حل لمشكلة logon.exe

[الورد]

الأعضاء الكرام

فتحت البريد و وجدت فيه رابط موقع استربت منه ، نسخته و وضعته في قوقل لأتأكد من ماهية الموقع

مع أني لم أدخل الموقع إنما بحثت عنه .... ثم انغلقت كل شاشات الجهاز تلقائيا .

ثم اشتغلت بعد دقيقة تلقائيا .... وعملتُ له اعادة تشغيل

ثم اكتشف الأفاست هذا :

C:\WINDOWS\system32\logon.exe

و هذا :
C:\DOCUME~1\USER\LOCALS~1\Temp\logon.exe



وقمت بحذفها ، وعملت تقرير الهايجاك ليطمئن قلبي :







=========================



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:21:59 م, on 20/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Documents and Settings\USER\Desktop\Zyzoom_HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EE9F689-5800-4D1A-9173-9A33E7A9813B}: NameServer = 195.226.228.72 195.226.228.74
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe

--
End of file - 5207 bytes



============================








فهل التقرير سليم ؟

 

[Demo-dashDemo-dash is verified member.]

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم​

وتقرير هاي جاك جديد

اعمل تقرير للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات .. ويظهر لك تقرير اعمل تحديد الكل ==> انسخه والصقه بردك القادم​

​

 

[الورد]

الأستاذ

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

طبقت كل الذي قلته ( تعطيل الحماية إلخ ) ، لكني أؤكد لك أنه في المرات السابقة وهذه المرة حين أستخدم ComboFix

لا يعمل ( اعادة تشغيل ) تلقائيا
ويعطني التقرير قبل اعادة التشغيل .

وهذا هو التقرير الأول :


