عـمـار
زيزوومى متألق
غير متصل
السلام عليكم ورحمة الله وبركاته .
اخوتى الكرام : انا واجهتنى مشكلة كبيرة وغريبة .
فى البيت عندى اخوتى اخذوا فلاش ميمورى ووضعوه فى اجهزة اخرى ... الخ
ووضعوه عنا هون مرة اخرى وظهرت المشكلة مع العلم بانه تم الفحص ببرنامج
MaLwaReByteS ولم يتم الكشف عن اى فيروس فى هذه الملفات البته وهى
تاخذ هذه الاشكال :
ولكن المشكلة الاكبر فى ان اى شئ يوضع فى الجهاز تدخل اليه هذه الملفات
وكذلك عند حذفها تعود مرة اخري فيرجى الحل السريع اخوتى الكرام مع تحليل
المشكلة والسبب الحقيقى : .
تقارير :
1*- HiJack >>
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 04:59:57 م, on 04/12/2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\conhost.exe
C:\GoogleChrome\GoogleChrome.exe
C:\Windows\System32\wscript.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Zyzoom_Forum_Tools\zyzoom.exe
C:\Zyzoom_Forum_Tools\zHijak.com
C:\Program Files\Google\Chrome\Application\chrome.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.0.0.3
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll
O4 - HKCU\..\Run: [{77F427CD-4687-48D4-B487-8A542A9B94FC}] C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\TYZCJC').YBEIeEiMDEWJT)));
O4 - HKCU\..\Run: [Google Chrome] C:\GoogleChrome\WindowsUpdate.lnk
O4 - HKCU\..\Run: [AdopeUpdate] C:\GoogleChrome\GoogleUpdate.lnk
O4 - HKCU\..\Run: [AdopeFlash] C:\GoogleChrome\GoogleChrome.exe /AutoIt3ExecuteScript C:\GoogleChrome\GoogleChrome.a3x
O4 - HKCU\..\Run: [Microsoft Word] wscript.exe //D "C:\Users\MosT_WaNTeD\AppData\Roaming\Microsoft Office\\Microsoft Word.WsF"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: خدمة Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: خدمة Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Wise Boot Assistant (WiseBootAssistant) - WiseCleaner.com - C:\Program Files\Wise\Wise Care 365\BootTime.exe
--
End of file - 5123 bytes
ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ
2*- RuNScuNNeR >>
Runscanner logfile
* = signed file
- = file not found
General info
------------
Computer name : MOST_WANTED-PC
Creation time : 04/12/2015 05:00:44 م
Hosts <> 127.0.0.1 : 6
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 9.0.8112.16421
OS : Windows 7 Ultimate
OS Build : 7601
OS SP : Service Pack 1
RunScanner Version : 2.0.0.50
User Language : Arabic (Egypt)
User rights : Administrator
Windows folder : C:\Windows
Running processes
-----------------
* C:\GoogleChrome\GoogleChrome.exe (AutoIt Team)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\conhost.exe (Microsoft Corporation)
* C:\Windows\System32\dwm.exe (Microsoft Corporation)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
* C:\Program Files\Internet Download Manager\IEMonitor.exe (Tonec Inc.)
* C:\Windows\System32\lsass.exe (Microsoft Corporation)
* C:\Windows\System32\lsm.exe (Microsoft Corporation)
* C:\Windows\System32\wscript.exe (Microsoft Corporation)
* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)
* C:\Zyzoom_Forum_Tools\zRunScanner.com (Runscanner.net)
* C:\Windows\System32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\explorer.exe (Microsoft Corporation)
* C:\Windows\System32\winlogon.exe (Microsoft Corporation)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
* C:\Windows\System32\smss.exe (Microsoft Corporation)
* C:\Windows\System32\wininit.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)
C:\Zyzoom_Forum_Tools\zyzoom.exe
Unrated items
-------------
003 * C:\GoogleChrome\GoogleChrome.exe (AutoIt Team)
003 C:\GoogleChrome\GoogleUpdate.lnk
003 C:\GoogleChrome\WindowsUpdate.lnk
010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)
010 * C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Acrobat Update Service)
010 * C:\Program Files\Google\Update\GoogleUpdate.exe (Google Installer)
010 * C:\Program Files\Google\Update\GoogleUpdate.exe (Google Installer)
010 * C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Anti-Malware)
010 C:\Program Files\Wise\Wise Care 365\BootTime.exe (Wise BootTime Service)
011 C:\Windows\WiseHDInfo32.dll (Hardware Information driver)
011 * C:\Windows\system32\DRIVERS\idmwfp.sys (Internet Download Manager WFP Driver)
011 * C:\Program Files\UltraISO\drivers\ISODrive.sys (ISO DVD/CD-ROM Device Driver)
011 * C:\Windows\system32\drivers\mbam.sys (MBAMProtector)
011 * C:\Windows\system32\drivers\mwac.sys (MBAMWebAccessControl)
035 * C:\Program Files\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}
042 GUID / CLSID not found {92780B25-18CC-41C8-B9BE-3C9C571A8263}
052 * C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.) {0055C089-8582-441B-A0BF-17B458C2A3A8}
052 * C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
052 * C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}
052 * C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit) {10921475-03CE-4E04-90CE-E2E7EF20C814}
060 GUID / CLSID not found {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
061 C:\Windows\system32\IcarosThumbnailProvider.dll (Tabibito Technology) {c5aec3ec-e812-4677-a9a7-4fee1f9aa000}
061 * C:\Program Files\Internet Download Manager\IDMShellExt.dll (Tonec Inc.) {CDC95B92-E27C-4745-A8C5-64A52A78855D}
