ما أصدق :y: انحلت المشكلة بعد مرمطة وتعب أيام .
والفضل بعد الله سبحانه وتعالى .... ثم الأخ العزيز فارس الملاك 
k: بالفعل فارس اسم على مسمى وبصراحه أهنئ المنتدى على وجود عضو مثلك ، ويشرفني أني أكون عضو بمنتداكم الراااائع
أخ فارس الملاك أنا سويت كل اللي قلتلي بالخطوات السابقة وبعدها اعاد تشغيل الجهاز وكمل البرنامج مسيرته بعدها قمت بتنزيل الكاسبر وعلطوووول نزله وطبعاً عندي تقريرين الاول للبرنامج كامبوفكس والثاني للهاجك .
التقرير الاول :
ComboFix 08-06-20.4 - Administrator 06/23/2008 9:50:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.270 [GMT 3:00]
Running from: C:\Documents and Settings\Administrator\سطح المكتب\اداة\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\Documents and Settings\Administrator\Application Data\tazebama
C:\Documents and Settings\Administrator\Application Data\tazebama\zPharaoh.dat
C:\Documents and Settings\Administrator\ravmonlog
C:\Documents and Settings\honizy\Application Data\tazebama
C:\Documents and Settings\honizy\Application Data\tazebama\zPharaoh.dat
C:\Documents and Settings\honizy\ravmonlog
C:\Documents and Settings\hook.dl_
C:\Documents and Settings\royaladmin\ravmonlog
C:\Documents and Settings\tazebama.dl_
C:\Documents and Settings\tazebama.dll
C:\Documents and Settings\user\ravmonlog
C:\Program Files\internet explorer\iekey.dll
C:\Program Files\internet explorer\iexp1ore.exe
C:\WINDOWS\svchost.ini
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\setting.ini
C:\zPharaoh.exe
D:\Autorun.inf
D:\RECYCLER\NokiaN73Tools.exe
D:\RECYCLER\RECYCLER .exe
----- File Replicators -----
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(1_2)\Copy of Week(1_2).exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(1_2)\Excersises\Excersises.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(1_2)\Source\Source.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(3)\Copy of Week(3).exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(3)\Excersises\Excersises.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(3)\Source\Source.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(4)\Copy of Week(4).exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Copy of Week(5).exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\bak\bak.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\bak\Circle\Circle.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\bak\constructure\constructure.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\classes\Circle\Circle.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\classes\classes.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\classes\constructure\constructure.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\classes\interfacing\interfacing.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\classes\package cache\package cache.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\classes\Polymorphism\Polymorphism.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\constructure.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\src\Circle\Circle.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\src\constructure\constructure.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\src\interfacing\interfacing.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\src\Polymorphism\Polymorphism.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\constructure\src\src.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(5)\Source\Source.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(6)\Copy of Week(6).exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(6)\Source\Ball\Ball.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(6)\Source\Ball\classes\classes.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(6)\Source\Ball\classes\package cache\package cache.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(6)\Source\Ball\src\src.exe
C:\Documents and Settings\user\سطح المكتب\totorials\Copy of Week(6)\Source\Source.exe
C:\WINDOWS\$hf_mig$\KB900485\update\update.exe
C:\WINDOWS\$hf_mig$\KB904706\update\update.exe
C:\WINDOWS\$hf_mig$\KB908519\update\update.exe
C:\WINDOWS\$hf_mig$\KB908531\update\update.exe
C:\WINDOWS\$hf_mig$\KB910437\update\update.exe
C:\WINDOWS\$hf_mig$\KB911280\update\update.exe
C:\WINDOWS\$hf_mig$\KB911562\update\update.exe
C:\WINDOWS\$hf_mig$\KB911567\update\update.exe
C:\WINDOWS\$hf_mig$\KB911927\update\update.exe
