مشكله في outlook

ع

عاقلهم مجنون

زيزوومي جديد
إنضم
27 نوفمبر 2008
المشاركات
77
مستوى التفاعل
0
النقاط
80
غير متصل
ترتيب حسب التاريخ ترتيب حسب الأصوات
الله يجزاك خير اخوي بس للاسف مانحلت المشكله
وهذا رساله البرنامج اللي اعطيتني
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


وللعلم اخوي هالفيروس مسبب مشكل كثيره منها تكرر الملفات والخصائص ماتشتغل ولوحه التحكم
 
تأييد 0
يعطيك العاااافيه اخوي ع اهتمامك
وهذا التقرير


************' Anti-Malware 1.50.1.1100
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


Database version: 6449

Windows 5.1.2600 Service Pack 1
Internet Explorer 6.0.2800.1106

22/05/2001 08:08:24 م
mbam-log-2001-05-22 (20-08-24).txt

Scan type: Full scan (C:\|D:\|F:\|)
Objects scanned: 158275
Time elapsed: 9 minute(s), 16 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 6
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 25

Memory Processes Infected:
c:\WINDOWS\system32\KHATRA.exe (Worm.AutoIT) -> 1996 -> Unloaded process successfully.
c:\WINDOWS\system\gHost.exe (Worm.AutoIT) -> 1772 -> Unloaded process successfully.
c:\WINDOWS\Xplorer.exe (Fake.Dropped.Malware) -> 1760 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{69620165-77DD-44EE-995C-3632E525A22B} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{FF14B02B-6EE4-400F-A729-B0EA35F921C2} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1ECC44FB-970D-4BC8-90E3-002DA4DD21B8} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AOSMTP.FastSender.1 (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AOSMTP.FastSender (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\KHATRA (Worm.AutoIT) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AClntUsr (Worm.AutoIT) -> Value: AClntUsr -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host (Worm.AutoIT) -> Value: G_Host -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vptray (Fake.Dropped.Malware) -> Value: vptray -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xplorer (Fake.Dropped.Malware) -> Value: Xplorer -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title (Worm.AutoIT) -> Value: Window Title -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman (Worm.AutoIT) -> Value: Taskman -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman (Worm.AutoIT) -> Bad: (C:\WINDOWS\System32\KHATRA.exe) Good: () -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Worm.AutoIT) -> Bad: (C:\WINDOWS\System32\KHATRA.exe) Good: () -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (PUM.Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\finish.exe (Backdoor.Agent.VB) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\avphost.dll (Trojan.Banker) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ptnrtg.nn (Worm.Conficker) -> Quarantined and deleted successfully.
c:\WINDOWS\system32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\KHATRA.exe (Worm.AutoIT) -> Quarantined and deleted successfully.
c:\WINDOWS.exe (Worm.Venom) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\drivers.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\etc.exe (Worm.Venom) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\KHATRA.exe (Worm.AutoIT) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\spool\spool.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\system32.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\documents and settings\administrator\administrator.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\khatarnakh.exe (Worm.AutoIT) -> Quarantined and deleted successfully.
c:\WINDOWS\mario675.cab (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\new-screamsaver.com.cab (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\PCHEALTH\UploadLB\Binaries.exe (Worm.Archive) -> Quarantined and deleted successfully.
c:\WINDOWS\PCHEALTH\UploadLB\Config.exe (Worm.Archive) -> Quarantined and deleted successfully.
c:\WINDOWS\PCHEALTH\UploadLB\UploadLB.exe (Worm.Archive) -> Quarantined and deleted successfully.
c:\WINDOWS\supermodels.cab (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
c:\WINDOWS\system\gHost.exe (Worm.AutoIT) -> Quarantined and deleted successfully.
c:\WINDOWS\system\system.exe (Trojan.Banker) -> Quarantined and deleted successfully.
c:\WINDOWS\twain_32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\WINDOWS.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Xplorer.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
 
تأييد 0
معليش يا غلا ..

