كيف اعرف للحين مخترق ولا لا ؟؟

المصدر: كيف اعرف للحين مخترق ولا لا ؟؟
في منتدى : منتدى مشاكـل وحلول الحـاسب

مساء الخير
امس كان جهازي مخترق من شخص الله لايحله

المهم سويت فورمات امس وسويت اسكان مافيه فيروسات
عندي كاسبر اصلي

المشكله اليوم كل شوي تقفل صفحات الانترنت
وفتحت لي كذا صفحه مدري ايش وقفلتها

كيف اعرف للحين مخترق ولا لا ؟؟

 

هذا تقرير هياجيك جديد


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:28 ص, on 06/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\AnchorFree\bin\ctrl\AFController.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: مساعد رابط Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AF BHO - {B7154C4D-87C0-4A2C-AB64-DA132BAC2EE6} - C:\Program Files\AnchorFree\bin\AFBho.dll
O3 - Toolbar: AFToolbar - {1F385865-F3D4-41ff-960D-7B7D0A7A72F6} - C:\Program Files\AnchorFree\bin\AFToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [AFProg] C:\Program Files\AnchorFree\bin\ctrl\AFController.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1244149372015
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 7132 bytes

 

حدد هذه القيم و احذفها :
C:\Program Files\AnchorFree\bin\ctrl\AFController.exe
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [AFProg] C:\Program Files\AnchorFree\bin\ctrl\AFController.exe



طريقة الحذف ​

​

،
،
،
دام انك سويت فرمته امس جهازك سليم
و ما فيه الا العافية ..
،
،
اما طرق كشف الاختراق ما فيه طريقة مضمونه 100%
لكن ممكن تلاحظ انت مثلا نقص ملفات او اي اشياء غريبة
في الجهاز تتغير ..

اهم شي انك ما تفتح اي ملفات من مواقع غير موثوقة
لا تحمل الا من مواقع موثوق فيها و لا تدخل روابط غريبة
او من اشخاص لا تثق فيها و ان شاء الله ما يخترق جهازك​

 

السلام عليكم حبيت اقولك الفرق بين الكاسبر الموجود عندك والكاسبر الاخر

الإنتي فايروس << هذا الموجود عندك

حمل اداة الكاسبر من الرابط التالي

http://dnl-eu6.kaspersky-labs.com/devbuilds/AVPTool/


http://www.mediafire.com/?mymmlwzjjnz

بعد التحميل ،، دبل كلك وسيتم استخراج ملف الاداة الى مجلد بسطح المكتب لحظات وتبدأ الاداة بالعمل

تابع الشرح لفحص الجهاز وتنظيفه وارفاق التقرير












ثم قم بضغط التقرير ورفعه هنا>>>>
http://zshare.net

وبعد الانتهاء ارفق تقرير اداة الكاسبر + تقرير هايجاك جديد

 

معليش حبيبنا ماشفت ردك الا بعد وضع الرد

 

تم حذف القيم اخوي

ايش اسوي ثاني

 

