[ تم حل المشكلة ]مشكله في الـSafemode!

المصدر: [ تم حل المشكلة ]مشكله في الـSafemode!
في منتدى : منتدى مشاكـل وحلول الحـاسب

سلام عليكم

ما ادري وش المشكله وهل هي قديمه ولا توى جتني من فلاش شبكته لأني ما دخلت للسيفمود من فتره.

لكن شكبت فلاش طلع فيه فايروس مع انه ما اتوقع فيه شئ كان فيه اداه زيزوميه خاصه والكاسبر مدري وش اكتشف ومسح كم برنامج من الجهاز مالها دخل بالفايروس وقال انها مصابه وهي شغاله معي بدون مشاكل من زمـــان .. السيف مود حاولت ادخله علشان امسح المشاكل بواسطه الـSafemode لكن رفض كل ما جيت بدخل يسوي ريستارت من حاله ويعيد من البدايه ..!

المهم ان Task Manager تعطل:

تعديل الريجستري Registry Editing تعطل:


Hijackthis :

كود:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:10:37, on 12/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
C:\AppServ\Apache2.2\bin\httpd.exe
D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\PnkBstrB.exe
C:\AppServ\Apache2.2\bin\httpd.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Java\jre6\bin\jucheck.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://yads.zedo.com/ads2/c?a=655555;g=0;c=929000054;p=6;f=811824;h=574042;i=0;x=3840;n=929;s=7;k=http://www.skill2thrill.com/pages/Default.aspx?lan=sa&tid=38&affiliateid=afunz
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Babylon - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - D:\Program Files\Babylon\Babylon Toolbar\BabylonIEToolBar.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "D:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avp] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKLM\..\Run: [4shared Update] "D:\Program Files\4shared Desktop\checkUpdate.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: TVR Scheduler.lnk = D:\Program Files\honestech\honestech TVR 2.5\scheduleTV.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download all 4shared files - D:\Program Files\4shared Desktop\down_all.htm
O8 - Extra context menu item: &Download using 4shared Desktop - D:\Program Files\4shared Desktop\down_link.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://D:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\AppServ\Apache2.2\bin\httpd.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Macromedia - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - D:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: WTService - Unknown owner - D:\WINDOWS\system32\atwtusb.exe

--
End of file - 7489 bytes

Combofix :

كود:

