عندك زحمه
عطل برنامج الحمايه بعدين نزل الاداة هذي وشغلها
اطلع لك رسالتين اضغط >> yes
بعد ما تنتهي من اعمل يطلع لك تقريرها
ارفعه لي على رابط
بعدين عطني تقرير هايجاك
وارفع تقريره برضه
أخي الفاضل
جزاك الله خيرًا
قمتُ بالتحميل للبرنامج المذكور و فعلتُ ماتذكره ، و التقريران موجودان فيما يلي :
1- تقرير الأداة المذكورة :
ComboFix 08-08-04.09 - ELSAFWA 2008-08-06 16:54:49.1 -
FAT32x86
Running from: E:\Documents and Settings\ELSAFWA\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
E:\Documents and Settings\ELSAFWA\Local Settings\Temporary Internet Files\.IE5\COL77EDW\cnsminex_empty[1].htm
E:\Documents and Settings\ELSAFWA\Local Settings\Temporary Internet Files\.IE5\RTIQBYHB\cnsminex_empty[2].htm
E:\WINDOWS\system32\fmcvxy.dll.LoG
E:\WINDOWS\temp\wmsetup.dll
E:\WINDOWS\Update.dll
.
((((((((((((((((((((((((( Files Created from 2008-07-06 to 2008-08-06 )))))))))))))))))))))))))))))))
.
2008-08-05 20:40 . 2008-08-05 20:40 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\Grisoft
2008-08-05 20:40 . 2008-08-05 20:40 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-05 20:40 . 2007-05-30 15:10 10,872 --a------ E:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-08-05 16:22 . 2008-08-05 16:22 <DIR> d-------- E:\WINDOWS\system32\Adobe
2008-08-05 16:22 . 2008-08-05 16:22 <DIR> d-------- E:\WINDOWS\Profiles
2008-08-05 16:22 . 2008-08-05 16:22 <DIR> d-------- E:\Program Files\Common Files\Adobe
2008-08-05 16:22 . 2008-08-05 16:22 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\InterTrust
2008-08-05 16:21 . 1998-10-29 15:45 306,688 --a------ E:\WINDOWS\IsUninst.exe
2008-08-03 15:56 . 2008-08-03 15:56 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\vlc
2008-08-03 15:55 . 2008-08-03 15:55 <DIR> d-------- E:\Program Files\VideoLAN
2008-08-02 21:21 . 2008-08-02 21:22 <DIR> d-------- E:\Program Files\AmanLinks_Beta_0.0.4
2008-08-02 10:27 . 2008-08-02 10:27 <DIR> d--h----- E:\WINDOWS\PIF
2008-08-02 10:22 . 2008-08-02 10:21 737,280 --a------ E:\WINDOWS\iun6002.exe
2008-08-02 10:21 . 2008-08-02 10:21 <DIR> d-------- E:\WINDOWS\system32\athan
2008-08-02 10:21 . 2008-08-02 10:21 <DIR> d-------- E:\Program Files\Athan
2008-08-01 10:33 . 2005-04-05 12:49 67,584 --a------ E:\WINDOWS\system32\drivers\MpFirewall.sys
2008-08-01 10:33 . 2004-04-23 17:15 24,576 --a------ E:\WINDOWS\system32\MpfApi.dll
2008-07-31 20:22 . 2008-07-31 20:22 <DIR> d-------- E:\Program Files\Webroot
2008-07-31 20:22 . 2008-07-31 20:22 <DIR> d-------- E:\Program Files\Common Files\Webroot Shared
2008-07-31 20:22 . 2008-07-31 20:22 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\Webroot
2008-07-31 20:22 . 2005-03-02 10:04 56,832 --a------ E:\WINDOWS\Unwash6.exe
2008-07-31 19:26 . 2008-07-31 19:26 <DIR> d-------- E:\WINDOWS\system32\LogFiles
2008-07-31 16:44 . 2008-07-31 16:44 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-31 16:43 . 2008-07-31 16:43 <DIR> d-------- E:\Program Files\Yahoo!