هذا تقرير ايضاء من برنامج ComboFix
اللي عليه صورة اسد

ComboFix 09-06-05.03 - Good 06/06/2009 0:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.2550.2084 [GMT 3:00]
Running from: c:\documents and settings\Good\سطح المكتب\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Good\Application Data\addons.dat
c:\program files\Windows Live\Messenger\MsnMsgr.exe
c:\program files\Yahoo!\Messenger\YahooMessenger.exe
c:\windows\101.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\kakle.dll
.
((((((((((((((((((((((((( Files Created from 2009-05-05 to 2009-06-05 )))))))))))))))))))))))))))))))
.
2009-06-05 21:33 . 2009-06-05 21:33 -------- d-----w- c:\program files\Trend Micro
2009-06-05 21:18 . 2009-06-05 21:18 64000 ----a-w- C:\mspass.exe
2009-06-05 21:17 . 2009-06-05 21:17 33 ----a-w- C:\mspass.bat
2009-06-05 20:59 . 2009-06-05 21:00 294912 ----a-w- C:\kob.exe
2009-06-05 19:06 . 2009-06-05 19:06 -------- d-----w- c:\windows\system32\??
2009-06-05 05:25 . 2009-06-05 05:25 -------- d-----w- c:\documents and settings\Good\Local Settings\Application Data\Identities
2009-06-05 04:57 . 2009-06-05 04:57 -------- d-----w- c:\documents and settings\Good\Application Data\vlc
2009-06-05 02:53 . 2009-06-05 02:53 -------- d-----w- c:\program files\Hotspot Shield
2009-06-05 02:52 . 2009-06-05 02:52 -------- d-----w- c:\program files\AnchorFree
2009-06-04 21:58 . 2009-06-04 21:58 -------- d--h--w- c:\windows\system32\MsN
2009-06-04 21:55 . 2004-03-29 12:23 90112 ----a-w- c:\windows\unvise32.exe
2009-06-04 21:55 . 2009-06-04 21:55 -------- d-----w- c:\program files\SWiSHmax
2009-06-04 21:54 . 2009-06-04 21:54 120240 ----a-w- c:\documents and settings\Good\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-06-04 21:54 . 2009-06-05 03:54 -------- d-----w- c:\documents and settings\Good\Application Data\IDM
2009-06-04 21:54 . 2009-06-05 21:49 -------- d-----w- c:\documents and settings\Good\Application Data\DMCache
2009-06-04 21:54 . 2009-06-05 20:57 -------- d-----w- c:\program files\Internet Download Manager
2009-06-04 21:53 . 2009-06-04 21:53 -------- d-----w- c:\documents and settings\Good\Local Settings\Application Data\Help
2009-06-04 21:53 . 2009-06-04 21:53 -------- d-----w- c:\program files\GoldWave
2009-06-04 21:52 . 2009-06-04 21:52 -------- d-----w- c:\documents and settings\Good\Application Data\Ipswitch
2009-06-04 21:52 . 2009-06-04 21:52 -------- d-----w- c:\program files\Ipswitch
2009-06-04 21:51 . 2009-06-04 21:51 -------- d-----w- c:\program files\PHP Coder
2009-06-04 21:44 . 2002-10-25 02:17 65536 ----a-w- c:\windows\system32\Crypserv.exe
2009-06-04 21:44 . 1999-06-18 21:49 165888 ----a-w- c:\windows\Ckconfig.exe
2009-06-04 21:44 . 1996-05-03 17:21 27648 ----a-r- c:\windows\Setup_ck.exe
2009-06-04 21:44 . 1996-05-03 15:36 18432 ----a-w- c:\windows\Setup_ck.dll
2009-06-04 21:44 . 1995-07-04 18:33 11776 ----a-w- c:\windows\Ckrfresh.exe
2009-06-04 21:44 . 2002-10-25 02:17 29414 ----a-w- c:\windows\system32\CKLDRV.SYS
2009-06-04 21:44 . 2009-06-04 21:44 818688 ----a-w- c:\windows\system32\K2KLOC.dll
2009-06-04 21:44 . 2009-06-04 21:44 741888 ----a-w- c:\windows\system32\K2KRMT.dll
2009-06-04 21:43 . 2009-06-04 21:43 -------- d-----w- c:\documents and settings\Good\Application Data\Media Player Classic
2009-06-04 21:43 . 2009-06-04 21:51 -------- d-----w- c:\program files\Kelk 2000
2009-06-04 21:33 . 2009-06-05 00:29 -------- d-----w- c:\documents and settings\Good\Contacts
2009-06-04 21:30 . 2009-06-04 21:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-06-04 21:21 . 2009-06-04 21:23 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-04 21:20 . 2009-06-04 21:20 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-06-04 21:13 . 2005-02-25 03:34 22752 ----a-w- c:\windows\system32\spupdsvc.exe
2009-06-04 21:13 . 2009-06-04 21:13 -------- d--h--w- c:\windows\$hf_mig$
2009-06-04 21:08 . 2001-08-17 13:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2009-06-04 21:08 . 2004-08-04 00:55 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-06-04 21:07 . 2004-08-04 00:41 57216 ----a-w- c:\windows\system32\drivers\redbook.sys
2009-06-04 21:07 . 2001-08-17 13:46 6400 ----a-w- c:\windows\system32\drivers\enum1394.sys
2009-06-04 21:06 . 2004-08-03 21:55 73728 -c--a-w- c:\windows\system32\dllcache\usbui.dll
2009-06-04 21:06 . 2004-08-03 21:55 73728 ----a-w- c:\windows\system32\usbui.dll
2009-06-04 21:06 . 2001-09-18 13:30 16256 ----a-w- c:\windows\system32\drivers\battc.sys