ComboFix 08-11-19.08 - USER 11/20/2008 19:38:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1033.18.551 [GMT 3:00]
Running from: c:\documents and settings\USER\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-10-20 to 2008-11-20 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-20 16:40 --------- d-----w c:\documents and settings\USER\Application Data\DMCache
2008-11-20 16:35 --------- d-----w c:\documents and settings\USER\Application Data\Skype
2008-11-20 14:03 --------- d-----w c:\program files\Internet Download Manager
2008-11-20 13:11 --------- d-----w c:\program files\Spyware Terminator
2008-11-20 13:11 --------- d-----w c:\documents and settings\USER\Application Data\Spyware Terminator
2008-11-20 13:05 --------- d-----w c:\documents and settings\USER\Application Data\skypePM
2008-11-20 12:07 --------- d-----w c:\documents and settings\All Users\Application Data\Spyware Terminator
2008-11-16 18:51 --------- d-----w c:\documents and settings\USER\Application Data\shamela
2008-11-16 14:31 737,280 ----a-w c:\windows\iun6002.exe
2008-11-16 11:05 --------- d-----w c:\program files\Nokia
2008-11-15 22:11 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-11-15 22:11 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2008-11-15 15:04 --------- d-----w c:\documents and settings\All Users\Application Data\Nokia
2008-11-15 15:02 --------- d-----w c:\program files\MSXML 6.0
2008-11-15 15:01 --------- d-----w c:\program files\Common Files\Nokia
2008-11-15 14:59 --------- d-----w c:\documents and settings\USER\Application Data\IDM
2008-11-15 14:54 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2008-11-08 02:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2008-11-08 02:29 --------- d-----w c:\program files\Common Files\Adobe
2008-11-08 01:09 --------- d-----w c:\program files\PhotoWatermark Professional 7
2008-11-07 23:26 --------- d-----w c:\documents and settings\All Users\Application Data\GlobalScape
2008-11-07 23:02 --------- d-----w c:\documents and settings\USER\Application Data\GlobalSCAPE
2008-11-07 23:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-07 23:01 --------- d-----w c:\program files\GlobalSCAPE
2008-11-07 23:01 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-07 22:54 --------- d-----w c:\program files\CCleaner
2008-11-07 00:04 --------- d-----w c:\program files\Alwil Software
2008-11-07 00:00 --------- d-----w c:\documents and settings\USER\Application Data\vlc
2008-11-06 23:33 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-06 23:28 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-06 23:09 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-06 22:58 --------- d-----w c:\program files\Windows Live
2008-11-06 22:49 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-06 21:47 --------- d-----w c:\program files\Skype
2008-11-06 21:37 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-11-06 21:36 --------- d-----w c:\program files\Common Files\Skype
2008-11-06 21:36 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-11-06 21:35 1,773,568 ----a-w c:\windows\system32\msgdiplus.dll
2008-11-06 21:27 --------- d-----w c:\program files\QuickTime Alternative
2008-11-06 21:27 --------- d-----w c:\program files\Media Player Classic
2008-11-06 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-06 21:22 32,000 ----a-w c:\windows\system32\drivers\stppp.sys
2008-11-06 21:22 --------- d-----w c:\program files\Thomson SpeedTouch
2008-11-06 19:32 --------- d-----w c:\program files\Magic Video Converter
2008-11-06 19:29 --------- d-----w c:\program files\Total Video Converter
2008-11-06 19:18 --------- d-----w c:\program files\MySQL
2008-11-06 18:58 --------- d-----w c:\program files\VideoLAN
2008-11-06 18:54 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-06 18:54 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-11-06 18:54 --------- d-----w c:\program files\Real
2008-11-06 18:54 --------- d-----w c:\program files\Common Files\xing shared
2008-11-06 18:54 --------- d-----w c:\program files\Common Files\Real
2008-11-06 18:50 --------- d-----w c:\program files\Common Files\Ahead
2008-11-06 18:50 --------- d-----w c:\program files\Ahead
2008-11-06 18:44 --------- d-----w c:\program files\Microsoft.NET
2008-11-06 18:43 --------- d-----w c:\program files\Microsoft Works
2008-11-06 18:04 --------- d-----w c:\documents and settings\USER\Application Data\ACD Systems
2008-11-06 18:03 --------- d-----w c:\program files\Common Files\ACD Systems
2008-11-06 18:03 --------- d-----w c:\program files\ACD Systems
2008-11-06 18:03 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-11-06 17:34 --------- d-----w c:\program files\microsoft frontpage
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-15 05:56 91,136 ----a-w c:\windows\system32\nmwcdcls.dll
2008-08-20 05:30 666,112 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 03:00 PM 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [02/01/2008 05:22 PM 21898024]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [11/18/2008 08:39 PM 81000]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [11/08/2008 05:34 AM 1783808]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/06/2008 09:54 PM 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 03:00 PM 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 10/15/2008 01:04 AM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 09/26/2008 11:02 AM 2356088 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagnostics]
--a------ 11/07/2008 12:22 AM 557149 c:\program files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 07/29/2008 05:18 PM 2610608 c:\program files\Internet Download Manager\IDMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 04/14/2008 05:42 AM 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 10:50 AM 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
--a------ 11/08/2008 05:34 AM 1783808 c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 11/06/2008 09:54 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
--a------ 01/30/2004 03:33 AM 180224 c:\windows\system32\pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Thomson SpeedTouch\\ST330\\service\\st330service.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-07 110160]
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-08 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-07 20560]
R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-11-07 30464]
R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-11-07 12672]
R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\DRIVERS\stppp.sys [2008-11-07 32000]

*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Cmaudio - cmicnfg.cpl


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\USER\Application Data\Mozilla\Firefox\Profiles\ti2xi2ec.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-11-20 19:40:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 4.1\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 4.1\my.ini\" MySQL"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service"
.
Completion time: 11/20/2008 19:41:54
ComboFix-quarantined-files.txt 2008-11-20 16:41:49

Pre-Run: 29,525,078,016 bytes free
Post-Run: 29,518,983,168 bytes free

168 --- E O F --- 2008-11-07 23:49:20

 

[الورد]

ولما علمتُ اعادة تشغيل يدويا لم يعمل البرنامج إلا يدويا :

وهذا التقرير بعد اعادة التشغيل :


