اخواني جهازي متهكر

[فهد بن خالد]

السلام عليكم ورحمة الله وبركاته ,,




الله يوفقكم ويجزاكم عني وعن كل الاعضاء الاجر العظيم ،،

عندي مشكله اخواني الريجستري مايفتح معي ،،

ومن ثلاث ايام وجهازي وضعه مو طبيعي ،، الماوس تجي اوقات يتحرك من حاله ،،

استخدمت برنامج RootkitReveal

وطلع معي هالتقرير

HKU\S-1-5-21-507921405-1275210071-839522115-1003\Software\Microsoft\Windows\Shell\Bags\1\Desktop\ItemPos1024x768(1) 10/04/1433 08:48 2.58 KB Data mismatch between Windows API and raw hive data.
HKLM\SECURITY\Policy\Secrets\SAC* 02/04/1432 10:26 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 02/04/1432 10:26 0 bytes Key name contains embedded nulls (*)
C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf 10/04/1433 09:01 23.89 KB Hidden from Windows API.


ولا فهمت الحل من التقرير ،،،

و شغلت برنامج X-NetStat Professional لجل اتابع المنافذ مع اني تابعت شروح وعملتها لاغلاق المنافذ

ومن البرنامج ظهر لي منفذ والملف المشغل للمنفذ

Port 1981
[shockrave]
Shockrave Trojan Horse p2pq
p2pq
Also Bowl Trojan
C:\WINDOWS\system32\kernel32.dll


الله يجزاكم خير ان كان في معلومه لاتقصرون ومالكم إلا الدعوه الصادقه وجزاكم الله خير ،،

تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:56:21 م, on 04/03/2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Ad Muncher\AdMunch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Ad Muncher] "C:\Program Files\Ad Muncher\AdMunch.exe" /bt
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Block frame with Ad Muncher -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 - Extra context menu item: Block image with Ad Muncher -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 - Extra context menu item: Block link with Ad Muncher -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 - Extra context menu item: Don't filter page with Ad Muncher -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 - Extra context menu item: Report page to the Ad Muncher developers -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{21C5E672-22C5-49D2-B420-9483F6441CE7}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{24DDD044-DC51-4E1F-BD9D-96C068014AFC}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4946E73C-8101-4AC3-AB16-30BCE1A39F8D}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{4AA64CC8-31B2-4AFB-A664-6A84B457378A}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{987E5267-21C9-4912-A75E-FCD13FC902E5}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC9254DB-E481-40F8-800D-CBEDAB42F6DC}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{21C5E672-22C5-49D2-B420-9483F6441CE7}: NameServer = 80.118.196.36,157.161.9.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{21C5E672-22C5-49D2-B420-9483F6441CE7}: NameServer = 80.118.196.36,157.161.9.6
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: البرنامج الخفي لذاكرة التخزين المؤقت لفئات المكونات - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\DfsdkS.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 6157 bytes

​

 

[فهد بن خالد]

تقرير البرامج المثبته

7-Zip 9.20
Ad Muncher v4.92 Build 32700
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.1) - Arabic
Ashampoo Magical Snap 2.30
Ashampoo Registry Cleaner v.1.00
Ashampoo WinOptimizer 8 v.8.13
CCleaner
Google Update Helper
HiJackThis
Intel(R) Graphics Media *********** Driver
Internet Download Manager
Junk Mail filter update
K-Lite Codec Pack 8.4.0 (Full)
Malwarebytes' Anti-Malware
Messenger Plus! 5
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mozilla Firefox 10.0.2 (x86 ar)
MSVC80_x86_v2
MSVC90_x86
MSVCRT
MSXML 6.0 Parser
Nero 7 Essentials
Realtek High Definition Audio Driver
Registry First Aid
Revo Uninstaller 1.93
Segoe UI
swMSM
Windows Imaging Component
Windows Internet Explorer 8
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
WinZip
WolfTeam Arab
X-NetStat Pro 5.58
Your Uninstaller! 7
أداة التحميل Windows Live Upload Tool
أرشيف وينرار
بريد Windows Live
مساعد تسجيل الدخول إلى Windows Live


