جهازي مصاب بفيروس عنيد

[جــ الحبيب ــرح]

السلام عليكم ورحمة الله وبركاتة
لا اطيل عليكم ولا اكثر من المديح والثناء على المنتدى ومن فيه
لانهم في غنى عن التعريف وعند الله جزائهم واجرهم ان شاء الله
مشكلتي يا اخوتي
قيل لي انه فيروس صيني
حيث اني استلمت من صديق لي ملف عبر الماسنجر على اساس انه اداة ازالة لفيروس جديد يدعى الفيروس الصيني
ومن يومها والنود كل شويه يطلع لي تحذير برغم اني سويت سكان وباخر تحديث
وسويت سكان اون لاين وقال الموقع انه حذف ملفات ومع هذا بين الساعه والاخرى
يعود النود للتحذير ارفق اليكم تقرير من جهازي وصوره من برنامج النود
ارجو مساعدتي وجزاكم الله عني خير الجزاء

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:35:31 ص, on 02/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Folder Guard Pro\FGKey.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\timezone.exe
C:\Program Files\HowbaniSoft\HowbaniSoft Internet Cafe Management System V80\CafeSysSvr.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Win32Pad\win32pad.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Ulead Systems\Ulead PhotoImpact 12\Iedit_.exe
C:\Program Files\Trend Micro HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O1 - Hosts: 202.165.102.205 972.aksjd11.com
O1 - Hosts: 202.165.102.205 w3og.cn
O1 - Hosts: 203.208.35.100 qazc.fourtw.cn
O1 - Hosts: 203.208.35.100

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 203.208.35.101

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 203.208.35.101

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 72.14.235.99 222.1212l112.net
O1 - Hosts: 72.14.235.99 444.1212l112.netn
O1 - Hosts: 72.14.235.99 555.1212l112.net
O1 - Hosts: 72.14.235.99 111.1212l112.net
O1 - Hosts: 65.55.21.250 111.3243l24.com
O1 - Hosts: 65.55.21.250 222.3243l24.com
O1 - Hosts: 65.55.21.250 333.3243l24.com
O1 - Hosts: 125.64.8.112 kao2.gmwo03.com
O1 - Hosts: 125.64.8.112 kao.gmwo06.com
O1 - Hosts: 125.64.8.112 444.gmwo07.com
O1 - Hosts: 116.252.185.15 ru.update365.us
O1 - Hosts: 116.252.185.15 ad.update365.us
O1 - Hosts: 207.46.232.182 popmails.net
O1 - Hosts: 203.208.37.99 3.goodhh.com
O1 - Hosts: 220.181.37.55 down.rwixr.com
O1 - Hosts: 160.79.42.52

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 63.175.76.152

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 219.133.40.91 qq.ljsll.com
O1 - Hosts: 203.208.35.102

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 209.132.177.50 973.aksjd11.com
O1 - Hosts: 209.132.177.50 974.aksjd11.com
O1 - Hosts: 209.132.177.50 971.aksjd11.com
O1 - Hosts: 209.132.177.50 975.aksjd11.com
O1 - Hosts: 72.14.235.104 user1.12-39.net
O1 - Hosts: 72.14.235.147

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 192.150.18.101 ata1.sysions.net
O1 - Hosts: 192.150.18.101 ata2.sysions.net
O1 - Hosts: 192.150.18.101 ata3.sysions.net
O1 - Hosts: 192.150.18.101 ata4.sysions.net
O1 - Hosts: 193.120.42.226 8nnnnn99.cn
O1 - Hosts: 24.39.54.34

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [FG_Monitor] C:\Program Files\Folder Guard Pro\FGKey.exe /Start
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [Timezone] "C:\WINDOWS\system32\timezone.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: + Offline &Explorer: Download the link -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\Offline Explorer Enterprise\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\Offline Explorer Enterprise\Add_AllO.htm
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\wikipedia.HTM
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: تحميل ملفات (إف.إل.في) الـ 10 الأخيرة بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL2.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)
--
End of file - 10419 bytes​

 

[Juve GuardJuve Guard is verified member.]

