مشكلة في ملفات الأوفيس2003

المصدر: مشكلة في ملفات الأوفيس2003
في منتدى : منتدى مشاكـل وحلول الحـاسب

السلام عليكم ومسائك طيب .

أخواني يبدو أن حاسوبي تعرض لفيروس غريب قام بتغيير شكل ملفات برامج الأوفيس 2003 ...
وسأدرج صورة عن المشكلة متمنيا منكم المساعدة في هذه المشكلة الغريبة .

 

يمكن اول شي تاتي بصورة من الملفات الي غيرهن
ومن تم ايش من مكافح تستخدمة

 

عندي الكاسبر انترسيكيورتي 8، والغريب أنه غير شكل ملفات برامج الأوفيس 2003 فقط ...

 

حمل هذا البرنامج
www.zyzoom.net/shswelh/Zyzoom_HijackThis.exe
بعدها اغلق جميع البرامج وخصوصا الانترنت اكسبلورر والماسنجر
شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم​

 

وهذا هو التقرير يا زيزوميين /

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:07:33 م, on 13/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\apache\Apache.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
c:\apache\Apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
c:\apache\APACHE.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\apache\APACHE.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
D:\Desktop\برامج\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.s-oman.net/avb/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.emi.ae
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader 8.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realone player\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll
O14 - IERESET.INF: START_PAGE_URL=www.emi.ae
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Apache - Unknown owner - c:\apache\Apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: PHPGeekUtil - Unknown owner - c:\apache\APACHE.EXE
--
End of file - 7860 bytes

 

كل ملفات الاوفيس او بس الورد مثلاا ؟

 

اعتذر عن التأخير ، فقط ملفات الأوفيس 2003 هي التي تظهر بهذه الصورة .

رغم أني مثبت في جهازي منذ فترة طويلة أيضا الأوفيس 2007 ولكن الملفات ليس بها مشكلة .

المشكلة ظهرت عندما استعرت هارديسك خارجي من أحد الأخوة ويبدو أنه كان ملغوم .

 

اخى ماكس يقصد اى ملف تبع الاوفيس 2003 يعنى كل ملفات الوورد و الاكسيس و الاكسل و هكذا ام الوورد فقط
​

 

بالضبط كل ملفات الورد والأكسل والأكسس والبوربوينت تبع اوفيس2003...

 

عطل برامج الحماية عن العمل
[شرح] تعطيل برامج الحماية عن العمل لاستخدام ادوات الصيانة ‏
ثم
حمل الاداة التالية واحفظها على سطح المكتب

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة​

 

سأعمل الخطوة الآن وسأرد عليكم قريبا .

 