هات هايجاك ثااني
 
توقيع : YHYA -KSA
تأييد 0
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 06:52:51 ص, on 24/05/1999
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Altiris\AClient\AClient.exe
C:\WINDOWS\System32\ChgService.exe
C:\Program Files\NetSupport\NetSupport School\client32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\sessmgr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Altiris\AClient\AClntUsr.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mobily\Mobily Connect Card\Mobily Connect Card.exe
C:\WINDOWS\System\gHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\Xplorer.exe
C:\Zyzoom_Forum_Tools\zyzoom.exe
C:\WINDOWS\System32\KHATRA.exe
C:\Zyzoom_Forum_Tools\zHijak.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Exploiter
F3 - REG:win.ini: load=C:\WINDOWS\System32\KHATRA.exe
O3 - Toolbar: &راديو - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\WINDOWS\Xplorer.exe
O4 - HKLM\..\Run: [AClntUsr] C:\WINDOWS\System32\KHATRA.exe
O4 - HKLM\..\Run: [Xplorer] "C:\WINDOWS\Xplorer.exe" /Windows
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [G_Host] "C:\WINDOWS\System\gHost.exe" /Reproduce
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: (Empty).LNK = C:\KHATRA.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\netsupport\netsupport school\nslsp.dll
O14 - IERESET.INF: START_PAGE_URL=http://teacher/elns2ar/index.php
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A4C7A27-2767-4A14-9F26-0602890F03DD}: NameServer = 86.51.35.18 86.51.34.18
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: البرنامج الخفي لذاكرة التخزين المؤقت لفئات المكونات - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\WINDOWS\Altiris\AClient\AClient.exe
O23 - Service: Change Modem Device Service - Unknown owner - C:\WINDOWS\System32\ChgService.exe
O23 - Service: Client32 - NetSupport Ltd - C:\Program Files\NetSupport\NetSupport School\client32.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: GuiHook - Unknown owner - C:\PROGRA~1\NETSUP~1\guihook.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

--
End of file - 5265 bytes​
 
تأييد 0
O3 - Toolbar: &راديو - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx


O17 - HKLM\System\CCS\Services\Tcpip\..\{6A4C7A27-2767-4A14-9F26-0602890F03DD}: NameServer = 86.51.35.18 86.51.34.18




اعمل التالي بلترتيب .. واذا ل ينفع .. احذف الاوفيس كامل وسطبه مره ثانيه

اداة smitraudfix

بعد عمل ذالك ..

حمل الادااه هذي وشغلها .. واتركها هيه تتسكر وبعدين اعمل

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



وبعدين عمل ...

تنظيف مخلفات الجهاز


بعد عمل التنظيف حملي

الاداه .. التاليه

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


بعد التحميل .. فك الظغط وافتي جميع الرجستر واستبدلها بموافق . . .


وبعدين اعيد التشغيل شغل البرنامج التي كانت مع الريجستر .. واعطنا ايش صار معاك الجهاز
 
توقيع : YHYA -KSA
تأييد 0
اخوي الرابط الاخير مو شغااال
والجهاز نفس اول ماتغير شي
 
تأييد 0
طيب يا اخوي هذا هوه الرابط الاخير

اوكي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


احذف النسخه وسطبها من جديد بعد عمل ... الي قلتلك
 
توقيع : YHYA -KSA
تأييد 0
اخوي حملت الرجستر
بس للاسف تطلع رساله(تم تعطيل تحرير التسجيل من قبل المسوؤل)
 
تأييد 0
اخوي ياليت القي برنامج يحذف فايروس تكرر الملفات
بحثت ومالقيت
 
تأييد 0
توقيع : YHYA -KSA
تأييد 0
هلا اخوي واسف ع التاخير
بس اخوي اداره المهام تعمل بشكل طبيعي
والرابط مو شغال
 
تأييد 0
يجب تسجيل الدخول أو التسجيل كي تتمكن من الرد هنا.
عودة
أعلى