​

 

[Run]

اعمل فحص

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

بعد ما تنتهي
اعمل التالي

حمل الاداة التالية وطبق الشرح للفحص

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

​

 

[فهد بن خالد]

الله يجزاك الجنه ويرفع درجاتك الى العلا يارب ،،

تقرير SUPERAntiSpyware

SUPERAntiSpyware Scan Log

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Generated 03/04/2012 at 11:26 PM

Application Version : 5.0.1144

Core Rules Database Version : 8302
Trace Rules Database Version: 6114

Scan type : Complete Scan
Total Scan Time : 00:08:09

Operating System Information
Windows XP Professional 32-bit, Service Pack 2 (Build 5.01.2600)
Administrator

Memory items scanned : 343
Memory threats detected : 0
Registry items scanned : 33179
Registry threats detected : 2
File items scanned : 12933
File threats detected : 72

Disabled.SecurityCenterOption
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#ANTIVIRUSDISABLENOTIFY
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#UPDATESDISABLENOTIFY

Adware.Tracking Cookie
.histats.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.mediafire.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.advertising.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.pro-market.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adrevolver.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.media.adrevolver.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.burstnet.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.interclick.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.mediaplex.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.questionmarket.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adviva.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.specificmedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.specificclick.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.trafficmp.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.trafficmp.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.realmedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.realmedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.apmebf.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.fastclick.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.edge.ru4.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.tacoda.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.a1.interclick.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.zedo.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adcentriconline.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adtech.de [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.glb.adtechus.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adserverec.adtechus.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adserverwc.adtechus.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.ad.us-ec.adtechus.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.bluestreak.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.loadxl.exelator.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.loadxl.exelator.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.loadxl.exelator.biz [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.precisionclick.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.precisionclick.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.smartadserver.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.2o7.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.nextag.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.ad.yieldmanager.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.247realmedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adinterax.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
rotator.adjuggler.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.clicktale.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.casalemedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.chitika.net [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.ads.pointroll.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.kanoodle.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

[ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.tradedoubler.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.adlegend.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.weborama.fr [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

[ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
data.coremetrics.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.eyewonder.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
pluckit.demandmedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.atwola.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]
1a-do-not-track-plus.com [ C:\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\3B5KWYWQ.DEFAULT\COOKIES.SQLITE ]

التقرير الثـاني

SmitFraudFix v2.424

Scan done at 23:41:09.40, Sun 03/04/2012
Run from C:\Documents and Settings\user\«ل¥ ںéêè¢ \SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

127.0.0.1tonec.com
127.0.0.1

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

127.0.0.1 registeridm.com
127.0.0.1

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

127.0.0.1 secure.registeridm.com
127.0.0.1 internetdownloadmanager.com
127.0.0.1

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

127.0.0.1 secure.internetdownloadmanager.com
...

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End


​

 

[Run]

ارحب
كيف الوضع الان

 

[فهد بن خالد]

الله يبقيك ويطول بعمرك اخوي run وعسى الله يرحمك ووالديك من النار ويسكنكم جناته اللهم امين

الان الحمد لله الاوضاع ممتازه

عندي هذي المشكله الريجستري مايفتح

واستفسار يالغالي عملت تعطيل للخدمتين هل في تأثير اذا عطلتها اتصالي دي اس ال


Telephony

Remote Access Connection Manager
​

 

[Run]

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[فهد بن خالد]

يطول بعمرك بعد العمليه

جربت من الامر تشغيل regedit

لكن ماطلع نفس المشكله مدري هل في طريقه استعادة regedit

الله يوفقك
​

 

[فهد بن خالد]

بحثت عن
regedit.exe
في مجلد
C:\WINDOWS
وماحصلته :no:

المشكله ماعندي سي دي لصيانة الويندوز في طريقه لاسترجاعه ؟
:er:
​