ComboFix 08-11-19.08 - USER 11/20/2008 19:51:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.965.1033.18.694 [GMT 3:00]
Running from: c:\documents and settings\USER\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-10-20 to 2008-11-20 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-20 16:49 --------- d-----w c:\documents and settings\USER\Application Data\Skype
2008-11-20 16:40 --------- d-----w c:\documents and settings\USER\Application Data\DMCache
2008-11-20 14:03 --------- d-----w c:\program files\Internet Download Manager
2008-11-20 13:11 --------- d-----w c:\program files\Spyware Terminator
2008-11-20 13:11 --------- d-----w c:\documents and settings\USER\Application Data\Spyware Terminator
2008-11-20 13:05 --------- d-----w c:\documents and settings\USER\Application Data\skypePM
2008-11-20 12:07 --------- d-----w c:\documents and settings\All Users\Application Data\Spyware Terminator
2008-11-16 18:51 --------- d-----w c:\documents and settings\USER\Application Data\shamela
2008-11-16 14:31 737,280 ----a-w c:\windows\iun6002.exe
2008-11-16 11:05 --------- d-----w c:\program files\Nokia
2008-11-15 22:11 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-11-15 22:11 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2008-11-15 15:04 --------- d-----w c:\documents and settings\All Users\Application Data\Nokia
2008-11-15 15:02 --------- d-----w c:\program files\MSXML 6.0
2008-11-15 15:01 --------- d-----w c:\program files\Common Files\Nokia
2008-11-15 14:59 --------- d-----w c:\documents and settings\USER\Application Data\IDM
2008-11-15 14:54 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
2008-11-08 02:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys
2008-11-08 02:29 --------- d-----w c:\program files\Common Files\Adobe
2008-11-08 01:09 --------- d-----w c:\program files\PhotoWatermark Professional 7
2008-11-07 23:26 --------- d-----w c:\documents and settings\All Users\Application Data\GlobalScape
2008-11-07 23:02 --------- d-----w c:\documents and settings\USER\Application Data\GlobalSCAPE
2008-11-07 23:01 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-07 23:01 --------- d-----w c:\program files\GlobalSCAPE
2008-11-07 23:01 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-07 22:54 --------- d-----w c:\program files\CCleaner
2008-11-07 00:04 --------- d-----w c:\program files\Alwil Software
2008-11-07 00:00 --------- d-----w c:\documents and settings\USER\Application Data\vlc
2008-11-06 23:33 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2008-11-06 23:28 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-06 23:09 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-11-06 22:58 --------- d-----w c:\program files\Windows Live
2008-11-06 22:49 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-06 21:47 --------- d-----w c:\program files\Skype
2008-11-06 21:37 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-11-06 21:36 --------- d-----w c:\program files\Common Files\Skype
2008-11-06 21:36 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2008-11-06 21:35 1,773,568 ----a-w c:\windows\system32\msgdiplus.dll
2008-11-06 21:27 --------- d-----w c:\program files\QuickTime Alternative
2008-11-06 21:27 --------- d-----w c:\program files\Media Player Classic
2008-11-06 21:27 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-06 21:22 32,000 ----a-w c:\windows\system32\drivers\stppp.sys
2008-11-06 21:22 --------- d-----w c:\program files\Thomson SpeedTouch
2008-11-06 19:32 --------- d-----w c:\program files\Magic Video Converter
2008-11-06 19:29 --------- d-----w c:\program files\Total Video Converter
2008-11-06 19:18 --------- d-----w c:\program files\MySQL
2008-11-06 18:58 --------- d-----w c:\program files\VideoLAN
2008-11-06 18:54 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-11-06 18:54 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-11-06 18:54 --------- d-----w c:\program files\Real
2008-11-06 18:54 --------- d-----w c:\program files\Common Files\xing shared
2008-11-06 18:54 --------- d-----w c:\program files\Common Files\Real
2008-11-06 18:50 --------- d-----w c:\program files\Common Files\Ahead
2008-11-06 18:50 --------- d-----w c:\program files\Ahead
2008-11-06 18:44 --------- d-----w c:\program files\Microsoft.NET
2008-11-06 18:43 --------- d-----w c:\program files\Microsoft Works
2008-11-06 18:04 --------- d-----w c:\documents and settings\USER\Application Data\ACD Systems
2008-11-06 18:03 --------- d-----w c:\program files\Common Files\ACD Systems
2008-11-06 18:03 --------- d-----w c:\program files\ACD Systems
2008-11-06 18:03 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2008-11-06 17:34 --------- d-----w c:\program files\microsoft frontpage
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-15 05:56 91,136 ----a-w c:\windows\system32\nmwcdcls.dll
2008-08-20 05:30 666,112 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@Thu 11-20-2008_19.41.11.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-20 16:48:40 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_604.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 03:00 PM 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [02/01/2008 05:22 PM 21898024]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [10/18/2007 11:34 AM 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [11/18/2008 08:39 PM 81000]
"SpywareTerminator"="c:\progra~1\SPYWAR~1\SpywareTerminatorShield.exe" [11/08/2008 05:34 AM 1783808]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [11/06/2008 09:54 PM 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 03:00 PM 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 10/15/2008 01:04 AM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra------ 09/26/2008 11:02 AM 2356088 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagnostics]
--a------ 11/07/2008 12:22 AM 557149 c:\program files\Thomson SpeedTouch\ST330\diagnostics\diagnostics.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 07/29/2008 05:18 PM 2610608 c:\program files\Internet Download Manager\IDMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 04/14/2008 05:42 AM 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 10:50 AM 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
--a------ 11/08/2008 05:34 AM 1783808 c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 11/06/2008 09:54 PM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
--a------ 01/30/2004 03:33 AM 180224 c:\windows\system32\pctspk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Thomson SpeedTouch\\ST330\\service\\st330service.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-07 110160]
R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-08 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-07 20560]
R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2008-11-07 30464]
R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2008-11-07 12672]
R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\DRIVERS\stppp.sys [2008-11-07 32000]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\USER\Application Data\Mozilla\Firefox\Profiles\ti2xi2ec.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-11-20 19:53:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 4.1\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 4.1\my.ini\" MySQL"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\st330service]
"ImagePath"="C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe -service"
.
Completion time: 11/20/2008 19:54:20
ComboFix-quarantined-files.txt 2008-11-20 16:54:07
ComboFix2.txt 2008-11-20 16:41:56