C:\WINDOWS\$hf_mig$\KB912919\update\update.exe
C:\WINDOWS\$hf_mig$\KB913580\update\update.exe
C:\WINDOWS\$hf_mig$\KB914388\update\update.exe
C:\WINDOWS\$hf_mig$\KB914389\update\update.exe
C:\WINDOWS\$hf_mig$\KB916595\update\update.exe
C:\WINDOWS\$hf_mig$\KB917159\update\update.exe
C:\WINDOWS\$hf_mig$\KB917344\update\update.exe
C:\WINDOWS\$hf_mig$\KB917422\update\update.exe
C:\WINDOWS\$hf_mig$\KB917953\update\update.exe
C:\WINDOWS\$hf_mig$\KB918118\update\update.exe
C:\WINDOWS\$hf_mig$\KB918439\update\update.exe
C:\WINDOWS\$hf_mig$\KB918899\update\update.exe
C:\WINDOWS\$hf_mig$\KB919007\update\update.exe
C:\WINDOWS\$hf_mig$\KB920213\update\update.exe
C:\WINDOWS\$hf_mig$\KB920214\update\update.exe
C:\WINDOWS\$hf_mig$\KB920670\update\update.exe
C:\WINDOWS\$hf_mig$\KB920683\update\update.exe
C:\WINDOWS\$hf_mig$\KB920685\update\update.exe
C:\WINDOWS\$hf_mig$\KB920872\update\update.exe
C:\WINDOWS\$hf_mig$\KB921398\update\update.exe
C:\WINDOWS\$hf_mig$\KB921503\update\update.exe
C:\WINDOWS\$hf_mig$\KB921883\update\update.exe
C:\WINDOWS\$hf_mig$\KB922582\update\update.exe
C:\WINDOWS\$hf_mig$\KB922616\update\update.exe
C:\WINDOWS\$hf_mig$\KB922760\update\update.exe
C:\WINDOWS\$hf_mig$\KB922819\update\update.exe
C:\WINDOWS\$hf_mig$\KB923414\update\update.exe
C:\WINDOWS\$hf_mig$\KB923694\update\update.exe
C:\WINDOWS\$hf_mig$\KB923980\update\update.exe
C:\WINDOWS\$hf_mig$\KB924191\update\update.exe
C:\WINDOWS\$hf_mig$\KB924270\update\update.exe
C:\WINDOWS\$hf_mig$\KB924496\update\update.exe
C:\WINDOWS\$hf_mig$\KB925454\update\update.exe
C:\WINDOWS\$hf_mig$\KB925486\update\update.exe
C:\WINDOWS\$hf_mig$\KB925902\update\update.exe
C:\WINDOWS\$hf_mig$\KB926255\update\update.exe
C:\WINDOWS\$hf_mig$\KB926436\update\update.exe
C:\WINDOWS\$hf_mig$\KB927779\update\update.exe
C:\WINDOWS\$hf_mig$\KB927802\update\update.exe
C:\WINDOWS\$hf_mig$\KB927891\update\update.exe
C:\WINDOWS\$hf_mig$\KB928255\update\update.exe
C:\WINDOWS\$hf_mig$\KB928843\update\update.exe
C:\WINDOWS\$hf_mig$\KB929123\update\update.exe
C:\WINDOWS\$hf_mig$\KB929338\update\update.exe
C:\WINDOWS\$hf_mig$\KB929969\update\update.exe
C:\WINDOWS\$hf_mig$\KB930178\update\update.exe
C:\WINDOWS\$hf_mig$\KB930916\update\update.exe
C:\WINDOWS\$hf_mig$\KB931261\update\update.exe
C:\WINDOWS\$hf_mig$\KB931768-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB931784\update\update.exe
C:\WINDOWS\$hf_mig$\KB931836\update\update.exe
C:\WINDOWS\$hf_mig$\KB932168\update\update.exe
C:\WINDOWS\$hf_mig$\KB933360\update\update.exe
C:\WINDOWS\$hf_mig$\KB933566-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB933729\update\update.exe
C:\WINDOWS\$hf_mig$\KB935839\update\update.exe
C:\WINDOWS\$hf_mig$\KB935840\update\update.exe
C:\WINDOWS\$hf_mig$\KB936021\update\update.exe
C:\WINDOWS\$hf_mig$\KB936357\update\update.exe
C:\WINDOWS\$hf_mig$\KB938127-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB938828\update\update.exe
C:\WINDOWS\$hf_mig$\KB938829\update\update.exe
C:\WINDOWS\$hf_mig$\KB939653-IE7\update\update.exe
C:\WINDOWS\$hf_mig$\KB941202\update\update.exe
C:\WINDOWS\SoftwareDistribution\Download\21d35331b296ccdf85e78d7de12c492d\update\update.exe
C:\WINDOWS\SoftwareDistribution\Download\d1a4285ae9e17c1dc59d2d8d8a36a810\update\update.exe
.
.
((((((((((((((((((((((((( Files Created from 2008-05-23 to 2008-06-23 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-23 06:57 --------- d-----w C:\Documents and Settings\Administrator\Application Data\tazebama
2008-06-23 05:09 --------- d-----w C:\Program Files\Samy Soft
2008-06-22 08:21 --------- d-----w C:\Program Files\Nokia
2008-06-22 08:21 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-22 08:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-22 08:14 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-06-15 08:37 --------- d-----w C:\Documents and Settings\honizy\Application Data\COWON
2008-05-21 09:23 314,735 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
2008-05-21 09:22 925,039 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
2008-05-19 08:15 260,308 ----a-w C:\xo8wr9.exe
2008-05-19 06:43 229,743 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-19 06:41 172,032 ------w C:\WINDOWS\Setup1.exe
2008-05-19 06:41 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-04-29 08:17 --------- d-----w C:\Program Files\xat.com Image Optimizer
.