2009-06-04 21:06 . 2001-08-17 13:58 9344 ----a-w- c:\windows\system32\drivers\compbatt.sys
2009-06-04 21:06 . 2004-08-03 23:07 14080 ----a-w- c:\windows\system32\drivers\CmBatt.sys
2009-06-04 21:06 . 2004-08-03 23:07 8832 ----a-w- c:\windows\system32\drivers\wmiacpi.sys
2009-06-04 21:04 . 2002-08-29 06:30 5632 -c--a-w- c:\windows\system32\dllcache\kbdheb.dll
2009-06-04 21:03 . 2008-10-16 11:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-04 21:03 . 2009-06-05 21:44 -------- d--h--w- c:\documents and settings\Default User
2009-06-04 21:03 . 2009-06-04 18:23 -------- d-----w- C:\Documents and Settings
2009-06-04 21:03 . 2009-06-04 18:15 -------- d-----w- c:\documents and settings\All Users
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 21:49 . 2009-06-04 20:11 262176 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2009-06-05 21:49 . 2009-06-04 20:11 4072 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2009-06-05 21:49 . 2009-06-04 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-06-05 21:47 . 2009-06-04 20:11 2852896 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-05 21:47 . 2009-06-04 20:11 25464 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-05 20:58 . 2002-08-29 06:30 40316 ----a-w- c:\windows\system32\perfc001.dat
2009-06-05 20:58 . 2002-08-29 06:30 251946 ----a-w- c:\windows\system32\perfh001.dat
2009-06-05 06:41 . 2009-06-04 18:23 393880 ----a-w- c:\documents and settings\Good\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-04 21:52 . 2009-06-04 18:39 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 21:52 . 2009-06-04 18:15 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-04 21:32 . 2009-06-04 19:26 -------- d-----w- c:\program files\Windows Live
2009-06-04 20:52 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2009-06-04 20:52 . 2009-06-04 20:12 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-06-04 20:52 . 2009-06-04 20:12 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-06-04 20:52 . 2009-06-04 20:52 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\klbg.sys
2009-06-04 20:52 . 2009-06-04 20:52 206088 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\avp.exe
2009-06-04 20:52 . 2009-06-04 20:52 226832 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.506\XP\klif.sys
2009-06-04 20:11 . 2009-06-04 20:11 -------- d-----w- c:\program files\Kaspersky Lab
2009-06-04 20:10 . 2009-06-04 20:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-06-04 20:08 . 2009-06-04 20:08 720896 ----a-w- c:\windows\iun6002.exe
2009-06-04 20:08 . 2009-06-04 20:08 -------- d-----w- c:\program files\Macromedia
2009-06-04 20:06 . 2009-06-04 19:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-04 20:04 . 2009-06-04 20:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems
2009-06-04 20:04 . 2009-06-04 20:04 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared
2009-06-04 20:02 . 2009-06-04 20:02 -------- d-----w- c:\program files\Xilisoft
2009-06-04 20:01 . 2009-06-04 20:01 0 ----a-w- c:\windows\nsreg.dat
2009-06-04 19:53 . 2009-06-04 19:53 -------- d-----w- c:\documents and settings\Good\Application Data\ESET
2009-06-04 19:49 . 2009-06-04 19:49 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-06-04 19:42 . 2009-06-04 19:42 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-06-04 19:42 . 2009-06-04 19:42 172032 ------w- c:\windows\Setup1.exe
2009-06-04 19:42 . 2009-06-04 19:42 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-04 19:41 . 2009-06-04 19:41 -------- d-----w- c:\program files\Nero
2009-06-04 19:41 . 2009-06-04 19:41 -------- d-----w- c:\program files\Common Files\Ahead
2009-06-04 19:40 . 2009-06-04 19:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-06-04 19:40 . 2009-06-04 19:40 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-04 19:39 . 2009-06-04 19:39 -------- d-----w- c:\program files\VideoLAN
2009-06-04 19:38 . 2009-06-04 19:38 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-04 19:38 . 2009-06-04 19:37 -------- d-----w- c:\program files\Real
2009-06-04 19:38 . 2009-06-04 19:37 -------- d-----w- c:\program files\Common Files\Real
2009-06-04 19:34 . 2009-06-04 19:34 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-06-04 19:34 . 2009-06-04 19:34 -------- d-----w- c:\program files\CyberLink
2009-06-04 19:31 . 2009-06-04 19:31 196608 ----a-w- c:\windows\system32\maag.dll