ComboFix 09-12-10.01 - Administrator 12/11/2009  20:38:56.5.2 - x86
Microsoft Windows XP Professional  5.1.2600.2.1256.966.1033.18.2046.1568 [GMT 3:00]
Running from: d:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
 (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 d:\documents and settings\Administrator\My Documents\cc_20091211_202357.reg
 .
(((((((((((((((((((((((((   Files Created from 2009-11-11 to 2009-12-11  )))))))))))))))))))))))))))))))
.
 2009-12-11 01:09 . 2009-12-11 01:09 -------- d-----w- d:\program files\CCleaner
2009-12-10 21:20 . 2009-12-10 21:20 -------- d-----w- d:\program files\Common Files\eSellerate
2009-12-09 17:15 . 2009-12-11 16:18 -------- d-----w- d:\documents and settings\Administrator\Application Data\4shared Desktop
2009-12-09 17:15 . 2009-12-09 17:15 -------- d-----w- d:\program files\4shared Desktop
2009-12-09 15:48 . 2009-12-09 15:48 -------- d-----w- d:\documents and settings\Administrator\Application Data\Thinstall
2009-12-09 11:42 . 2009-08-24 22:30 13312 ----a-w- d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x02y25ch.default\extensions\twitternotifier@naan.net\components\nsTwitterFoxSign.dll
2009-11-29 13:56 . 2009-11-29 13:56 198064 ----a-w- d:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-11-29 13:55 . 2009-12-09 20:38 -------- d-----w- d:\documents and settings\Administrator\Application Data\IDM
2009-11-29 13:55 . 2009-11-29 13:56 -------- d-----w- d:\program files\Internet Download Manager
2009-11-27 11:18 . 2009-11-27 11:18 -------- d-----w- d:\program files\WinWatermark 2.2
2009-11-27 11:12 . 2004-08-03 20:08 31616 -c--a-w- d:\windows\system32\dllcache\usbccgp.sys
2009-11-27 11:12 . 2004-08-03 20:08 31616 ----a-w- d:\windows\system32\drivers\usbccgp.sys
2009-11-26 20:28 . 2009-11-26 20:28 -------- d-----w- d:\program files\honestech
2009-11-26 20:27 . 2009-11-26 20:27 -------- d-----w- d:\documents and settings\Administrator\Application Data\InstallShield
2009-11-25 12:29 . 2009-12-11 17:23 79488 ----a-w- d:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-18 15:17 . 2009-11-18 15:17 -------- d-----w- d:\program files\Common Files\Adobe AIR
2009-11-15 06:19 . 2009-11-15 06:20 -------- d-----w- d:\program files\AutoIt3
 .
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-11 17:17 . 2009-10-17 01:56 -------- d-----w- d:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-12-11 17:17 . 2009-10-15 20:30 -------- d-----w- d:\documents and settings\Administrator\Application Data\DMCache
2009-12-11 16:58 . 2009-10-15 20:25 -------- d-----w- d:\documents and settings\Administrator\Application Data\uTorrent
2009-12-11 16:46 . 2009-10-16 02:28 -------- d-----w- d:\program files\Golden Al-Wafi Translator
2009-12-11 16:39 . 2009-10-15 21:21 410984 ----a-w- d:\windows\system32\deploytk.dll
2009-12-11 16:38 . 2009-10-15 21:06 152576 ----a-w- d:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-12-11 16:25 . 2009-10-16 01:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Babylon
2009-12-11 16:15 . 2009-11-09 11:40 350408 ----a-w- d:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-11 16:05 . 2009-10-15 17:27 89400 ----a-w- d:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-10 21:18 . 2009-10-17 12:53 -------- d-----w- d:\program files\Sony
2009-12-10 00:25 . 2009-10-16 01:58 -------- d-----w- d:\documents and settings\Administrator\Application Data\Babylon
2009-11-26 20:28 . 2009-10-15 19:56 -------- d--h--w- d:\program files\InstallShield Installation Information
2009-11-22 04:48 . 2009-11-01 12:38 -------- d-----w- d:\program files\Steam
2009-11-18 15:17 . 2009-10-15 20:33 -------- d-----w- d:\program files\Common Files\Adobe
2009-11-10 04:19 . 2009-11-10 04:18 -------- d-----w- d:\program files\Acoustica MP3 Audio Mixer
2009-11-09 11:54 . 2009-10-17 13:19 -------- d-----w- d:\documents and settings\Administrator\Application Data\Sony
2009-11-09 11:46 . 2009-11-09 11:46 -------- d-----w- d:\documents and settings\All Users\Application Data\Sony
2009-11-09 11:40 . 2009-11-09 11:40 -------- d-----w- d:\program files\MSBuild