هذا التقرير النهائي ... مع امنياتي بحل المشكلة

ComboFix 10-02-12.01 - Administrator 02/13/2010 20:40:58.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1256.968.1033.18.446.104 [GMT 4:00]
Running from: c:\documents and settings\Administrator\My Documents\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\hpe29.dll
c:\documents and settings\All Users\Application Data\hpeB2.dll
c:\recycler\S-1-5-21-0985058970-0651154414-076649484-9242
c:\recycler\S-1-5-21-3797602510-2425493121-969505164-4426
c:\recycler\S-1-5-21-6093307761-1208041785-873893821-2318
c:\recycler\S-1-5-21-6093307761-1208041785-873893821-2318\Desktop.ini
c:\recycler\S-1-5-21-6093307761-1208041785-873893821-2318\hd1.exe
.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.
2010-02-13 16:35 . 2010-02-13 16:35 388608 ----a-w- c:\windows\system32\CF11511.exe
2010-02-13 14:50 . 2010-01-23 13:34 -------- d-----w- C:\تشغيل جميع القنوات على التحدى
2010-02-12 12:20 . 2010-02-12 12:20 574464 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\300000007100002i\SETUP.EXE
2010-02-12 12:20 . 2010-02-12 12:20 574464 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\300000008c00002i\offlb.exe
2010-02-12 12:19 . 2010-02-12 12:19 574464 ----a-w- c:\documents and settings\Administrator\Application Data\Thinstall\Microsoft Office Enterprise 2007\10000001b00002i\msiexec.exe
2010-02-12 12:19 . 2010-02-12 12:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Thinstall
2010-02-11 18:15 . 2010-02-11 18:40 -------- d-----w- c:\program files\MDPT
2010-02-05 04:26 . 2010-02-05 04:28 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-05 04:25 . 2008-01-09 08:28 27632 ----a-w- c:\windows\system32\drivers\seehcri.sys
2010-02-05 04:20 . 2010-02-05 04:20 -------- d-----w- c:\program files\Avanquest update
2010-02-05 04:12 . 2010-02-05 04:25 -------- d-----w- c:\program files\Sony Ericsson
2010-02-05 04:12 . 2010-02-05 04:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Ericsson
2010-02-04 15:24 . 2010-02-13 15:57 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-04 15:24 . 2010-02-04 15:24 -------- d-----w- c:\program files\Classic Menu for Office
2010-02-04 05:18 . 2010-02-05 08:36 -------- d-----w- C:\winnt
2010-02-04 05:18 . 2010-02-04 05:23 -------- d-----w- C:\phptriad
2010-02-04 05:17 . 2010-02-05 08:36 -------- d-----w- C:\apache
2010-01-28 18:07 . 2010-01-24 05:55 -------- d-----w- C:\CCcam_ChannelInfo_Providers_Prio
2010-01-28 15:05 . 2010-02-12 14:23 -------- d-----w- c:\documents and settings\Administrator\Application Data\dvdcss
2010-01-27 17:48 . 2010-01-27 17:48 -------- d-----w- c:\program files\Common Files\xing shared
2010-01-27 17:48 . 2010-01-27 17:48 -------- d-----w- c:\program files\real
2010-01-27 17:20 . 2010-01-27 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Zoom Player
2010-01-27 17:20 . 2010-01-27 17:23 -------- d-----w- c:\program files\Zoom Player
2010-01-27 17:17 . 2010-02-10 17:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-01-27 16:49 . 2010-01-27 16:49 -------- d-----w- c:\documents and settings\Administrator\Application Data\Vso
2010-01-27 16:49 . 2010-01-27 16:49 81920 ----a-w- c:\documents and settings\Administrator\Application Data\ezpinst.exe
2010-01-27 16:49 . 2010-01-27 16:49 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-01-27 16:49 . 2010-01-27 16:49 47360 ----a-w- c:\documents and settings\Administrator\Application Data\pcouffin.sys
2010-01-27 16:49 . 2006-09-16 00:44 314368 ----a-w- c:\windows\system32\avisynth.dll
2010-01-27 16:49 . 2004-05-26 02:37 719872 ----a-w- c:\windows\system32\devil.dll
2010-01-27 16:49 . 2010-01-27 16:52 -------- d-----w- c:\program files\Video Convert Master
2010-01-25 18:58 . 2010-01-25 18:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ahead
2010-01-21 17:00 . 2010-01-21 17:00 -------- d-----w- c:\program files\Studio V5
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-13 16:50 . 2010-01-09 21:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-13 16:49 . 2010-01-09 21:25 524320 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-02-13 16:49 . 2010-01-09 21:25 3920 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-13 16:47 . 2010-01-09 21:25 3053600 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-13 16:47 . 2010-01-09 21:25 25984 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-13 15:11 . 2004-01-14 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-02-12 15:53 . 2004-01-12 16:30 1809440 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-07 20:05 . 2004-01-12 18:23 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2010-02-05 04:25 . 2004-01-12 16:55 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-05 04:13 . 2010-02-05 04:13 -------- d-----w- c:\documents and settings\All Users\Application Data\BVRP Software
2010-01-27 17:53 . 2010-01-27 16:58 -------- d-----w- c:\program files\Winamp
2010-01-27 17:48 . 2004-01-12 17:10 -------- d-----w- c:\program files\Common Files\Real