061 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
061 C:\Program Files\TeraCopy\TeraCopy.dll {A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}
061 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
061 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
061 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
069 C:\Windows\system32\mdimon.dll (Microsoft Corporation)
073 Adobe Flash Player PPAPI Notifier.job : C:\Windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe (Adobe Systems Incorporated)
073 GoogleUpdateTaskMachineUA.job : C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
100 ProxyOverride HKCU : 1
104 GUID / CLSID not found {D27CDB6E-AE6D-11CF-96B8-444553540000}
105 تحميل الكل بواسطة Internet Download Manager : C:\Program Files\Internet Download Manager\IEGetAll.htm
105 تحميل بواسطة Internet Download Manager : C:\Program Files\Internet Download Manager\IEExt.htm
173 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
173 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
173 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
221 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
221 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
221 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
225 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
225 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
225 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
225 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
225 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
225 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
227 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
227 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
227 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 * C:\Program Files\Internet Download Manager\IDMShellExt.dll (Tonec Inc.) {CDC95B92-E27C-4745-A8C5-64A52A78855D}
251 C:\Program Files\TeraCopy\TeraCopy.dll {A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}
Missing files
-------------
011 System32\drivers\rdvgkmd.sys
011 c:\windows\system32\DRIVERS\taphss6.sys
اخوتى الكرام : انا واجهتنى مشكلة كبيرة وغريبة .
فى البيت عندى اخوتى اخذوا فلاش ميمورى ووضعوه فى اجهزة اخرى ... الخ
ووضعوه عنا هون مرة اخرى وظهرت المشكلة مع العلم بانه تم الفحص ببرنامج
MaLwaReByteS ولم يتم الكشف عن اى فيروس فى هذه الملفات البته وهى
تاخذ هذه الاشكال :
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
[/URL]
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
ولكن المشكلة الاكبر فى ان اى شئ يوضع فى الجهاز تدخل اليه هذه الملفات
وكذلك عند حذفها تعود مرة اخري فيرجى الحل السريع اخوتى الكرام مع تحليل
المشكلة والسبب الحقيقى : .
تقارير :
1*- HiJack >>
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 04:59:57 م, on 04/12/2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\conhost.exe
C:\GoogleChrome\GoogleChrome.exe
C:\Windows\System32\wscript.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Zyzoom_Forum_Tools\zyzoom.exe
C:\Zyzoom_Forum_Tools\zHijak.com
C:\Program Files\Google\Chrome\Application\chrome.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.0.0.3
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O1 - Hosts: 127.0.0.2 mefeedia.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll
O4 - HKCU\..\Run: [{77F427CD-4687-48D4-B487-8A542A9B94FC}] C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\TYZCJC').YBEIeEiMDEWJT)));
O4 - HKCU\..\Run: [Google Chrome] C:\GoogleChrome\WindowsUpdate.lnk
O4 - HKCU\..\Run: [AdopeUpdate] C:\GoogleChrome\GoogleUpdate.lnk
O4 - HKCU\..\Run: [AdopeFlash] C:\GoogleChrome\GoogleChrome.exe /AutoIt3ExecuteScript C:\GoogleChrome\GoogleChrome.a3x
O4 - HKCU\..\Run: [Microsoft Word] wscript.exe //D "C:\Users\MosT_WaNTeD\AppData\Roaming\Microsoft Office\\Microsoft Word.WsF"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: خدمة Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: خدمة Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Wise Boot Assistant (WiseBootAssistant) - WiseCleaner.com - C:\Program Files\Wise\Wise Care 365\BootTime.exe
--
End of file - 5123 bytes
ـــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــــ
2*- RuNScuNNeR >>
Runscanner logfile
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
* = signed file
- = file not found
General info
------------
Computer name : MOST_WANTED-PC
Creation time : 04/12/2015 05:00:44 م
Hosts <> 127.0.0.1 : 6
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 9.0.8112.16421
OS : Windows 7 Ultimate
OS Build : 7601
OS SP : Service Pack 1
RunScanner Version : 2.0.0.50
User Language : Arabic (Egypt)
User rights : Administrator
Windows folder : C:\Windows
Running processes
-----------------
* C:\GoogleChrome\GoogleChrome.exe (AutoIt Team)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\conhost.exe (Microsoft Corporation)
* C:\Windows\System32\dwm.exe (Microsoft Corporation)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
* C:\Program Files\Internet Download Manager\IEMonitor.exe (Tonec Inc.)