2009-11-09 11:36 . 2009-11-09 11:36 -------- d-----w- d:\program files\Reference Assemblies
2009-11-09 11:32 . 2009-11-09 10:39 52770576 ----a-w- d:\documents and settings\Administrator\Application Data\Sony Setup\64993CD0-67D1-4244-A2BC-FD73F4DA5B62\dotnetfx3.exe
2009-11-09 10:39 . 2009-10-17 12:47 -------- d-----w- d:\documents and settings\Administrator\Application Data\Sony Setup
2009-11-09 04:43 . 2009-11-09 04:43 -------- d-----w- d:\program files\FormatFactory
2009-11-08 03:43 . 2009-11-01 01:53 214504 ----a-w- d:\windows\system32\PnkBstrB.exe
2009-11-07 04:36 . 2009-10-27 19:12 331776 ----a-w- d:\documents and settings\Administrator\Application Data\TrustIntra\Test deaf drv.exe
2009-11-07 04:36 . 2009-10-15 20:29 -------- d-----w- d:\documents and settings\Administrator\Application Data\TrustIntra
2009-11-07 04:35 . 2009-10-15 20:29 357888 ----a-w- d:\documents and settings\Administrator\Application Data\TrustIntra\Browse Sixth Save 2.exe
2009-11-07 04:35 . 2009-11-07 04:35 765952 ----a-w- d:\documents and settings\Administrator\Application Data\TrustIntra\mbwsmydb.exe
2009-11-07 04:35 . 2009-10-15 20:29 -------- d-----w- d:\documents and settings\All Users\Application Data\Long slow road itch
2009-11-07 04:32 . 2009-10-15 20:28 -------- d-----w- d:\program files\Messenger Plus! Live
2009-11-07 03:44 . 2009-10-15 20:28 -------- d-----w- d:\program files\Windows Live
2009-11-07 03:43 . 2009-11-07 03:43 -------- d-----w- d:\program files\Microsoft
2009-11-07 03:43 . 2009-11-07 03:43 -------- d-----w- d:\program files\Windows Live SkyDrive
2009-11-07 03:26 . 2009-11-07 03:26 -------- d-----w- d:\program files\Common Files\Windows Live
2009-11-07 02:13 . 2009-11-02 23:01 -------- d-----w- d:\documents and settings\Administrator\Application Data\Xfire
2009-11-07 01:16 . 2009-11-01 01:54 138936 ----a-w- d:\windows\system32\drivers\PnkBstrK.sys
2009-11-04 15:54 . 2009-11-04 15:54 107888 ----a-w- d:\windows\system32\CmdLineExt.dll
2009-11-03 23:23 . 2009-11-03 23:23 -------- d-----w- d:\documents and settings\LocalService\Application Data\Xfire
2009-11-03 15:29 . 2009-11-03 15:29 79488 ----a-w- d:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_15\gtapi.dll
2009-11-02 23:17 . 2009-11-02 23:01 -------- d-----w- d:\program files\Xfire
2009-11-02 23:01 . 2009-11-02 23:01 -------- d-----w- d:\documents and settings\NetworkService\Application Data\Xfire
2009-11-02 00:21 . 2009-10-16 14:52 -------- d-----w- d:\documents and settings\All Users\Application Data\Tablet
2009-11-01 01:40 . 2009-11-01 01:40 75064 ----a-w- d:\windows\system32\PnkBstrA.exe
2009-11-01 00:49 . 2009-11-01 00:49 -------- d-----w- d:\program files\EA GAMES
2009-10-31 00:54 . 2009-10-31 00:43 -------- d-----w- d:\program files\Flash-SWF to AVI-GIF
2009-10-31 00:41 . 2009-10-17 13:31 -------- d-----w- d:\program files\CamStudio
2009-10-30 17:10 . 2009-10-30 16:52 -------- d-----w- d:\program files\ATITool
2009-10-29 19:41 . 2009-10-29 19:41 -------- d-----w- d:\program files\Sun
2009-10-29 12:06 . 2009-10-29 12:06 -------- d-----w- d:\program files\FastStone Capture
2009-10-29 01:44 . 2009-10-29 01:43 -------- d-----w- d:\program files\UltraVPN
2009-10-28 00:15 . 2009-10-28 00:15 -------- d-----w- d:\documents and settings\Administrator\Application Data\Malwarebytes
2009-10-28 00:15 . 2009-10-28 00:15 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2009-10-28 00:15 . 2009-10-28 00:15 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-27 22:13 . 2009-10-27 22:13 -------- d-----w- d:\program files\Trend Micro
2009-10-27 22:04 . 2009-10-27 11:47 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2009-10-27 19:10 . 2009-10-27 19:10 761856 ----a-w- d:\documents and settings\Administrator\Application Data\TrustIntra\xuecajwm.exe
2009-10-27 11:47 . 2009-10-27 11:47 -------- d-----w- d:\documents and settings\All Users\Application Data\TechSmith
2009-10-27 11:47 . 2009-10-27 11:47 -------- d-----w- d:\program files\TechSmith
2009-10-25 13:23 . 2009-10-25 13:23 -------- d-----w- d:\program files\Snarfware