2010-01-27 17:48 . 2004-01-12 16:34 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-01-27 17:48 . 2004-01-12 16:34 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-01-27 17:46 . 2004-01-14 17:14 -------- d-----w- c:\program files\Google
2010-01-27 17:02 . 2010-01-27 16:58 -------- d-----w- c:\documents and settings\Administrator\Application Data\Winamp
2010-01-09 22:16 . 2008-01-29 14:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2010-01-09 22:16 . 2010-01-09 21:26 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-01-09 22:16 . 2010-01-09 21:26 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-01-09 22:15 . 2010-01-09 22:15 44808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\fssync.dll
2010-01-09 22:15 . 2010-01-09 22:15 208616 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\avp.exe
2010-01-09 22:15 . 2010-01-09 22:15 33808 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\klbg.sys
2010-01-09 22:15 . 2010-01-09 22:15 213520 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.454\XP\klif.sys
2010-01-09 21:25 . 2010-01-09 21:25 -------- d-----w- c:\program files\Kaspersky Lab
2010-01-09 21:22 . 2010-01-09 21:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-01-07 13:25 . 2004-01-12 17:06 -------- d-----w- c:\program files\JetAudio
2010-01-07 13:25 . 2010-01-07 13:25 -------- d-----w- c:\documents and settings\Administrator\Application Data\COWON
2010-01-07 12:53 . 2010-01-07 12:53 10240 ----a-w- c:\documents and settings\Administrator\Application Data\GRETECH\GomPlayer\GrLauncherTempSetup.exe
2010-01-07 07:47 . 2010-01-07 07:47 -------- d-----w- c:\program files\FlashTools
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-27 39408]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2010-01-09 208616]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-01-27 198160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Arabic Social Interface]
1996-10-31 18:41 541696 ----a-w- c:\program files\Family Programs 2\Social\SKRASI.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-01-02 13:41 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-03 20:56 15360 ------w- c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2007-05-15 11:55 1057328 ----a-w- c:\program files\Nero\Nero 7\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 11:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2004-01-12 17:09 282624 ----a-w- c:\program files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-06-28 06:54 16248320 ------r- c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
2007-05-15 11:55 1628208 ----a-w- c:\program files\Nero\Nero 7\InCD\NBHGui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 10:04 2879488 ------r- c:\windows\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Administrator\\Desktop\\DCC.exe"=
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 06:29 م 33808]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [05/02/2010 08:25 ص 90112]
R2 PHPGeekUtil;PHPGeekUtil;c:\apache\Apache.exe [25/01/2002 08:30 ص 20480]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 07:02 م 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 06:06 م 24592]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [05/02/2010 08:25 ص 27632]
S3 BulkUsb;FABULK;c:\windows\system32\Drivers\FABulk.sys --> c:\windows\system32\Drivers\FABulk.sys [?]
S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [05/02/2010 08:13 ص 86824]
S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [05/02/2010 08:13 ص 15016]
S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [05/02/2010 08:13 ص 114600]
S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [05/02/2010 08:13 ص 108328]
S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [05/02/2010 08:13 ص 26024]
S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [05/02/2010 08:13 ص 104616]
S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [05/02/2010 08:13 ص 109736]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.s-oman.net/avb/index.php
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open Picture in &Microsoft PhotoDraw - c:\progra~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\evntsvc.exe
AddRemove-HijackThis - d:\desktop\برامج\HijackThis.exe
AddRemove-آفاق المعرفة 1.2.5 - c:\Uninstall.exe

**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 20:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(808)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3236)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-02-13 20:55:11 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-13 16:55
Pre-Run: 28,746,063,872 bytes free
Post-Run: 28,841,775,104 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 5D24F56525E2915D0E1B8CA0FC386998

 

للرفع والاهتمام .

 

استخدم هذا الملف ثم اعد تشغيل الجهاز

http://www.mediafire.com/?momio4zd4qx

 

للأسف المشكلة بعدها موجودة نزلت الملف وشغلته واعدت تشغيل الجهاز ونفس الشئ ما في جديد .
متابع معكم حتى نهاية الحلول .

 

حلي الاخير
اعادة تثبيت الاوفيس 2007 من جديد

 

نعم أخي ماكس هذا آخر حلولي سأعيد تثبيت الأوفيس 2003 .
شكرا على المجهود وأتمنى تنحل المشكلة بإعادة تثبيت الأوفيس من جديد .

 

قمت بحذف الاوفيس2003 ، واعدت تثبيته وحلت المشكلة ...
هذا للعلم وللاستفادة .