2008-07-31 15:50 . 2008-07-31 15:50 <DIR> d-------- E:\Program Files\Avant Browser
2008-07-30 20:39 . 2008-07-30 20:39 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\shamela
2008-07-30 20:34 . 2004-08-04 15:00 66,594 --a------ E:\WINDOWS\system32\dllcache\c_720.nls
2008-07-30 19:25 . 2005-08-10 11:22 114,464 --a------ E:\WINDOWS\system32\drivers\naiavf5x.sys
2008-07-30 18:28 . 2008-07-30 18:28 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\Avant Profiles
2008-07-30 18:16 . 2008-07-30 18:16 <DIR> d-------- E:\Documents and Settings\LocalService\Application Data\McAfee.com Personal Firewall
2008-07-30 18:16 . 2008-07-30 18:16 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\McAfee.com Personal Firewall
2008-07-30 18:15 . 2008-08-06 17:06 52,288 --a------ E:\WINDOWS\system32\Status.MPF
2008-07-30 18:10 . 2004-06-22 09:17 18,004 -ra------ E:\WINDOWS\system32\drivers\slnt.sys
2008-07-30 18:08 . 2004-08-03 23:15 145,792 --a------ E:\WINDOWS\system32\drivers\portcls.sys
2008-07-30 18:00 . 2008-07-30 18:00 <DIR> d-------- E:\Program Files\McAfee.com
2008-07-30 18:00 . 2008-07-30 18:00 <DIR> d-------- E:\Program Files\McAfee AntiSpyware 1.00 Install
2008-07-30 18:00 . 2008-07-30 18:01 <DIR> d-------- E:\Program Files\McAfee
2008-07-30 18:00 . 2008-07-30 18:01 <DIR> d-------- E:\Documents and Settings\ELSAFWA\Application Data\McAfee
2008-07-30 18:00 . 2008-07-30 18:00 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\McAfee.com
2008-07-30 18:00 . 2008-07-30 18:01 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\McAfee
2008-07-30 18:00 . 2005-10-18 11:08 349,760 --a------ E:\WINDOWS\system32\mcinsctl.dll
2008-07-30 18:00 . 2005-05-24 19:23 288,320 --a------ E:\WINDOWS\system32\McGDMgr.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-02 11:12 0 ----a-w E:\WINDOWS\Fonts\VDM7.tmp
2008-08-02 11:11 0 ----a-w E:\WINDOWS\Fonts\VDM6.tmp
2008-07-30 14:48 --------- d-----w E:\Program Files\microsoft frontpage
2008-07-30 06:07 46,592 ----a-w E:\WINDOWS\SOUNDMAN.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 17:43 4670704]
"Window Washer"="E:\Program Files\Webroot\Washer\wwDisp.exe" [2005-03-08 10:02 910336]
"MSKAGENTEXE"="E:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 16:33 126976]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Index Washer"="E:\Program Files\Webroot\Washer\WashIdx.exe" [2004-05-17 04:05 34304]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCAgentExe"="e:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2008-07-31 15:09 303104]
"MCUpdateExe"="e:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2008-07-31 15:09 212992]
"MSKAGENTEXE"="E:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 16:33 126976]
"MSKDetectorExe"="E:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-03-23 15:47 1111040]
"VSOCheckTask"="E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2008-07-31 15:09 151552]
"VirusScan Online"="E:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2008-07-31 15:09 163840]
"OASClnt"="E:\Program Files\McAfee.com\VSO\oasclnt.exe" [2008-07-31 15:09 53248]
"_AntiSpyware"="e:\progra~1\mcafee\MCAFEE~1\masalert.exe" [2006-01-06 15:14 327680]
"MPFExe"="E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE" [2005-04-05 14:41 950272]
"!AVG Anti-Spyware"="E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-08-05 20:49 6731312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Index Washer"="E:\Program Files\Webroot\Washer\WashIdx.exe" [2004-05-17 04:05 34304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="E:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
--a------ 2008-07-30 09:07 46592 E:\WINDOWS\SOUNDMAN.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"E:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
S2 cdralw;NVIDIA Compatible Windows Miniport Driver;E:\WINDOWS\system32\DRIVERS\nvmini.sys []
S3 eth8023;eth8023;E:\WINDOWS\system32\drivers\eth8023.sys []
.