2009-10-24 16:47 . 2009-10-24 16:47 -------- d-----w- d:\documents and settings\All Users\Application Data\GeoVid
2009-10-24 16:47 . 2009-10-24 16:47 -------- d-----w- d:\program files\GeoVid
2009-10-22 10:24 . 2009-10-22 10:24 -------- d-----w- d:\program files\URUSoft
2009-10-21 13:41 . 2009-10-20 00:05 -------- d-----w- d:\program files\QuickTime
2009-10-21 13:41 . 2009-10-21 13:41 -------- d-----w- d:\documents and settings\All Users\Application Data\Apple Computer
2009-10-21 12:31 . 2009-10-21 12:11 -------- d-----w- d:\program files\The KMPlayer
2009-10-21 12:12 . 2009-10-21 12:12 -------- d-----w- d:\program files\Common Files\Apple
2009-10-21 12:12 . 2009-10-21 12:12 -------- d-----w- d:\program files\Apple Software Update
2009-10-21 12:12 . 2009-10-21 12:12 -------- d-----w- d:\documents and settings\All Users\Application Data\Apple
2009-10-21 12:11 . 2009-10-21 12:11 -------- d-----w- d:\documents and settings\Administrator\Application Data\Apple Computer
2009-10-21 08:55 . 2009-10-21 08:55 -------- d-----w- d:\documents and settings\Administrator\Application Data\Corel
2009-10-21 08:52 . 2009-10-21 08:52 -------- d-----w- d:\program files\Common Files\Corel
2009-10-21 08:51 . 2009-10-21 08:51 -------- d-----w- d:\program files\Corel
2009-10-21 03:54 . 2009-10-17 02:08 -------- d-----w- d:\program files\WebShot
2009-10-20 14:26 . 2009-10-20 14:26 -------- d-----w- d:\program files\Common Files\Macromedia Shared
2009-10-20 14:25 . 2009-10-20 14:25 -------- d-----w- d:\program files\Macromedia
2009-10-20 12:06 . 2009-10-20 12:06 -------- d-----w- d:\documents and settings\Administrator\Application Data\Toon Boom Animation
2009-10-20 11:58 . 2009-10-20 11:58 -------- d-----w- d:\program files\Toon Boom Animation
2009-10-20 00:23 . 2009-10-20 00:23 -------- d-----w- d:\documents and settings\All Users\Application Data\FLEXnet
2009-10-20 00:03 . 2009-10-20 00:03 -------- d-----w- d:\program files\Bonjour
2009-10-19 23:51 . 2009-10-19 23:51 -------- d-----w- d:\program files\Common Files\Macrovision Shared
2009-10-19 23:51 . 2009-10-19 23:51 -------- d-----w- d:\documents and settings\All Users\Application Data\Messenger Plus!
2009-10-19 23:37 . 2009-10-19 23:36 -------- d-----w- d:\program files\MagicISO
2009-10-19 11:18 . 2009-10-15 20:32 -------- d-----w- d:\program files\Common Files\Real
2009-10-19 11:18 . 2009-10-19 11:18 -------- d-----w- d:\program files\Common Files\xing shared
2009-10-19 11:18 . 2009-10-15 20:32 -------- d-----w- d:\program files\Real
2009-10-19 11:13 . 2009-10-16 09:44 -------- d---a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-10-17 13:19 . 2009-10-17 13:19 -------- d-----w- d:\documents and settings\Administrator\Application Data\Publish Providers
2009-10-17 12:47 . 2009-10-17 12:47 2667792 ----a-w- d:\documents and settings\Administrator\Application Data\Sony Setup\CF356349-4782-4F9D-AE42-7E3C6AD74B9C\WindowsInstaller-KB893803-v2-x86.exe
2009-10-17 12:46 . 2009-10-17 12:46 -------- d-----w- d:\program files\Sony Setup
2009-10-17 02:23 . 2009-10-17 01:57 95259 ----a-w- d:\windows\system32\drivers\klick.dat
2009-10-17 02:23 . 2009-10-17 01:57 108059 ----a-w- d:\windows\system32\drivers\klin.dat
2009-10-17 02:22 . 2009-10-17 02:22 59920 ----a-w- d:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-10-17 02:22 . 2009-10-17 02:22 109072 ----a-w- d:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-10-17 02:22 . 2009-10-17 02:22 264720 ----a-w- d:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-10-17 02:02 . 2009-10-17 02:02 604140 --sha-w- d:\windows\system32\drivers\ISwift3.dat
2009-10-17 01:56 . 2009-10-17 01:56 -------- d-----w- d:\program files\Kaspersky Lab
2009-10-17 01:55 . 2009-10-17 01:55 -------- d-----w- d:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-10-16 17:31 . 2009-10-15 17:22 86327 ----a-w- d:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-16 14:56 . 2009-10-16 14:56 -------- d-----w- d:\program files\Free Notes & Office Ink
2009-10-16 14:54 . 2009-10-16 14:54 -------- d-----w- d:\program files\Power Presenter RE