حمل الاداة هذي عندك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اي رساله تطلع عندك اضغط >> yes
بعد ما تنتهي عطني تقريرها
بعدين عطني تقرير بالهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​

 

[AbOdy]

المعذرة على نقل الموضوع الى الركن المختص


______________________________

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

دبل كلك ثم انتظر دقيقة واعد تشغيل الجهاز وارفع تقرير ثاني

 

[جــ الحبيب ــرح]

اخي العزيز الف شكر على سرعة التجاوب
فعلا لقد قمت بتحميلها الليله الماضية وقمت بعمل الفحص وهذا هو التقرير
اما التقرير السابق فهم منذ نص ساعه تقريبا
​

ComboFix 08-07-29.1 - XPPRESP3 07/31/2008 4:07:39.1 - NTFSx86​

Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.843 [GMT 3:00]
Running from: C:\Documents and Settings\XPPRESP3\Desktop\برامج\New Folder\ComboFix.exe
* Resident AV is active​

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\pskill.exe
C:\WINDOWS\system32\unxxx.bat
C:\WINDOWS\Update.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-31 19:51 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\IDM
2008-07-31 19:01 24,064 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-07-31 18:59 --------- d-----w C:\Program Files\RegCure
2008-07-31 04:46 --------- d-----w C:\Program Files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-07-31 01:53 --------- d-----w C:\Program Files\Ringz Studio
2008-07-31 01:53 --------- d-----w C:\Program Files\Common Files\Real
2008-07-31 01:06 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\DMCache
2008-07-30 23:17 --------- d-----w C:\Program Files\SuperCopier2
2008-07-30 23:13 --------- d-----w C:\Program Files\Folder Guard Pro
2008-07-30 21:33 --------- d-----w C:\Program Files\MobiMB Mobile Media Browser
2008-07-30 02:19 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-07-30 00:57 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\DivX
2008-07-30 00:28 --------- d-----w C:\Program Files\Real Alternative
2008-07-30 00:04 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-29 23:48 --------- d-----w C:\Program Files\K-Lite Video Conversion Pack
2008-07-29 23:42 --------- d-----w C:\Program Files\DivX
2008-07-29 21:44 --------- d-----w C:\Program Files\Nuclear Coffee
2008-07-29 21:14 --------- d-----w C:\Program Files\SodaBush
2008-07-29 21:14 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\SodaBush
2008-07-29 19:31 --------- d-----w C:\Program Files\Caffe
2008-07-29 17:07 --------- d-----w C:\Program Files\PowerISO
2008-07-29 14:49 --------- d-----w C:\Program Files\netcut
2008-07-29 13:18 --------- d-----w C:\Program Files\Eset
2008-07-28 22:55 --------- d-----w C:\Program Files\Easy iPod MP4 PSP 3GP
2008-07-28 22:51 --------- d-----w C:\Program Files\ImTOO
2008-07-28 19:43 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-07-28 17:49 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Ulead Systems
2008-07-28 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-28 17:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-07-28 17:47 --------- d-----w C:\Program Files\Ulead Systems
2008-07-28 17:47 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-07-28 17:47 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-28 13:06 --------- d-----w C:\Program Files\Windows Live
2008-07-28 13:06 --------- d-----w C:\Program Files\MSN Messenger
2008-07-28 13:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-27 23:07 --------- d-----w C:\Program Files\Xilisoft
2008-07-27 19:44 --------- d-----w C:\Program Files\VerbAce Research
2008-07-27 06:58 19,535,904 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-26 23:52 --------- d-----w C:\Program Files\Orbitdownloader
2008-07-26 23:50 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Orbit
2008-07-26 19:16 212,288 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-23 15:10 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-07-23 15:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-23 11:33 --------- d-----w C:\Program Files\Portable TuneUp Utilities 2007 6.0.2311
2008-07-23 10:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-07-23 09:17 --------- d-----w C:\Documents and Settings\Default User\Application Data\Orbit
2008-07-23 06:09 --------- d-----w C:\Program Files\Common Files\LogoManager
2008-07-23 05:04 --------- d-----w C:\Program Files\Norton Ghost
2008-07-23 05:04 --------- d-----w C:\Program Files\HowbaniSoft
2008-07-23 05:04 --------- d-----w C:\Program Files\Hotspot Shield
2008-07-23 05:04 --------- d-----w C:\Program Files\Gold Wave Editor
2008-07-23 05:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-23 05:04 --------- d-----w C:\Program Files\3D MP3 Sound Recorder
2008-07-23 05:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-22 05:25 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Talkback
2008-07-22 02:45 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Symantec
2008-07-22 02:41 --------- d-----w C:\Program Files\Symantec
2008-07-22 00:27 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-07-22 00:25 --------- d-----w C:\Program Files\AVSMedia
2008-07-22 00:14 --------- d-----w C:\Program Files\AviSynth 2.5
2008-07-22 00:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\ashampoo
2008-07-22 00:10 --------- d-----w C:\Program Files\Ashampoo
2008-07-21 23:32 --------- d-----w C:\Program Files\WinPcap
2008-07-21 21:21 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\XnView
2008-07-21 17:09 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Ahead
2008-07-21 14:36 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Media Player Classic
2008-07-21 13:55 --------- d-----w C:\Documents and Settings\user80\Application Data\IE7Pro
2008-07-21 13:55 --------- d-----w C:\Documents and Settings\Default User\Application Data\IE7Pro
