\windows\WinAVI Video Converter 9.02009-04-16 13:02 . 2009-04-16 13:02 -------- d-sh--w c:\windows\ftpcache2009-04-16 13:02 . 2009-04-16 13:02 -------- d-----w c:\program files\FLV-Media Player2009-04-16 13:00 . 2009-05-01 15:20 -------- d-----w c:\documents and settings\بوفاضل\Application Data\Video Converter for Any Flv Player2009-04-16 13:00 . 2009-05-01 15:20 -------- d-----w c:\program files\Any Flv Player2009-04-16 12:48 . 2009-04-16 12:48 -------- d-----w c:\documents and settings\بوفاضل\Application Data\FLVPlayer4Free2009-04-16 12:32 . 2009-04-16 12:32 275456 ----a-w c:\windows\system32\gfbaksm.dll2009-04-16 12:32 . 2009-04-16 12:32 275456 ----a-w c:\windows\system32\gfbaksm.dat2009-04-16 12:32 . 2009-04-16 12:33 -------- d-----w c:\program files\GetFLV2009-04-09 21:53 . 2009-05-01 14:08 -------- d-----w c:\documents and settings\All Users\Application Data\Avira2009-04-06 16:27 . 2009-04-06 16:27 -------- d-----w c:\program files\TechSmith2009-04-06 15:57 . 2009-04-06 16:02 -------- d-----w c:\program files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter2009-04-06 15:49 . 2009-04-06 15:49 -------- d-----w C:\Mp3 Output2009-04-06 15:49 . 2007-02-25 12:36 383238 ----a-w c:\windows\system32\libmp3lame-0.dll2009-04-06 15:49 . 2009-04-06 15:49 -------- d-----w c:\program files\Smallvideosoft2009-04-05 08:26 . 2009-04-05 08:26 -------- d-sh--w C:\found.002.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-05-02 15:37 . 2008-08-06 08:03 6 ---ha-w c:\windows\Tasks\SA.DAT2009-05-02 15:00 . 2009-02-06 15:04 260 ---ha-w c:\windows\Tasks\ACDDA2FA918A5512.job2009-05-02 10:01 . 2009-05-02 09:34 32 --sha-w c:\windows\system32\drivers\fidbox2.idx2009-05-02 10:01 . 2009-05-02 09:34 32 --sha-w c:\windows\system32\drivers\fidbox.idx2009-05-02 09:23 . 2008-08-07 04:40 -------- d-----w c:\program files\Kaspersky Lab2009-05-01 20:59 . 2008-11-16 21:45 -------- d-----w c:\program files\YCIII2009-05-01 16:49 . 2008-09-06 20:14 424 ---ha-w c:\windows\Tasks\User_Feed_Synchronization-{8BB6EAE7-E840-45A3-BB97-672FB2F53D5F}.job2009-05-01 09:41 . 2001-09-19 12:00 59628 ----a-w c:\windows\system32\perfc001.dat2009-05-01 09:41 . 2001-09-19 12:00 331398 ----a-w c:\windows\system32\perfh001.dat2009-04-28 11:44 . 2008-10-05 01:35 -------- d-----w c:\program files\Yahoo!2009-04-22 13:42 . 2008-08-07 02:59 -------- d-----w c:\program files\MSN Messenger2009-04-22 13:41 . 2008-09-03 01:18 -------- d-----w c:\program files\Messenger Plus! Live2009-04-09 22:34 . 2009-01-01 21:55 -------- d-----w c:\program files\Malwarebytes' Anti-Malware2009-04-06 12:32 . 2009-01-01 21:55 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys2009-04-06 12:32 . 2009-01-01 21:55 15504 ----a-w c:\windows\system32\drivers\mbam.sys2009-03-28 06:02 . 2008-08-08 11:52 116904 ----a-w c:\documents and settings\بوفاضل\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2009-03-27 16:16 . 2009-03-27 16:16 -------- d-----w c:\program files\MSECache2009-03-27 15:35 . 2008-09-03 01:17 -------- d-----w c:\program files\Windows Live2009-03-27 15:34 . 2009-03-27 15:34 -------- d-----w c:\program files\Microsoft Sync Framework2009-03-27 15:33 . 2009-03-27 15:33 -------- d-----w c:\program files\Microsoft SQL Server Compact Edition2009-03-27 15:30 . 2009-03-27 15:30 -------- d-----w c:\program files\Microsoft2009-03-27 15:30 . 2009-03-27 15:30 -------- d-----w c:\program files\Windows Live SkyDrive2009-03-06 14:20 . 2008-04-14 18:29 283136 ----a-w c:\windows\system32\pdh.dll2009-03-04 17:55 . 2009-03-04 17:55 410984 ----a-w c:\windows\system32\deploytk.dll2009-03-04 17:55 . 2008-09-29 10:08 -------- d-----w c:\program files\Java2009-03-03 00:06 . 2008-07-20 10:51 826368 ----a-w c:\windows\system32\wininet.dll2009-02-26 23:48 . 2008-12-10 11:48 74490 ----a-w c:\windows\Uninstal.exe2009-02-20 16:50 . 2008-07-20 10:50 78336 ----a-w c:\windows\system32\ieencode.dll2009-02-10 16:03 . 2008-04-14 18:12 2067584 ----a-w c:\windows\system32\ntkrnlpa.exe2009-02-09 14:04 . 2008-04-14 18:07 1846656 ----a-w c:\windows\system32\win32k.sys2009-02-09 13:40 . 2009-02-07 15:52 592 ----a-w c:\windows\chgkey.vbs2009-02-09 11:22 . 2008-04-14 18:12 2190592 ----a-w c:\windows\system32\ntoskrnl.exe2009-02-09 11:21 . 2008-04-14 18:30 110592 ----a-w c:\windows\system32\services.exe2009-02-09 10:51 . 2008-04-14 18:29 723456 ----a-w c:\windows\system32\lsasrv.dll2009-02-09 10:51 . 2008-04-14 18:29 401408 ----a-w c:\windows\system32\rpcss.dll2009-02-09 10:51 . 2008-04-14 18:29 681472 ----a-w c:\windows\system32\advapi32.dll2009-02-09 10:51 . 2008-04-14 18:29 693760 ----a-w c:\windows\system32\ntdll.dll2009-02-06 16:43 . 2009-02-06 16:43 307576 ----a-w c:\windows\WLXPGSS.SCR2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\system32\sirenacm.dll2009-02-06 10:39 . 