Pre-Run: 29,533,532,160 bytes free
Post-Run: 29,524,451,328 bytes free

169 --- E O F --- 2008-11-07 23:49:20

 

[الورد]

وهذا تقرير الهايجاك :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:56:40 م, on 20/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Documents and Settings\USER\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EE9F689-5800-4D1A-9173-9A33E7A9813B}: NameServer = 195.226.228.72 195.226.228.74
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe

--
End of file - 5114 bytes

 

[Demo-dashDemo-dash is verified member.]

المعذره على التاخير اخي الكريم

احذف التالي من الهاي جاك

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


طريقة الحذف

​

​

بعدها اذهب الى اضافة وازالة البرامج واحذف التولبار الموجود عندك (toolbar)>> ممكن ما يكون موجود​

ثم نزل هذه الاداة واتبع الشرح التالي​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط ​

شرح الاستخدام ,,,,,,
دبل كلك على الاداة واصبر حتى تنتهي جميع النوافذ وتقف عند هذه النافذة​

​

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))
​

​

 

[الورد]

أحسن الله إليك لم تتأخر إطلاقا ، بل ساعدتني كثيرا من وقتك

فعلت كل ما أشرت به ، فهل بقي شيء لإصلاح الجهاز ؟


وهذا تقرير الهايجاك أرفقه بعد كل هذه العمليات :


========================================




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:35 م, on 20/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson SpeedTouch\ST330\service\st330service.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\USER\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [Privacy Suite] "C:\Documents and Settings\USER\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\USER\Application Data\CyberScrub\Privacy Suite"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{6EE9F689-5800-4D1A-9173-9A33E7A9813B}: NameServer = 195.226.228.72 195.226.228.74
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson SpeedTouch/ST330/service/st330service.exe

--
End of file - 5233 bytes

 

[Demo-dashDemo-dash is verified member.]

التقرير سليم ,,

ااذا استمرت الرساله بالظهور ابدأ >> تشغيل >> والصق

%temp%

ثم انتر ,, راح يطلع لك مجلد

احذف هذا الملف

logon.exe

بهذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

والله الموفق
​

 

[الورد]

أحسن الله إليك ، وفرج كربتك آمين

 

[Demo-dashDemo-dash is verified member.]

وياك يااااارب
الله يرزقك ويحفظك اخي الكريم
​