2008-07-21 13:47 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Almeza MultiSet
2008-07-21 13:46 --------- d-----w C:\Program Files\Almeza
2008-07-21 12:51 --------- d-----w C:\Program Files\Yahoo!
2008-07-21 12:51 --------- d-----w C:\Program Files\RocketDock
2008-07-21 12:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-21 12:49 --------- d-----w C:\Program Files\Winamp
2008-07-21 12:48 --------- d-----w C:\Program Files\Win32Pad
2008-07-21 12:48 --------- d-----w C:\Program Files\Wesmosis
2008-07-21 12:48 --------- d-----w C:\Program Files\VistaCodecPack
2008-07-21 12:48 --------- d-----w C:\Program Files\Java
2008-07-21 12:48 --------- d-----w C:\Program Files\Common Files\Java
2008-07-21 12:48 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Gena01
2008-07-21 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-21 12:47 --------- d-----w C:\Program Files\ScreenMaker
2008-07-21 12:47 --------- d-----w C:\Program Files\Rainlendar2
2008-07-21 12:46 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-07-21 12:46 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-07-21 12:46 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-07-21 12:46 --------- d-----w C:\Program Files\VMware
2008-07-21 12:46 --------- d-----w C:\Program Files\Paint.NET
2008-07-21 12:46 --------- d-----w C:\Program Files\Nero
2008-07-21 12:46 --------- d-----w C:\Program Files\HWiNFO32
2008-07-21 12:46 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-21 12:42 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-21 12:42 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-07-21 12:36 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-21 12:36 --------- d-----w C:\Program Files\Softland
2008-07-21 12:36 --------- d-----w C:\Program Files\DAMN NFO Viewer
2008-07-21 12:36 --------- d-----w C:\Program Files\CPU-Z
2008-07-21 12:33 --------- d-----w C:\Program Files\LClock
2008-07-21 12:33 --------- d-----w C:\Program Files\Desktop
2008-07-21 12:32 --------- d-----w C:\Program Files\SysInternals
.
------- Sigcheck -------
08/08/2007 07:28 PM 360704 a11391be25035570ae4b8970920f2c74 C:\WINDOWS\system32\drivers\tcpip.sys
08/08/2007 07:40 PM 950784 396acc64ecec61d7b2f8b53151b37028 C:\WINDOWS\explorer.exe
08/08/2007 07:40 PM 950784 396acc64ecec61d7b2f8b53151b37028 C:\WINDOWS\XPize\Backup\explorer.exe
07/31/2008 10:01 PM 24064 c3a2915c71ae6f225eb906c25ccd29b5 C:\WINDOWS\system32\ctfmon.exe
08/04/2004 05:00 PM 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\XPize\Backup\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [03/19/2007 12:05 AM 630784]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [07/24/2007 10:12 AM 1298432]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [03/14/2005 02:37 AM 1057280]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [10/05/2006 08:56 PM 280779]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [07/21/2008 03:46 PM 949376]
"FG_Monitor"="C:\Program Files\Folder Guard Pro\FGKey.exe" [02/25/2007 12:00 AM 132680]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [11/26/2006 09:30 PM 97357]
"MSConfig"="C:\WINDOWS\system32\msconfig.exe" [08/08/2007 07:40 PM 184320]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [08/08/2007 07:24 PM 61952 C:\WINDOWS\system32\HDAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [01/09/2008 04:25 PM 16878080 C:\WINDOWS\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [07/31/2008 10:01 PM 24064]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [03/19/2007 12:05 AM 630784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Resume copy]
--a------ 03/24/2002 01:54 PM 46080 C:\WINDOWS\COPYFSTQ.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe /onboot
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SMSERIAL"=sm56hlpr.exe
"LClock"=C:\Program Files\LClock\LClock.exe
"SCDEmuApp.exe"=C:\Program Files\PowerISO\SCDEmuApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
R2 FGUARD32;FGUARD32;C:\Program Files\Folder Guard Pro\FGUARD32.SYS [02/25/2007 12:00 AM]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 05:00 PM]
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [08/03/2004 11:01 PM]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [08/03/2005 12:10 AM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{055ec592-58df-11dd-953d-00142af49f16}]
\Shell\AutoRun\command - N:\nplrssy.exe
\Shell\explore\Command - N:\nplrssy.exe
\Shell\open\Command - N:\nplrssy.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ad6b5d1-34db-11dc-ad72-806d6172696f}]
\Shell\AutoRun\command - D:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43f6b8e8-5af1-11dd-9542-00142af49f16}]
\Shell\AutoRun\command - N:\rthrw.com
\Shell\explore\Command - N:\rthrw.com
\Shell\open\Command - N:\rthrw.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6176a7c6-594f-11dd-953f-00142af49f16}]
\Shell\AutoRun\command - t9peum02.exe
\Shell\explore\Command - t9peum02.exe
\Shell\open\Command - t9peum02.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-07-25 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe [04/26/2007 09:51 PM]
2008-07-31 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [04/22/2008 12:21 AM]
2008-07-31 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [04/22/2008 12:21 AM]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O8 -: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 -: Check &Spelling - C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: Lookup on Merriam Webster -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\Merriam Webster.HTM
O8 -: Lookup on Wikipedia -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\wikipedia.HTM
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 -: تحميل ملفات (إف.إل.في) الـ 10 الأخيرة بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL2.htm​