2001-09-19 12:00 35328 ----a-w c:\windows\system32\sc.exe2009-02-03 19:57 . 2008-04-14 18:29 56832 ----a-w c:\windows\system32\secur32.dll.------- Sigcheck -------[-] 2008-07-20 10:56 1571328 E16DB203BFEB9740C8483E418C8C18AD c:\windows\system32\sfcfiles.dll.((((((((((((((((((((((((((((( SnapShot_2009-04-30_12.46.30 ))))))))))))))))))))))))))))))))))))))))).- 2001-09-19 12:00 . 2009-04-28 17:27 59638 c:\windows\system32\perfc009.dat+ 2001-09-19 12:00 . 2009-05-01 09:41 59638 c:\windows\system32\perfc009.dat+ 2001-09-19 12:00 . 2009-05-01 09:41 395398 c:\windows\system32\perfh009.dat- 2001-09-19 12:00 . 2009-04-28 17:27 395398 c:\windows\system32\perfh009.dat+ 2008-11-11 17:00 . 2008-11-11 17:00 218376 c:\windows\system32\klogon.dll+ 2009-05-01 15:48 . 2009-05-01 16:22 226832 c:\windows\system32\drivers\klif.sys+ 2008-07-21 14:34 . 2008-07-21 14:34 121872 c:\windows\system32\drivers\kl1.sys.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-07-25 8433664]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-02 185872]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-08-07 98304]"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]"nltide_2"="shell32" [X][HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnkbackup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Microsoft Office OneNote 2003 Quick Launch.lnk]path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Microsoft Office OneNote 2003 Quick Launch.lnkbackup=c:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnkbackup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^بوفاضل^قائمة ابدأ^البرامج^بدء التشغيل^Yankee Clipper III.lnk]path=c:\documents and settings\بوفاضل\قائمة ابدأ\البرامج\بدء التشغيل\Yankee Clipper III.lnkbackup=c:\windows\pss\Yankee Clipper III.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]"WMPNetworkSvc"=3 (0x3)"usnjsvc"=3 (0x3)"RichVideo"=2 (0x2)"ose"=3 (0x3)"OracleXETNSListener"=2 (0x2)"OracleXEClrAgent"=3 (0x3)"OracleServiceXE"=2 (0x2)"OracleMTSRecoveryService"=3 (0x3)"MDM"=2 (0x2)"IDriverT"=3 (0x3)"gusvc"=3 (0x3)"AVP"=2 (0x2)"AgereModemAudio"=2 (0x2)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\English\\setup.exe"="c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"=R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2007-07-20 5632]R3 winbondhidcir;Winbond HID CIR Receiver;c:\windows\system32\DRIVERS\winbondhidcir.sys [2007-07-20 21504]R4 OracleJobSchedulerXE;OracleJobSchedulerXE; [x]R4 OracleServiceXE;OracleServiceXE; [x]R4 OracleXETNSListener;OracleXETNSListener;c:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exe [2006-02-01 204800][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5abdb341-a430-11dd-8d5c-001b24ee22c5}]\Shell\AutoRun\command - F:\zPharaoh.exe\Shell\explore\command - F:\zPharaoh.exe\Shell\open\command - F:\zPharaoh.exe[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f49c9904-67b7-11dd-8c06-001b24ee22c5}]\Shell\AutoRun\command - f:\ctrun\start.exe\Shell\readme\command - notepad \readme.txt.Contents of the 'Scheduled Tasks' folder2009-05-01 c:\windows\Tasks\User_Feed_Synchronization-{8BB6EAE7-E840-45A3-BB97-672FB2F53D5F}.job- c:\windows\system32\msfeedssync.exe [2008-07-20 10:50]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com.sa/IE: Download ALL with IDAIE: Download with IDAIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cabFF - ProfilePath - c:\documents and settings\بوفاضل\Application Data\Mozilla\Firefox\Profiles\1dogw6dj.default\FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=FF - prefs.js: browser.search.selectedEngine - YahooFF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/?linkid=9529939FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=en-CA&FORM=MICFEC&q=FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dllFF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-05-02 18:45Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-1708537768-1202660629-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*t*t* \OpenWithList]@Class="Shell""a"="msnmsgr.exe""MRUList"="a"[HKEY_USERS\S-1-5-21-1708537768-1202660629-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B98EC8F3-C72D-17F0-F729-48FBEB943424}*]@Allowed: (Read) (RestrictedCode)@Allowed: (Read) (RestrictedCode)"fajjenaeimka"=hex:66,61,68,6d,68,66,6c,6b,6c,6a,66,6b,00,00[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]@Denied: (Full) (LocalSystem)"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(2032)c:\progra~1\MICROS~2\OFFICE11\MCPS.DLL.Completion time: 2009-05-02 18:47ComboFix-quarantined-files.txt 2009-05-02 15:47ComboFix2.txt 2009-05-02 15:35ComboFix3.txt 2009-04-30 13:04ComboFix4.txt 2009-04-28 12:03Pre-Run: 29,632,540,672 bytes freePost-Run: 29,628,575,744 bytes free226 --- E O F --- 2009-04-30 12:35

