مشكلة في الهارديسك

[وليد القحطاني]

السلام عليكم

الهارديسك اذا ظغطت عليه يعلق الجهاز ويفتح بعد ازمة ؟


ما المشكلة اخواني ,,



:f:​

 

[AbOdy]

اعمل التالي

إذا كان الهارد خارجي اشبكه .. وإذا كان داخلي اعمل التالي على كل الحالتين



==============

(1)
عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
(2)
واعمل تقرير للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم​

بالأنتظار للتقريرين​

 

[يوسف القحطاني]

^

كيف اذا كان خارجي اشبكه اخوي ؟؟


هو خارجي مالحل ؟

 

[AbOdy]

إذا كان خارجي

اشبك الهارد وشغل الأداة

بالأنتظار

 

[يوسف القحطاني]

تفضل يالغالي


ComboFix 08-09-15.02 - a 01/04/2009 6:01:34.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.270 [GMT -8:00]
Running from: C:\Documents and Settings\a\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((( Files Created from 2008-12-04 to 2009-01-04 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-04 14:03 75,040 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2009-01-04 13:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-01-04 13:58 --------- d-----w C:\Documents and Settings\a\Application Data\DMCache
2009-01-04 13:55 9,985,056 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2009-01-04 13:55 125,996 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2009-01-04 13:55 11,024 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2009-01-04 13:36 0 ----a-w C:\osy3.sys
2009-01-04 00:22 --------- d-----w C:\Program Files\Common Files\xing shared
2009-01-04 00:21 --------- d-----w C:\Program Files\Common Files\Real
2009-01-04 00:19 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2009-01-01 11:22 --------- d-----w C:\Documents and Settings\a\Application Data\cleaner
.
((((((((((((((((((((((((((((( snapshot@Fri 09-12-2008_15.41.14.07 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-21 03:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-21 04:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 15:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 16:00:00 28,672 ----a-w C:\WINDOWS\Nircmd.exe
- 2000-08-31 15:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 16:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
- 2008-09-09 00:49:23 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\s\index.dat
+ 2009-01-04 13:57:41 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\s\index.dat
- 2008-09-09 00:49:23 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-04 13:57:41 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-09-12 11:04:01 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
+ 2008-09-12 11:03:56 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat
+ 2008-09-12 11:04:00 194,320 ----a-w C:\WINDOWS\system32\drivers\klif.sys
+ 2007-04-04 22:58:26 24,344 ----a-w C:\WINDOWS\system32\drivers\klim5.sys
+ 2008-09-12 11:03:56 96,976 ----a-w C:\WINDOWS\system32\drivers\klin.dat
+ 2007-05-20 06:36:24 22,354 ----a-w C:\WINDOWS\system32\drivers\klop.dat
+ 2007-05-20 06:37:14 206,352 ----a-w C:\WINDOWS\system32\klogon.dll
- 2002-01-01 07:03:24 53,744 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2002-01-01 07:06:44 53,744 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2002-01-01 07:03:24 383,390 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2002-01-01 07:06:44 383,390 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-09-05 11:19:27 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
+ 2009-01-04 00:19:58 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
- 2008-09-05 11:19:31 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll
+ 2009-01-04 00:20:05 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll
- 2008-09-05 11:19:31 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll
+ 2009-01-04 00:20:06 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll
- 2008-08-17 03:00:00 185,944 ----a-w C:\WINDOWS\system32\rmoc3260.dll
+ 2009-01-04 00:21:42 185,944 ----a-w C:\WINDOWS\system32\rmoc3260.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 01:56 PM 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [10/18/2007 11:34 AM 5724184]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/12/2008 02:56 AM 881152]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [04/13/2004 02:25 PM 3309568]
"VX1000"="C:\WINDOWS\vVX1000.exe" [06/29/2006 03:42 PM 707376]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 06:00 AM 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_12\bin\jusched.exe" [05/02/2007 03:15 AM 75520]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [01/03/2009 04:19 PM 185896]
"nwiz"="nwiz.exe" [04/13/2004 02:25 PM 782336 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/03/2004 01:56 PM 15360]
C:\Documents and Settings\a\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="explorer.exe "
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Instant Update Reminder.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Instant Update Reminder.lnk
backup=C:\WINDOWS\pss\Instant Update Reminder.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 08/03/2004 01:56 PM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 08/24/2007 06:00 AM 33648 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 07/12/2008 02:56 AM 881152 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a--c--- 08/03/2004 11:32 AM 208952 C:\WINDOWS\ime\IMJP8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
--a------ 06/29/2006 03:54 PM 269104 C:\Program Files\Microsoft LifeCam\LifeExp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 10/13/2004 08:24 AM 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 10/18/2007 11:34 AM 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 04/13/2004 02:25 PM 3309568 C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a--c--- 04/13/2004 02:25 PM 46080 C:\WINDOWS\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a--c--- 08/03/2004 11:32 AM 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a--c--- 08/03/2004 11:32 AM 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 11/02/2004 08:24 PM 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 01/03/2009 04:19 PM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000]
--a------ 06/29/2006 03:42 PM 707376 C:\WINDOWS\vVX1000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--a------ 08/03/2004 01:56 PM 110592 C:\WINDOWS\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a--c--- 04/13/2004 02:25 PM 782336 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13700:TCP"= 13700:TCP:BitComet 13700 TCP
"13700:UDP"= 13700:UDP:BitComet 13700 UDP
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [06/29/2006 03:54 PM 187184]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [04/04/2007 02:58 PM 24344]
R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [06/29/2006 03:42 PM 1965872]
S3 Winacusb;Winacusb;C:\WINDOWS\system32\DRIVERS\winacusb.sys [07/31/2002 02:48 PM 794402]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: ت&صدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O17 -: HKLM\CCS\Interface\{1E2C1DFE-D9D9-48A7-BF35-687AAFBC713A}: NameServer = 192.168.1.254
O16 -: Microsoft XML Parser for Java -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413} - hxxp://voice4.doook.com/cp/files/talk08.cab
C:\WINDOWS\Downloaded Program Files\talk.inf
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\mfc42.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\Downloaded Program Files\Authenticatedll.dll
C:\WINDOWS\Downloaded Program Files\imcv1.dll
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-01-04 06:03:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 01/04/2009 6:08:24
ComboFix-quarantined-files.txt 2009-01-04 14:08:04
ComboFix2.txt 2008-09-12 22:41:53
Pre-Run: 32,633,827,328 bytes free
Post-Run: 32,716,627,968 bytes free
203 --- E O F --- 2008-09-11 11:05:48







لكن بعد ما انتهى الفحص طلعت لي نافذة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[alemalbyelaram]

جزاك الله خيرااااا وساعدك على قضاء حوائج الناس