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-07-31 04:08:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\XPPRESP3\LOCALS~1\Temp\mc217.tmp"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
.
Completion time: 07/31/2008 4:09:17
ComboFix-quarantined-files.txt 2008-07-31 01:09:15
Pre-Run: 9,187,086,336 bytes free
Post-Run: 9,232,859,136 bytes free
265
وهذي صوره للتحذير الذي يظهر لي من برنامج النود
[​

اخي العزيز الف شكر على سرعة التجاوب
فعلا لقد قمت بتحميلها الليله الماضية وقمت بعمل الفحص وهذا هو التقرير
اما التقرير السابق فهم منذ نص ساعه تقريبا​

ComboFix 08-07-29.1 - XPPRESP3 07/31/2008 4:07:39.1 - NTFSx86​

Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.843 [GMT 3:00]
Running from: C:\Documents and Settings\XPPRESP3\Desktop\برامج\New Folder\ComboFix.exe
* Resident AV is active​

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\pskill.exe
C:\WINDOWS\system32\unxxx.bat
C:\WINDOWS\Update.dll
.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-31 19:51 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\IDM
2008-07-31 19:01 24,064 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-07-31 18:59 --------- d-----w C:\Program Files\RegCure
2008-07-31 04:46 --------- d-----w C:\Program Files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-07-31 01:53 --------- d-----w C:\Program Files\Ringz Studio
2008-07-31 01:53 --------- d-----w C:\Program Files\Common Files\Real
2008-07-31 01:06 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\DMCache
2008-07-30 23:17 --------- d-----w C:\Program Files\SuperCopier2
2008-07-30 23:13 --------- d-----w C:\Program Files\Folder Guard Pro
2008-07-30 21:33 --------- d-----w C:\Program Files\MobiMB Mobile Media Browser
2008-07-30 02:19 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-07-30 00:57 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\DivX
2008-07-30 00:28 --------- d-----w C:\Program Files\Real Alternative
2008-07-30 00:04 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-29 23:48 --------- d-----w C:\Program Files\K-Lite Video Conversion Pack
2008-07-29 23:42 --------- d-----w C:\Program Files\DivX
2008-07-29 21:44 --------- d-----w C:\Program Files\Nuclear Coffee
2008-07-29 21:14 --------- d-----w C:\Program Files\SodaBush
2008-07-29 21:14 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\SodaBush
2008-07-29 19:31 --------- d-----w C:\Program Files\Caffe
2008-07-29 17:07 --------- d-----w C:\Program Files\PowerISO
2008-07-29 14:49 --------- d-----w C:\Program Files\netcut
2008-07-29 13:18 --------- d-----w C:\Program Files\Eset
2008-07-28 22:55 --------- d-----w C:\Program Files\Easy iPod MP4 PSP 3GP
2008-07-28 22:51 --------- d-----w C:\Program Files\ImTOO
2008-07-28 19:43 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-07-28 17:49 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Ulead Systems
2008-07-28 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-28 17:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-07-28 17:47 --------- d-----w C:\Program Files\Ulead Systems
2008-07-28 17:47 --------- d-----w C:\Program Files\Common Files\Ulead Systems
2008-07-28 17:47 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-28 13:06 --------- d-----w C:\Program Files\Windows Live
2008-07-28 13:06 --------- d-----w C:\Program Files\MSN Messenger
2008-07-28 13:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-07-27 23:07 --------- d-----w C:\Program Files\Xilisoft
2008-07-27 19:44 --------- d-----w C:\Program Files\VerbAce Research
2008-07-27 06:58 19,535,904 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-26 23:52 --------- d-----w C:\Program Files\Orbitdownloader
2008-07-26 23:50 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Orbit
2008-07-26 19:16 212,288 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-23 15:10 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2008-07-23 15:09 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-23 11:33 --------- d-----w C:\Program Files\Portable TuneUp Utilities 2007 6.0.2311