2009-10-16 11:45 . 2009-10-16 11:45 -------- d-----w- d:\documents and settings\Administrator\Application Data\FastStone
.
 ------- Sigcheck -------
 [-] 2004-09-01 . 7B11118B078B88F87183FE69EDA43137 . 359040 . . [5.1.2600.2180] . . d:\windows\system32\drivers\tcpip.sys
 [-] 2004-09-01 . A77219A971029DC2FB683E8513713803 . 215552 . . [5.1.2600.2055] . . d:\windows\system32\termsrv.dll
.
(((((((((((((((((((((((((((((   SnapShot_2009-11-28_10.17.41   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-11 17:17 . 2009-12-11 17:17 16384              d:\windows\temp\Perflib_Perfdata_318.dat
+ 2009-10-15 17:35 . 2001-07-09 07:50 225280              d:\windows\system32\NeroCheck.exe
- 2009-10-15 21:21 . 2009-10-15 21:21 148888              d:\windows\system32\javaws.exe
+ 2009-12-11 16:39 . 2009-12-11 16:39 148888              d:\windows\system32\javaws.exe
+ 2009-12-11 16:39 . 2009-12-11 16:39 144792              d:\windows\system32\javaw.exe
- 2009-10-15 21:21 . 2009-10-15 21:21 144792              d:\windows\system32\javaw.exe
- 2009-10-15 21:21 . 2009-10-15 21:21 144792              d:\windows\system32\java.exe
+ 2009-12-11 16:39 . 2009-12-11 16:39 144792              d:\windows\system32\java.exe
+ 2009-11-11 14:10 . 2009-09-09 10:43 210352              d:\windows\system32\idmmbc.dll
+ 2009-10-16 02:06 . 2009-10-16 02:28 151040              d:\windows\ST6UNST.EXE
+ 2009-10-16 14:52 . 2007-11-13 10:23 2039456              d:\windows\system32\WTMKM.exe
+ 2006-06-01 09:22 . 2006-06-01 09:22 1593344              d:\windows\system32\nwiz.exe
+ 2009-10-15 20:09 . 2009-12-11 16:18 1579992              d:\windows\system32\FNTCACHE.DAT
+ 2009-12-11 16:39 . 2009-12-11 16:39 1633792              d:\windows\Installer\346ff.msi
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"IDMan"="d:\program files\Internet Download Manager\IDMan.exe" [2009-11-29 3171760]
 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="d:\windows\system32\NeroCheck.exe" [2001-07-09 225280]
"IntelAudioStudio"="d:\program files\Intel Audio Studio\IntelAudioStudio.exe" [2005-08-09 8597586]
"NvCplDaemon"="d:\windows\system32\NvCpl.dll" [2006-06-01 7618560]
"nwiz"="nwiz.exe" [2006-06-01 1593344]
"NvMediaCenter"="NvMCTray.dll" [2006-06-01 86016]
"MacrokeyManager"="WTMKM.exe" [2007-11-13 2039456]
"TkBellExe"="d:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-19 198160]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"Malwarebytes Anti-Malware (reboot)"="d:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-12-11 1394000]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-11 112496]
"avp"="d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-07-03 303376]
"4shared Update"="d:\program files\4shared Desktop\checkUpdate.exe" [2009-09-29 1337344]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-12-11 222616]
 d:\documents and settings\All Users\Start Menu\Programs\Startup\
TVR Scheduler.lnk - d:\program files\honestech\honestech TVR 2.5\scheduleTV.exe [2009-11-26 389120]
 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
 [COLOR=RED] SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [/COLOR]
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"
 [HKLM\~\startupfolder\D:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Xfire.lnk]
path=d:\documents and settings\Administrator\Start Menu\Programs\Startup\Xfire.lnk
backup=d:\windows\pss\Xfire.lnkStartup
 [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=d:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
 [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Snagit 9.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Snagit 9.lnk
backup=d:\windows\pss\Snagit 9.lnkCommon Startup
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4shared Desktop]
2009-12-07 10:44 3632640 ----a-w- d:\program files\4shared Desktop\desktop.exe
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
2008-02-14 17:02 3235552 ----a-w- d:\program files\Babylon\Babylon-Pro\Babylon.exe
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
2009-11-29 13:56 3171760 ----a-w- d:\program files\Internet Download Manager\IDMan.exe