 

تقرير الهاجيناكLogfile of Trend Micro HijackThis v2.0.2Scan saved at 18:58:26, on 02/05/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16827)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Windows Live\Toolbar\wltuser.exeC:\Documents and Settings\بوفاضل\Application Data\cleaner\run.exeC:\Documents and Settings\بوفاضل\Application Data\cleaner\PrivacySuite.exeC:\Documents and Settings\بوفاضل\Application Data\cleaner\CSPSeraser.exeC:\Documents and Settings\بوفاضل\My Documents\الملفات\HiJackThis.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dllO2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quietO4 - HKCU\..\RunOnce: [Privacy Suite] "C:\Documents and Settings\بوفاضل\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\بوفاضل\Application Data\CyberScrub\Privacy Suite" O4 - HKCU\..\RunOnce: [ClearPageFileAtShutDown] "C:\Documents and Settings\بوفاضل\Application Data\cleaner\CSPSeraser.exe" -XPO4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (file missing)O9 - Extra button: تدوين هذا في المدونة - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &تدوين هذا في Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exeO9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exeO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dllO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...en/x86/client/wuweb_site.cab?1224066574453O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocxO16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file:///C:/Program%20Files/AutoCAD%202002/InstBanr.ocxO16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocxO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)--End of file - 6844 bytes

 

احفظي الثلاث التاقرير وارفعيها لي على هذا الموقع

http://www.zshare.net/

 

a2scan_090502-175601.rar - 0.00MBالاده الاولىصح عندي مشكله التصفح الكسبلور اخترب عندييشبك الحروف اللغه ماتتغير وتنسيق راح

 

هذا الاداه الثانيه
log.rar - 0.00MB

 

هالجيناك
mmmhijackthis.rar - 0.00MB

 

تمام

الأن حددي القيم وحذفيها


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll


O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (file missing)

طريقة الحذف ​

​

​

​

بعدها اذهب الى اضافة وازالة البرامج واحذف التولبار الموجود عندك (toolbar)>> ممكن ما يكون موجود​

ثم نزل هذه الاداة واتبع الشرح التالي

http://www.mediafire.com/?ajm934ztyhn​

او

http://www.zyzoom.net/shswelh/Zyzoom...cy_Suite_2.exe

التوافق : ويندوز اكسبيفقط ​

شرح الاستخدام ,,,,,,
عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )





وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))




^
^^

ضروري تحذفي القيم وتنظفي الجهاز بأداة التنظيف

بعد عمل المطلوب اعملي التالي


ادخل على خيارات الأنترنت وتابع الصورة

وبعد عمل المطلوب اعمل التالي

حملي هالأداة

اداة Cwshredder




شرح الاستخدام ​

وبعد الأنتهاء منها

حملي

اداة استعادة افتراضيات الريجستري ( xp sp3 )





ولاهنتي عمل الخطوات بالترتيب

وبعد عمل كل المطلوب ,, اعيدي تشغيل الجهاز

وشوفي لي ماهي المشاكل الي تواجهيها غير برنامج الحماية ؟؟​

​