2008-07-23 10:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-07-23 09:17 --------- d-----w C:\Documents and Settings\Default User\Application Data\Orbit
2008-07-23 06:09 --------- d-----w C:\Program Files\Common Files\LogoManager
2008-07-23 05:04 --------- d-----w C:\Program Files\Norton Ghost
2008-07-23 05:04 --------- d-----w C:\Program Files\HowbaniSoft
2008-07-23 05:04 --------- d-----w C:\Program Files\Hotspot Shield
2008-07-23 05:04 --------- d-----w C:\Program Files\Gold Wave Editor
2008-07-23 05:04 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-23 05:04 --------- d-----w C:\Program Files\3D MP3 Sound Recorder
2008-07-23 05:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-22 05:25 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Talkback
2008-07-22 02:45 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Symantec
2008-07-22 02:41 --------- d-----w C:\Program Files\Symantec
2008-07-22 00:27 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-07-22 00:25 --------- d-----w C:\Program Files\AVSMedia
2008-07-22 00:14 --------- d-----w C:\Program Files\AviSynth 2.5
2008-07-22 00:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\ashampoo
2008-07-22 00:10 --------- d-----w C:\Program Files\Ashampoo
2008-07-21 23:32 --------- d-----w C:\Program Files\WinPcap
2008-07-21 21:21 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\XnView
2008-07-21 17:09 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Ahead
2008-07-21 14:36 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Media Player Classic
2008-07-21 13:55 --------- d-----w C:\Documents and Settings\user80\Application Data\IE7Pro
2008-07-21 13:55 --------- d-----w C:\Documents and Settings\Default User\Application Data\IE7Pro
2008-07-21 13:47 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Almeza MultiSet
2008-07-21 13:46 --------- d-----w C:\Program Files\Almeza
2008-07-21 12:51 --------- d-----w C:\Program Files\Yahoo!
2008-07-21 12:51 --------- d-----w C:\Program Files\RocketDock
2008-07-21 12:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-21 12:49 --------- d-----w C:\Program Files\Winamp
2008-07-21 12:48 --------- d-----w C:\Program Files\Win32Pad
2008-07-21 12:48 --------- d-----w C:\Program Files\Wesmosis
2008-07-21 12:48 --------- d-----w C:\Program Files\VistaCodecPack
2008-07-21 12:48 --------- d-----w C:\Program Files\Java
2008-07-21 12:48 --------- d-----w C:\Program Files\Common Files\Java
2008-07-21 12:48 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Gena01
2008-07-21 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-21 12:47 --------- d-----w C:\Program Files\ScreenMaker
2008-07-21 12:47 --------- d-----w C:\Program Files\Rainlendar2
2008-07-21 12:46 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2008-07-21 12:46 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2008-07-21 12:46 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2008-07-21 12:46 --------- d-----w C:\Program Files\VMware
2008-07-21 12:46 --------- d-----w C:\Program Files\Paint.NET
2008-07-21 12:46 --------- d-----w C:\Program Files\Nero
2008-07-21 12:46 --------- d-----w C:\Program Files\HWiNFO32
2008-07-21 12:46 --------- d-----w C:\Program Files\Common Files\Ahead
2008-07-21 12:42 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-21 12:42 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-07-21 12:36 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-21 12:36 --------- d-----w C:\Program Files\Softland
2008-07-21 12:36 --------- d-----w C:\Program Files\DAMN NFO Viewer
2008-07-21 12:36 --------- d-----w C:\Program Files\CPU-Z
2008-07-21 12:33 --------- d-----w C:\Program Files\LClock
2008-07-21 12:33 --------- d-----w C:\Program Files\Desktop
2008-07-21 12:32 --------- d-----w C:\Program Files\SysInternals
.
------- Sigcheck -------