2009-06-04 19:31 . 2009-06-04 19:31 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-06-04 19:31 . 2009-06-04 19:31 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-06-04 19:31 . 2009-06-04 19:31 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-06-04 19:31 . 2009-06-04 19:31 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-06-04 19:31 . 2009-06-04 19:31 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-06-04 19:31 . 2009-06-04 19:31 1986560 ----a-w- c:\windows\system32\akll.dll
2009-06-04 19:31 . 2009-06-04 19:31 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-06-04 19:31 . 2009-06-04 19:31 -------- d-----w- c:\program files\Real_SC
2009-06-04 19:29 . 2009-06-04 19:29 47104 ------w- c:\windows\AKDeInstall.exe
2009-06-04 19:29 . 2009-06-04 19:29 -------- d-----w- c:\program files\mpegable
2009-06-04 19:29 . 2009-06-04 19:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-06-04 19:28 . 2009-06-04 19:28 -------- d-----w- c:\program files\Yahoo!
2009-06-04 19:27 . 2009-06-04 19:27 -------- d-----w- c:\program files\Messenger Plus! Live
2009-06-04 19:24 . 2009-06-04 19:24 2232 ----a-w- c:\windows\java\Packages\Data\FBHVT335.DAT
2009-06-04 19:24 . 2009-06-04 19:24 155995 ----a-w- c:\windows\java\Packages\YKLB5V3X.ZIP
2009-06-04 19:24 . 2009-06-04 19:24 2678 ----a-w- c:\windows\java\Packages\Data\3TR3P77J.DAT
2009-06-04 19:24 . 2009-06-04 19:24 2678 ----a-w- c:\windows\java\Packages\Data\VPNV7TV5.DAT
2009-06-04 19:24 . 2009-06-04 19:24 2678 ----a-w- c:\windows\java\Packages\Data\YP7LZPN1.DAT
2009-06-04 19:24 . 2009-06-04 19:24 2678 ----a-w- c:\windows\java\Packages\Data\NFJRNTZ5.DAT
2009-06-04 19:24 . 2009-06-04 19:24 2678 ----a-w- c:\windows\java\Packages\Data\FDBD79JJ.DAT
2009-06-04 19:19 . 2009-06-04 19:19 -------- d-----w- c:\documents and settings\Good\Application Data\ACD Systems
2009-06-04 19:17 . 2009-06-04 19:17 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-06-04 19:17 . 2009-06-04 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-06-04 19:17 . 2009-06-04 19:17 -------- d-----w- c:\program files\ACD Systems
2009-06-04 18:59 . 2009-06-04 18:48 -------- d-----w- c:\program files\Dell
2009-06-04 18:54 . 2009-06-04 18:54 -------- d-----w- c:\program files\WIDCOMM
2009-06-04 18:51 . 2009-06-04 18:38 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-04 18:47 . 2009-06-04 18:47 -------- d-----w- c:\program files\Broadcom
2009-06-04 18:46 . 2009-06-04 18:46 -------- d-----w- c:\program files\Synaptics
2009-06-04 18:45 . 2009-06-04 18:45 -------- d-----w- c:\program files\CONEXANT
2009-06-04 18:44 . 2009-06-04 18:44 -------- d-----w- c:\program files\DIFX
2009-06-04 18:42 . 2009-06-04 18:42 -------- d-----w- c:\program files\Intel
2009-06-04 18:40 . 2009-06-04 18:40 -------- d-----w- c:\program files\SigmaTel
2009-06-04 18:29 . 2009-06-04 18:29 -------- d-----w- c:\program files\Common Files\L&H
2009-06-04 18:29 . 2009-06-04 18:29 -------- d-----w- c:\program files\Microsoft.NET
2009-06-04 18:29 . 2009-06-04 18:29 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-06-04 18:28 . 2009-06-04 18:28 -------- d-----w- c:\program files\Microsoft Works
2009-06-04 18:16 . 2009-06-04 18:16 -------- d-----w- c:\program files\microsoft frontpage
2009-06-04 18:12 . 2009-06-04 18:12 22144 ----a-w- c:\windows\system32\emptyregdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2008-02-20 2594224]
"AFProg"="c:\program files\AnchorFree\bin\ctrl\AFController.exe" [2006-11-20 81920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-03 1032192]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-06-04 206088]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-04 185896]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-16 397312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-24 622653]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^سرعة تشغيل Adobe Reader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\سرعة تشغيل Adobe Reader.lnk
backup=c:\windows\pss\سرعة تشغيل Adobe Reader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Good^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma.lnk]
path=c:\documents and settings\Good\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 05:29 م 33808]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 05:06 م 24592]
S2 ekrn;ESET Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{474E2CC9-32D4-1DC8-6CB8-368E9F8E63F0}]
c:\windows\system32\MsN\msnmsgr.exe s
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
SafeBoot-procexp90.Sys