* C:\Windows\System32\lsass.exe (Microsoft Corporation)
* C:\Windows\System32\lsm.exe (Microsoft Corporation)
* C:\Windows\System32\wscript.exe (Microsoft Corporation)
* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)
* C:\Zyzoom_Forum_Tools\zRunScanner.com (Runscanner.net)
* C:\Windows\System32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\explorer.exe (Microsoft Corporation)
* C:\Windows\System32\winlogon.exe (Microsoft Corporation)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
* C:\Windows\System32\smss.exe (Microsoft Corporation)
* C:\Windows\System32\wininit.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)
C:\Zyzoom_Forum_Tools\zyzoom.exe
Unrated items
-------------
003 * C:\GoogleChrome\GoogleChrome.exe (AutoIt Team)
003 C:\GoogleChrome\GoogleUpdate.lnk
003 C:\GoogleChrome\WindowsUpdate.lnk
010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)
010 * C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Acrobat Update Service)
010 * C:\Program Files\Google\Update\GoogleUpdate.exe (Google Installer)
010 * C:\Program Files\Google\Update\GoogleUpdate.exe (Google Installer)
010 * C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Anti-Malware)
010 C:\Program Files\Wise\Wise Care 365\BootTime.exe (Wise BootTime Service)
011 C:\Windows\WiseHDInfo32.dll (Hardware Information driver)
011 * C:\Windows\system32\DRIVERS\idmwfp.sys (Internet Download Manager WFP Driver)
011 * C:\Program Files\UltraISO\drivers\ISODrive.sys (ISO DVD/CD-ROM Device Driver)
011 * C:\Windows\system32\drivers\mbam.sys (MBAMProtector)
011 * C:\Windows\system32\drivers\mwac.sys (MBAMWebAccessControl)
035 * C:\Program Files\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}
042 GUID / CLSID not found {92780B25-18CC-41C8-B9BE-3C9C571A8263}
052 * C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.) {0055C089-8582-441B-A0BF-17B458C2A3A8}
052 * C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
052 * C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}
052 * C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit) {10921475-03CE-4E04-90CE-E2E7EF20C814}
060 GUID / CLSID not found {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
061 C:\Windows\system32\IcarosThumbnailProvider.dll (Tabibito Technology) {c5aec3ec-e812-4677-a9a7-4fee1f9aa000}
061 * C:\Program Files\Internet Download Manager\IDMShellExt.dll (Tonec Inc.) {CDC95B92-E27C-4745-A8C5-64A52A78855D}
061 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
061 C:\Program Files\TeraCopy\TeraCopy.dll {A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}
061 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
061 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
061 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
069 C:\Windows\system32\mdimon.dll (Microsoft Corporation)
073 Adobe Flash Player PPAPI Notifier.job : C:\Windows\system32\Macromed\Flash\FlashUtil32_19_0_0_226_pepper.exe (Adobe Systems Incorporated)
073 GoogleUpdateTaskMachineUA.job : C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
100 ProxyOverride HKCU : 1
104 GUID / CLSID not found {D27CDB6E-AE6D-11CF-96B8-444553540000}
105 تحميل الكل بواسطة Internet Download Manager : C:\Program Files\Internet Download Manager\IEGetAll.htm
105 تحميل بواسطة Internet Download Manager : C:\Program Files\Internet Download Manager\IEExt.htm
173 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
173 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
173 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
221 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
221 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
221 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
225 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
225 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
225 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
225 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
225 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
225 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 * C:\Program Files\WinRAR\rarext.dll (Alexander Roshal) {B41DB860-8EE4-11D2-9906-E49FADC173CA}
227 C:\PROGRA~1\TeraCopy\TERACO~1.DLL {A8005AF0-D6E8-48AF-8DFA-023B1CF660A7}
227 * C:\Program Files\UltraISO\isoshell.dll (EZB Systems, Inc.) {AD392E40-428C-459F-961E-9B147782D099}
227 * C:\Program Files\IObit\IObit Uninstaller\UninstallMenuRight32.dll (IObit) {A6FF0E3A-8437-482C-8E04-4F9E15C57538}
231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 * C:\Program Files\Internet Download Manager\IDMShellExt.dll (Tonec Inc.) {CDC95B92-E27C-4745-A8C5-64A52A78855D}
251 C:\Program Files\TeraCopy\TeraCopy.dll {A7005AF0-D6E8-48AF-8DFA-023B1CF660A7}
Missing files
-------------
011 System32\drivers\rdvgkmd.sys
011 c:\windows\system32\DRIVERS\taphss6.sys