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-03 22:06 1667584 ------w- d:\program files\Messenger\msmsgs.exe
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2009-11-15 11:20 331365 ----a-w- d:\program files\UltraVPN\bin\openvpn-gui.exe
 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-11-03 15:23 1217808 ----a-w- d:\program files\Steam\Steam.exe
 [HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\AppServ\\Apache2.2\\bin\\httpd.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"d:\\Program Files\\Steam\\steamapps\\wldabumt3b\\day of defeat source\\hl2.exe"=
"d:\\Program Files\\Steam\\steamapps\\wldabumt3b\\counter-strike source\\hl2.exe"=
"d:\\Program Files\\Xfire\\Xfire.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\WINDOWS\\system32\\nwiz.exe"=
"d:\\Program Files\\Intel Audio Studio\\IntelAudioStudio.exe"=
"d:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
 R0 klbg;Kaspersky Lab Boot Guard Driver;d:\windows\system32\drivers\klbg.sys [12/15/2008 8:41 PM 33808]
R1 VBoxDrv;VirtualBox Service;d:\windows\system32\drivers\VBoxDrv.sys [10/29/2009 10:41 PM 115856]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;d:\windows\system32\drivers\VBoxUSBMon.sys [10/29/2009 10:41 PM 41424]
R2 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe [1/9/2007 7:17 PM 20539]
R3 abp470n5;abp470n5;\??\d:\windows\system32\drivers\jdinml.sys --> d:\windows\system32\drivers\jdinml.sys [?]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [5/13/2009 5:46 PM 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;d:\windows\system32\drivers\klmouflt.sys [5/16/2009 8:59 PM 19472]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;d:\windows\system32\drivers\VBoxNetAdp.sys [10/29/2009 10:41 PM 91856]
R3 VBoxNetFlt;VBoxNetFlt Service;d:\windows\system32\drivers\VBoxNetFlt.sys [9/9/2009 8:15 PM 100368]
S2 WTService;WTService;d:\windows\system32\atwtusb.exe -s --> d:\windows\system32\atwtusb.exe -s [?]
S3 TridVid;Trident Analog Video;d:\windows\system32\drivers\TridVid.sys [11/26/2009 11:40 PM 201216]
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://yads.zedo.com/ads2/c?a=655555;g=0;c=929000054;p=6;f=811824;h=574042;i=0;x=3840;n=929;s=7;k=http://www.skill2thrill.com/pages/Default.aspx?lan=sa&tid=38&affiliateid=afunz
uInternet Settings,ProxyOverride = *.local
IE: &Download all 4shared files - d:\program files\4shared Desktop\down_all.htm
IE: &Download using 4shared Desktop - d:\program files\4shared Desktop\down_link.htm
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Translate with &Babylon - d:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
DPF: Microsoft XML Parser for Java - [URL="file:///"]file://d:\windows\Java\classes\xmldso.cab[/URL]
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x02y25ch.default\
FF - component: d:\documents and settings\Administrator\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\x02y25ch.default\extensions\firedownload@mozilla.org\components\firedownload.dll
FF - component: d:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
 ---- FIREFOX POLICIES ----
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
 **************************************************************************
 catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [URL="http://www.gmer.net/"]http://www.gmer.net[/URL]
Rootkit scan 2009-12-11 20:43
Windows 5.1.2600 Service Pack 2 NTFS
 scanning hidden processes ...  
 scanning hidden autostart entries ... 
 scanning hidden files ...  
 scan completed successfully
hidden files: 0
 **************************************************************************
 [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mysql]
"ImagePath"="c:\appserv\MySQL\bin\mysqld-nt --defaults-file=c:\appserv\MySQL\my.ini mysql"
.
Completion time: 2009-12-11  20:46:10
ComboFix-quarantined-files.txt  2009-12-11 17:46
ComboFix2.txt  2009-12-07 20:38
ComboFix3.txt  2009-11-28 12:04
ComboFix4.txt  2009-11-28 11:48
ComboFix5.txt  2009-12-11 17:33
 Pre-Run: 5,228,908,544 bytes free
Post-Run: 5,180,297,216 bytes free
 - - End Of File - - 4C3114544A8167B442568F4EAC0D81AF