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Good\Application Data\Mozilla\Firefox\Profiles\tmnxar54.default\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-06 00:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1576)
c:\windows\System32\BCMLogon.dll
- - - - - - - > 'explorer.exe'(1440)
c:\windows\system32\msi.dll
c:\program files\Internet Download Manager\idmmkb.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\Crypserv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-05 0:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-05 21:51
Pre-Run: 18,254,282,752 bytes free
Post-Run: 18,572,955,648 bytes free
254

 

تقرير هاك جديد

 

تفضل ياغالي


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:18:38 ص, on 06/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Good\سطح المكتب\Virus Removal Tool\is-0ODFU\is-0ODFU.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: مساعد رابط Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AF BHO - {B7154C4D-87C0-4A2C-AB64-DA132BAC2EE6} - C:\Program Files\AnchorFree\bin\AFBho.dll
O3 - Toolbar: AFToolbar - {1F385865-F3D4-41ff-960D-7B7D0A7A72F6} - C:\Program Files\AnchorFree\bin\AFToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: is-0ODFU.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1244149372015
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 6718 bytes

 

حبيت اسألك انت محمل قبل الكاسبر برنامج النود .؟ وحذفته .؟

 

ايه مركب لي المحل نود
وحذفه لي وركب لي كاسبر لان عندي نسخه اصليه

 

اسمع اخوي باقي ملفات لبرنامج نود بجهازك

استخدم البرنامج التالي لحذف باقي برنامج نود اسمه كذا بالجهاز ( ESET )


استخدم هذي الاداه لحذف باقي البرنامج من الرجيستي ثم من باقي الجهاز .!!

RegFinder​

طريقة الاستخدام ​

​

وهذه النتيجة بعد البحث ​

​

هذه المفاتيح مازالت موجودة ​

ولحذفها كليك يمين ثم اختر SELECT ALL​

​

ثم كليك يمين مرة اخرى واختر DELETE​

​

​

أخيرا نذهب الى محرك البحث ونبحث عن البرنامج
ونحذف كل شي اذا وجد ​

​

​

​

RegFinder
بدون تثبيت وحجمه 140 كيلو بايت ​

DOWNLOAD
NOW​

DOWNLOAD
NOW




​

 

تم الحذف
وهذا تقرير جديد اخووي


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:42:50 ص, on 06/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Good\سطح المكتب\Virus Removal Tool\is-0ODFU\is-0ODFU.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: مساعد رابط Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AF BHO - {B7154C4D-87C0-4A2C-AB64-DA132BAC2EE6} - C:\Program Files\AnchorFree\bin\AFBho.dll
O3 - Toolbar: AFToolbar - {1F385865-F3D4-41ff-960D-7B7D0A7A72F6} - C:\Program Files\AnchorFree\bin\AFToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: is-0ODFU.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1244149372015
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 6440 bytes

 

التقرير سليم اخووي

وكيف الحين جهازك ..!

 

والله تمام مافي شي
بس قبل كان تسكر صفحات الانترنت

وعارف برنامج اللي يطلع لك باسورد الايميل اذا كان محفوظ
فتح لي على سطح المكتب
مع اني مو محمله نهائي
شي غريب

لان جهازي امس مخترق مدري للحين باقي مخترق ولا راح بعد الفرمات

 

على حسب التقرير ماشوف فيه شي

لكن مثل ماقلت لك

فيه فرق بين الاصدارين للكاسبر

بأحد ردودي واعيدها لك مره ثانيه وانت وش تشوف وش الأفضل



الإنترنت سيكيورتي : يحتوي على جدار ناري وفاحص للبريد وفلترة وأشياء أخري بالإضافة إلى جميع الميزات في نسخة الإنتي فايروس ,,,, ويفضل للأجهزة التي تتصل بشبكة أو بإنترنت ,,

الإنتي فايروس :ـ كشف الفيروسات وميزات أخرى ليس لها علاقة بالإنترنت ,,, ويفضل للأجهزة غير المتصلة بالإنترنت ,,

 

يعني الحين ايش اسوي ؟

 

ادري انك بتصفقني اذا قلت لك احذف البرنامج الاصلي حقك :d:


وحمل البرنامج الثاني :d: اللي هو كاسبر سكاي سكورتي :d:

بس اذا فكرت :d: وتاخذ برايي:d: احذف البرنامج بأداه الخاصه بالكاسبر

ثم ركب الكاسبر

وعلى فكره ترى نازل من الكاسبر نسخه عربيه k:

وتراك بزيزووم ابشر بالمفاتحين :bleh:

 

يرجال قراده يوم ركبت اصلي
طول عمري من شريت الاب توب وانا على مفاتيح زيزوم الله يخليهم
مالي اسبوع مركب اصلي اخترق جهازي

والله مدري وش اسوي
الحين محمل الاداه اللي ضاف لي الرجال بالصفحه الاولى
وقاعد اسوي اسكان للجهاز فيها
وبشوف

 

طيب طيب الله يعينك ياربي