s of the 'Scheduled Tasks' folder
2008-07-31 E:\WINDOWS\Tasks\McAfee AntiSpyware.job
- e:\progra~1\mcafee\MCAFEE~1\MASCon.exe [2006-01-06 15:16]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{0C55A48A-97DC-4003-8729-7D0B159B40D3} - (no file)
ShellExecuteHooks-<NO NAME> - (no file)
SSODL-msnmsg-{DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - (no file)
SSODL-DesktopWin-{DA191DE0-AA86-4ED0-4B87-292A3D48BE99} - E:\WINDOWS\AppPatch\DesktopWin.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.islamdor.com/vb/index.php?
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://us.mcafee.com/apps/mash1/en-us/redir.asp?affid=0-3&installtype=force&systempopup=true
O17 -: HKLM\CCS\Interface\{93891662-C163-4A39-A985-ED6DF0815D38}: NameServer = 163.121.128.134,163.121.128.135
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-08-06 17:05:29
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
E:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
E:\PROGRAM FILES\MCAFEE\MCAFEE ANTISPYWARE\MASSRV.EXE
E:\PROGRAM FILES\MCAFEE.COM\AGENT\MCDETECT.EXE
E:\PROGRAM FILES\MCAFEE.COM\VSO\MCSHIELD.EXE
E:\PROGRAM FILES\MCAFEE.COM\AGENT\MCTSKSHD.EXE
E:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
E:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2008-08-06 17:09:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-06 14:09:04
Pre-Run: 1,605,500,928 bytes free
Post-Run: 1,576,538,112 bytes free
153
2- تقرير الهاجاك :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:10:50 PM, on 8/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
e:\progra~1\mcafee\mcafee antispyware\massrv.exe
e:\program files\mcafee.com\agent\mcdetect.exe
e:\PROGRA~1\mcafee.com\vso\mcshield.exe
e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
e:\PROGRA~1\mcafee.com\vso\OasClnt.exe
e:\program files\mcafee.com\vso\mcvsshld.exe
E:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
E:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
E:\progra~1\mcafee\MCAFEE~1\masalert.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\System32\svchost.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
E:\WINDOWS\explorer.exe
E:\WINDOWS\system32\notepad.exe
E:\Program Files\McAfee.com\Agent\mcagent.exe
E:\Documents and Settings\ELSAFWA\Desktop\برنامج الهاجاك _ زيزوم\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - e:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [MCAgentExe] e:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] E:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] "E:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" /startup
O4 - HKLM\..\Run: [VSOCheckTask] "E:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "E:\Program Files\McAfee.com\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [OASClnt] "E:\Program Files\McAfee.com\VSO\oasclnt.exe"
O4 - HKLM\..\Run: [_AntiSpyware] e:\progra~1\mcafee\MCAFEE~1\masalert.exe
O4 - HKLM\..\Run: [MPFExe] E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Index Washer] E:\Program Files\Webroot\Washer\WashIdx.exe "ELSAFWA"
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Window Washer] E:\Program Files\Webroot\Washer\wwDisp.exe /startup
O4 - HKCU\..\Run: [MSKAGENTEXE] E:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{93891662-C163-4A39-A985-ED6DF0815D38}: NameServer = 163.121.128.134,163.121.128.135
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee AntiSpyware Service - McAfee, Inc. - e:\progra~1\mcafee\mcafee antispyware\massrv.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - e:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - e:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - e:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - E:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - E:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - E:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
--
End of file - 5520 bytes
أرجو أن ينصلح الأمر