 

make this


downlaod
http://www.softpedia.com/get/Tweak/System-Tweak/XP-Quick-Fix-Plus.shtml

 

وش المطلوب بالضبط ؟!

 

اعمل Enable Task Manager على اليسار فوق
وجنبها Enable registry

 

thanksss

 

اهلا بك
ادخل هذه الصفحة

http://noor.zyzoom.org/

وحمل اداة المكافي
شغلها بدبل كلك واتركها حتى تنتهي صفحة الدوس من الفحص والتنظيف
ثم توجه الى القرص c ،، وقم بضغط التقرير noor_mcafee
وارفعه على هذا الموقع

http://www.eupload.org/index.php

وارفق رابط التحميل بمشاركتك القادمة

 

لا جديد ، نفس المشكله ..!

 

استخدم التالي
تحميل برنامج المكافي
من الرابط التالي
http://noor.zyzoom.org/



واستخدم التالي بعد التحميل اضغط CHECK ALLي ثم زر REMOVE
http://www.mediafire.com/?z2mm2iwugey


سوري وضعط المشاركه بعد مشاركه الاخوان فوق وفي نفس اللحظه

 

الرابط ما يشتغل

 

حمل من هنا

http://www.up-master.com/data/zx.rar

 

كويس اني محملها من زمان ، جاري التشغيل ..

 

طلع فايروس Sality انا مدري وش الي خلاني اشبك فلاش ما استخدمته من فوق السنه :/ توبه استخدم فلاشات بعد اليوم :/ القهر اني شابك هاردسك فيه اشياء مهمه وقت ما كان مشبوك الفلاش ، لا يكون انتقل له بس :/ والحمد لله ما لحق يحذف برامج الا الجافا والوافي، ان شاء الله يمدي امسحه قبل لا يكمل شغله !

انتظر ينتهى وانزل التقرير ..

 

ايضا استخدم هذا الموضوع ممتاز جدا

احمي الفلاش ميمورى و اجعله له مناعة تامة من جميع انواع فيروسات الاتورن الخبيثه بهذه الاداة الصغيره العجيبه !!

 

شكله وصل لكل البرامج ! لأني اشوف اغلب البرامج يقول انها فايروس بس الغريب انها شغاله بدون مشاكل..

سؤالي هل يمكن مسحه مع الحفاظ على البرامج ؟
​

 

لاهنت خلص فحص وهات التقرير وبعدين نكمل

 

تفضل عزيزي

http://www.mediafire.com/?niyyh2kjjoo

الـeupload شكله زعلان علي لأنه كل ما جيت ارفع تعلق الصفحه !

 

عطل خاصية استعادة النظام
ثم حمل التالي واستخدمه
http://www.mediafire.com/?tjtejmm0mqm

بعد ذلك حمل التالي واستخدمه
بعد التحميل اضغط CHECK ALL ثم زر REMOVE
http://www.mediafire.com/?z2mm2iwugey


وحدث برنامج الحمايه لديك ان كان كاسبر فهو افضل والم يكن حمل واستخدم التالي
:: أداة الكاسبر لتنظيف وحذف الفيروسات مستعصية الحذف من النظام بحلتها الجديدة | Kaspersky Virus Removal Tool 2010 | :: ‏

 

جاري ان شاء الله .. ألف شكر مقدماً.

 

اعمل التالي

حمل الاداة التالية

www.zyzoom.net/shswelh/a-bc513899ae.exe

شغلها واعمل كما الشرح





ثم نظف جهازك بهذه الاداة

http://tools.zyzoom.org/tools/system/zyzoom_cleaner.com

وبلغنا اخر النتائج

 

بارك الله فيك هذه الاداه بالاعلى
نفس عمل هذه الاداه
بعد ذلك حمل التالي واستخدمه
بعد التحميل اضغط check all ثم زر remove
http://www.mediafire.com/?z2mm2iwugey


ولكن منكم نستفيد واعذرونا على التداخل في حل المشكله ونترك الامر لشخصكم الكريم