08/08/2007 07:28 PM 360704 a11391be25035570ae4b8970920f2c74 C:\WINDOWS\system32\drivers\tcpip.sys
08/08/2007 07:40 PM 950784 396acc64ecec61d7b2f8b53151b37028 C:\WINDOWS\explorer.exe
08/08/2007 07:40 PM 950784 396acc64ecec61d7b2f8b53151b37028 C:\WINDOWS\XPize\Backup\explorer.exe
07/31/2008 10:01 PM 24064 c3a2915c71ae6f225eb906c25ccd29b5 C:\WINDOWS\system32\ctfmon.exe
08/04/2004 05:00 PM 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\XPize\Backup\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [03/19/2007 12:05 AM 630784]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [07/24/2007 10:12 AM 1298432]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [03/14/2005 02:37 AM 1057280]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [10/05/2006 08:56 PM 280779]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [07/21/2008 03:46 PM 949376]
"FG_Monitor"="C:\Program Files\Folder Guard Pro\FGKey.exe" [02/25/2007 12:00 AM 132680]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [11/26/2006 09:30 PM 97357]
"MSConfig"="C:\WINDOWS\system32\msconfig.exe" [08/08/2007 07:40 PM 184320]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [08/08/2007 07:24 PM 61952 C:\WINDOWS\system32\HDAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [01/09/2008 04:25 PM 16878080 C:\WINDOWS\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [07/31/2008 10:01 PM 24064]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [03/19/2007 12:05 AM 630784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Resume copy]
--a------ 03/24/2002 01:54 PM 46080 C:\WINDOWS\COPYFSTQ.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe /onboot
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SMSERIAL"=sm56hlpr.exe
"LClock"=C:\Program Files\LClock\LClock.exe
"SCDEmuApp.exe"=C:\Program Files\PowerISO\SCDEmuApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
R2 FGUARD32;FGUARD32;C:\Program Files\Folder Guard Pro\FGUARD32.SYS [02/25/2007 12:00 AM]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 05:00 PM]
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [08/03/2004 11:01 PM]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [08/03/2005 12:10 AM]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{055ec592-58df-11dd-953d-00142af49f16}]
\Shell\AutoRun\command - N:\nplrssy.exe
\Shell\explore\Command - N:\nplrssy.exe
\Shell\open\Command - N:\nplrssy.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ad6b5d1-34db-11dc-ad72-806d6172696f}]
\Shell\AutoRun\command - D:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43f6b8e8-5af1-11dd-9542-00142af49f16}]
\Shell\AutoRun\command - N:\rthrw.com
\Shell\explore\Command - N:\rthrw.com
\Shell\open\Command - N:\rthrw.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6176a7c6-594f-11dd-953f-00142af49f16}]
\Shell\AutoRun\command - t9peum02.exe
\Shell\explore\Command - t9peum02.exe
\Shell\open\Command - t9peum02.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
s of the 'Scheduled Tasks' folder
2008-07-25 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe [04/26/2007 09:51 PM]
2008-07-31 C:\WINDOWS\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [04/22/2008 12:21 AM]
2008-07-31 C:\WINDOWS\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [04/22/2008 12:21 AM]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-Internet Settings,ProxyOverride = <local>
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O8 -: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 -: Check &Spelling - C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: Lookup on Merriam Webster -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\Merriam Webster.HTM
O8 -: Lookup on Wikipedia -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\wikipedia.HTM
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 -: تحميل ملفات (إف.إل.في) الـ 10 الأخيرة بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL2.htm​

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-07-31 04:08:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\XPPRESP3\LOCALS~1\Temp\mc217.tmp"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
.
Completion time: 07/31/2008 4:09:17
ComboFix-quarantined-files.txt 2008-07-31 01:09:15
Pre-Run: 9,187,086,336 bytes free
Post-Run: 9,232,859,136 bytes free​

265
وهذي صوره للتحذير الذي يظهر لي من برنامج النود

اكرر شكري وعرفاني لك اخي العزيز
وارجو قبول اسفي لوضعي الموضوع في قسم غير قسمة
​

 

[فارس الملاك]

عزيزي عطنا تقرير هايجاك​

 

[جــ الحبيب ــرح]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:23:48 ص, on 02/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Folder Guard Pro\FGKey.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\timezone.exe
C:\Program Files\HowbaniSoft\HowbaniSoft Internet Cafe Management System V80\CafeSysSvr.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Win32Pad\win32pad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\XPPRESP3\Desktop\برامج\HiJackThis_2.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [FG_Monitor] C:\Program Files\Folder Guard Pro\FGKey.exe /Start
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [Timezone] "C:\WINDOWS\system32\timezone.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: + Offline &Explorer: Download the link -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\Offline Explorer Enterprise\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\Offline Explorer Enterprise\Add_AllO.htm
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Files\ieSpell\wikipedia.HTM
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: تحميل ملفات (إف.إل.في) الـ 10 الأخيرة بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL2.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)
--
End of file - 8795 bytes

 

[فارس الملاك]

جاري التحليل

​

 

[فارس الملاك]

احذف هذه القيم

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)

O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)

O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,5 2,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73, 00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00 ,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,6 5,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66, 00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00 ,72,00,6f,00,75,00,70,00,00,00 (file missing)

طريقة الحذف

=================================​

استخدم هذه الاداة للتنظيف

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عزيزي هل تواجه مشاكل ام لا ؟؟​

 

[جــ الحبيب ــرح]

جاري تنفيذ التعليمات
ومن ثم الرد
مع فائق الشكر والاحترام

 

[فارس الملاك]

جاري الانتظار ياغالي​

 

[جــ الحبيب ــرح]

تم تنفيذ جميع الخطوات وحذف القيم وكذالك
لنسخ الاحتياطيه التي يقوم بعملها البرنامج
ومن ثم التنظيف بالاداة
وجاري تجربه الجهاز
مع فائق الشكر والاحترام

 

[فارس الملاك]

الله يسلمك ياغالي

وفي انتظارك في اي وقت​

 

[masha2008]

احذف هذه القيم​

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll​

O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll​

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe​

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe​

O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)​

O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)​

O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,5 2,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73, 00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00 ,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,6 5,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66, 00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00 ,72,00,6f,00,75,00,70,00,00,00 (file missing)​

طيب اشرحولنا ليش حذفنا هذا القيم بذات نبغى نتعلم علشان نساعدكم ..؟؟؟ ونصلح اجهزة خلق الله
بس الله يستر لا نخربهااا​

المشكله بس بالتقرير والخطوات الي بعدها سهله نعطيه الادتين لو انه ما يحتاج لها نخليه يشغلهاا.​

 

[فارس الملاك]

ياهلا فيك عزيزي

تقدر تراجع هالقسم وراح تلقى كل استفساراتك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[جــ الحبيب ــرح]

اخوتي الكرام
عادت المشكله كما كانت وعاود برنامج النود لاظهار تحذيره
قمت بالبحث عن اسم الملف في كل جهازي ولم يظهر له اثر
كما ظهرت مشكلات اخرى منها تهنيج الجهاز عند فتح صفحتين
واخرى اريد تصفح جهاز الكمبيوتر وهي حدوث خطاء ويجب اغلاق المتصفح
ويقوم بعد الضغط على الموافقه باغلاق جميع نوافذ المتصفح

شاكر لكم تعاونكم
وهذي صورة من التحذير

​

 

[جــ الحبيب ــرح]

اعزائي اصبحت لا ادخل النت الا للبحث عن حل لمشكلتي
وما ترتب عليها من مشاكل اخرى
اتمنى من اصحاب الخبره افادتي ارجوكم
وهذي صوره من اخر رسائل المشاكل التي صارت

​

 

[Juve GuardJuve Guard is verified member.]

اخوي
انت لو تحذف النود الي عندك كان حنا بخير
ركب الكاسبر ولا الأفيرا أحسن لك
وجرب تحدثهم لآخر التحديثات بعدين افحص جهاز بالوضع الآمن
ورد لنا خبر

 

[masha2008]

اخوي
انت لو تحذف النود الي عندك كان حنا بخير
ركب الكاسبر ولا الأفيرا أحسن لك
وجرب تحدثهم لآخر التحديثات بعدين افحص جهاز بالوضع الآمن
ورد لنا خبر

k:k:

 

[جــ الحبيب ــرح]

يا جماعه حذفت النود وسويت السايمنتك انتي فايرس وكشف على الفايرس واعطاني النصائح للحذف وسويتها واول ما عيد التشغيل يرجع الوضع مثل اول
اريد حلا بس لاحد يقول لي سوي فورمات او اف ديسك مع تحياتي
وفاق احترامي لجميع من تفاعل مع مشكلتي
​

 

[Demo-dashDemo-dash is verified member.]

^^^ هذا التروجين مو موجود بجهازك , هذي صوره من موقع والدليل مافيه دليت Delete فيه Terminate << اي قطع الإتصال بالموقع

ويالاخو قالولك احذف النود ورحت حذفته على طول ههههههههههههههه
النود افضل من السيمانتيك بمليون مره ,,,

طيب الحين الي تسويه شوف

ثم نزل هذه الاداة واتبع الشرح التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط

شرح الاستخدام ,,,,,,
عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))

​

رابط تحميل آخر تحديث للاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

وتقرير هاياك اخر

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ويكمل اقرب متابع
​