كود:
<pre>
----a-w 155,001 2008-06-23 06:50:15 C:\QooBox\Qoobox .exe
----a-w 154,801 2008-06-23 06:50:15 C:\QooBox\Quarantine\Quarantine .exe
----a-w 155,751 2008-06-23 06:50:15 C:\QooBox\Quarantine\D\D .exe
----a-w 154,801 2008-06-23 06:51:01 C:\QooBox\Quarantine\D\RECYCLER\RECYCLER .exe
</pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:00 PM 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 03:00 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^palstart.exe]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\palstart.exe
backup=C:\WINDOWS\pss\palstart.exeCommon Startup
[HKLM\~\startupfolder\^NTUSER.DAT]
path=\NTUSER.DAT
backup=C:\WINDOWS\pss\NTUSER.DATCommon Startup
[HKLM\~\startupfolder\^NtUser.dat.LOG]
path=\NtUser.dat.LOG
backup=C:\WINDOWS\pss\NtUser.dat.LOGCommon Startup
[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
backup=C:\WINDOWS\pss\ntuser.iniCommon Startup
[HKLM\~\startupfolder\^RavMonLog]
path=\RavMonLog
backup=C:\WINDOWS\pss\RavMonLogCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AFProg]
--a------ 07/23/2006 12:44 PM 118784 C:\Program Files\Hotspot Shield\AnchorFree\ctrl\AFController.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]
C:\WINDOWS\system32\amvo.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP]
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/04/2004 03:00 PM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
-ra------ 08/20/2004 08:51 PM 118784 C:\WINDOWS\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 01/07/2004 01:02 PM 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
-ra------ 08/20/2004 08:55 PM 155648 C:\WINDOWS\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 10:50 AM 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RRT-Auto]
H:\برامج اساسية لكل جهاز\برامج الصيانة والادوات\اقوى اداة عند اختفاء خيارات المجلد او امر تشغيل او ادارة المهام\RRT.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient 2.6]
--a------ 02/27/2004 08:29 PM 61440 C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 02/27/2008 08:31 AM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup 2.5]
--a------ 05/20/2004 07:40 PM 188416 C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12485:TCP"= 12485:TCP:NortonAV
"17354:TCP"= 17354:TCP:NortonAV
"16726:TCP"= 16726:TCP:NortonAV
"14205:TCP"= 14205:TCP:NortonAV
"17672:TCP"= 17672:TCP:NortonAV
"13356:TCP"= 13356:TCP:NortonAV
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [07/23/2006 12:44 PM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\zPharaoh.exe
\Shell\explore\command - C:\zPharaoh.exe
\Shell\open\command - C:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\zPharaoh.exe
\Shell\explore\command - D:\zPharaoh.exe
\Shell\open\command - D:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{740316a0-a238-11dc-af4a-000ffe28fcfb}]
\Shell\AutoRun\command - I:\zPharaoh.exe
\Shell\explore\command - I:\zPharaoh.exe
\Shell\open\command - I:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{753bbbf8-d221-11dc-af5c-000ffe28fcfb}]
\Shell\AutoRun\command - F:\xo8wr9.exe
\Shell\explore\Command - F:\xo8wr9.exe
\Shell\open\Command - F:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{753bbbf9-d221-11dc-af5c-000ffe28fcfb}]
\Shell\AutoRun\command - G:\xo8wr9.exe
\Shell\explore\Command - G:\xo8wr9.exe
\Shell\open\Command - G:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{753bbbfa-d221-11dc-af5c-000ffe28fcfb}]
\Shell\AutoRun\command - H:\xo8wr9.exe
\Shell\explore\Command - H:\xo8wr9.exe
\Shell\open\Command - H:\xo8wr9.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d668780-2c83-11dd-8c12-000ffe28fcfb}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-06-23 09:57:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\autorun.inf 126 bytes
C:\zPharaoh.exe 154781 bytes executable
scan completed successfully
hidden files: 2
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Qoobox\Quarantine\C\Documents and Settings\tazebama.dl_.vir
.
**************************************************************************
.
Completion time: 06/23/2008 9:59:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-23 06:58:50
Pre-Run: 25,111,388,160 bytes free
Post-Run: 25,062,154,240 bytes free
291 --- E O F --- 2007-10-25 00:02:46
والتقرير الثاني :
Logfile of HijackThis v1.99.1
Scan saved at 10:00:48 ص, on 23/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\tazebama.dl_
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\سطح المكتب\اداة\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rsii.gotevot.edu.sa
O17 - HKLM\Software\..\Telephony: DomainName = rsii.gotevot.edu.sa
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rsii.gotevot.edu.sa
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = rsii.gotevot.edu.sa
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
انا اللي مستغرب له أني حذفت اللي قلتلي عليه بالهاجك لكن رجعت يوم عدت التشغيل وأتوقع والعلم عند الله أن اداة كامبوفكس هي اللي حلت المشكلة .
المهم أن المشكلة اللي هبلت فيني ما كانت بجهاز واحد في أربعة أجهزة في العمل مع العلم أنني أخش على الادمن لكن ما فيه فايدة الجهاز يرفض نزول الكاسبر .
عموماً / الف شكر لأخي فارس الملاك والله يعطيك الف عافية على مجهودك الرائع ... وأتمنى أن تعطيني وش السبب اللي خلى الجهاز ما يقبل تنزيل أي برامج الحماية k:
