• بادئ الموضوع بادئ الموضوع قوت
  • تاريخ البدء تاريخ البدء
  • المشاهدات 4,644

قوت

زيزوومي نشيط
إنضم
12 يناير 2009
المشاركات
105
مستوى التفاعل
0
النقاط
120
غير متصل
السلام عليكم
جهازي يقوم باعادة التشغيل من نفسه بعد ما يقارب نصف ساعة !
و احيانا عندما تظهر رسائل خطأ في بداية التشغيل هذه صورتها :

zyzoom-c4fdf8758e.jpg




و مباشرة يظهر بعدها مربع يطلب حفظ العمل لان الجهاز سينطفئ بعد ثواني و يبدا عد تنازلي ثم يعيد التشغيل !

هذا تقرير الهايجك ربما يمكنكم اكتشاف الخطأ :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:19:41 ص, on 15/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\System.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\HD\Desktop\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

F2 - REG:system.ini: UserInit=userinit.exe ,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderAdvise - {97421d0d-e07f-40df-8f07-99597b9585ad} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: AVG Security Toolbar - {a057a204-bacc-4d26-9990-79a187e2698e} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [3PMmUpdate] rundll32 "C:\WINDOWS\Update.dll",Main
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\Policies\Explorer\Run: [MPMKrnl] rundll32 "C:\WINDOWS\MKMKrnl.dll",KMainProc
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: nidaiolj.dll,fcggofbn.dll,depfjjnn.dll,nkcndbnm.dll,ahnhefmg.dll,khcdmhoi.dll,gnbcmgcp.dll,fcbgckdl.dll,obogkolh.dll,aglpppfm.dll,abnjmoij.dll,lkdjpcnn.dll,mdhlhabp.dll,ddedkeoo.dll,geklddoj.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,jcjjnnfa.dll,glfcegbc.dll,gccpaoel.dll,pdhonaog.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - C:\Program Files\Messenger\msgmr.dll
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll
O21 - SSODL: A171EF60 - {A171EF60-89D6-4C15-BD7B-C9A145EDD53E} - C:\WINDOWS\system32\ahnhefmg.dll
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll
O21 - SSODL: 07BC60C9 - {07BC60C9-67D6-482D-9DC9-29600C735CA0} - C:\WINDOWS\system32\gnbcmgcp.dll
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll
O21 - SSODL: DE9F3377 - {DE9F3377-E652-4B15-B675-209ED0C223EF} - C:\WINDOWS\system32\depfjjnn.dll
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 7861 bytes


بانتظاركم على أحر من الجمر :f:
 

طيب الحين الأصابه انحذفت ,,,

بس باقي ملفات الدعائية لازم نقضي عليها ,,

لاهنت قوم بتحميل هذه الأداة مرة اخرى وشغلها في الوضع الأمن



شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

000.png



بالأنتظار
 

توقيع : AbOdy

فقط للتسهيل على ماكس لما يجي بعدي

الرجستري منتهي عندها

F2 - REG:system.ini: UserInit=userinit.exe ,C:\WINDOWS\system32\ntos.exe,

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: ThunderAdvise - {97421d0d-e07f-40df-8f07-99597b9585ad} - (no file)

O4 - HKLM\..\Run: [HBService32] System.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{34343FBC-D32A-468B-B6FE-2824C643CEE1}: NameServer =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dl l,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj. dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoi j.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhl y.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll, hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,,h bmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbc hibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin 2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhl y.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi .dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dl l,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,H BWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)

O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)

O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)

O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)

O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)

O21 - SSODL: A171EF60 - {A171EF60-89D6-4C15-BD7B-C9A145EDD53E} - C:\WINDOWS\system32\ahnhefmg.dll

O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)

O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)

O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)

O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)

O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)

O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)

O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)

O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)

O21 - SSODL: 07BC60C9 - {07BC60C9-67D6-482D-9DC9-29600C735CA0} - C:\WINDOWS\system32\gnbcmgcp.dll

O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)

O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)

O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)

O21 - SSODL: DE9F3377 - {DE9F3377-E652-4B15-B675-209ED0C223EF} - C:\WINDOWS\system32\depfjjnn.dll

O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)

O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)

O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - (no file)


بأنتظار الغالي ماكس أو عبودي أو فارس

لا تطبقين شئ من مشاركتي
 
توقيع : Corporation
شغلت الاداة في الوضع الامن و اتبعت شرحك بالتفصيل , ريستارت و هذا تقرير الهايجاك :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:36:57, on 17/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\HD\Desktop\Zyzoom_HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
F2 - REG:system.ini: UserInit=userinit.exe ,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderAdvise - {97421d0d-e07f-40df-8f07-99597b9585ad} - (no file)
O2 - BHO: AVG Security Toolbar - {a057a204-bacc-4d26-9990-79a187e2698e} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [avg8_tray] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dll,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj.dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoij.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhly.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)
O21 - SSODL: A171EF60 - {A171EF60-89D6-4C15-BD7B-C9A145EDD53E} - C:\WINDOWS\system32\ahnhefmg.dll
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)
O21 - SSODL: 07BC60C9 - {07BC60C9-67D6-482D-9DC9-29600C735CA0} - C:\WINDOWS\system32\gnbcmgcp.dll
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)
O21 - SSODL: DE9F3377 - {DE9F3377-E652-4B15-B675-209ED0C223EF} - C:\WINDOWS\system32\depfjjnn.dll
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)
O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - (no file)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 8120 bytes
 
في بداية مشاكل الجهاز صادفتني هذه الحالة و اختفت لا أعرف كيف لكنها رجعت الآن
عبارة عن اختفاء ايقونة اللغة من التاسك بار رغم أنها مفعلة من التول بار , كذلك خيار فتح الرابط في صفحة جديدة لا يعمل و أيضا خاصية Find في صفحة الاكسبلورر لا تعمل و تظهر هذه النافذة :

zyzoom-f7a34da1ea.jpg


الاخوة الاعزاء عبودي وماكس والبقية أنا أقدر لكم هذه الجهود و أحاول أن أذكر المشاكل في وقت واحد حتى لا أتعبكم لفترة طويلة , طبعا في انتظار تشخيصكم لحالة الجهاز حتى الآن .
وردات كثيرة لأرواحكم الطيبة.:smile:
 
الاصابة ايضا لم تحذف

افحص الجهاز بهذا البرنامج

SUPERAntiSpyware

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


ومشكلة شريط اللغة من هنا

اداة TaskbarRepair لاصلاح كل مشاكل شريط المهام

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
 
الاصابة ايضا لم تحذف

افحص الجهاز بهذا البرنامج

SUPERAntiSpyware

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ومشكلة شريط اللغة من هنا​


اداة TaskbarRepair لاصلاح كل مشاكل شريط المهام

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


:d:

وهذا شرح للبرنامج الأول

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



بعد ما تخلص ,, من الفحص والتنظيف عطنا تقرير هايجاك جديد بعد اعادة التشغيل ,,

بالأنتظار
 
توقيع : AbOdy
برنامج التاسك بار ما افادني بشي للاسف
و للحين قائمة مشكلة الاكسبلورر !

فحصت ونظفت الجهاز ببرنامج السباي وير
و هذا تقرير هايجاك :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:28:16 ص, on 18/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\HD\Desktop\Zyzoom_HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

F2 - REG:system.ini: UserInit=userinit.exe ,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderAdvise - {97421d0d-e07f-40df-8f07-99597b9585ad} - (no file)
O2 - BHO: AVG Security Toolbar - {a057a204-bacc-4d26-9990-79a187e2698e} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [avg8_tray] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{34343FBC-D32A-468B-B6FE-2824C643CEE1}: NameServer = 195.226.228.72 195.226.228.74
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dll,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj.dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoij.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhly.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)
O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - (no file)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 8190 bytes
 
الين يجي الغالي ماآآآكس

استخدمي هذة الاداة يالغاليه

اداة دكتور ويب

فحص وتنظيف وهي بدون تثبيت

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


وهذا رابط اخر للاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



(( اذا كنت تستخدم كاسبر أعمل له خروج من جوار الساعه أولاً ))

i72j1t42q3.jpg


شرح عمل الاداة ::

بعد التحميل نقوم بتشغيلها .. ونعمل كما بالصور ::

3oh2ql4moe.jpg


ثم

wb3gi1nm8j.jpg


ثم ننتظر قليلاً يتم فحص الذاكرة فقط ..

وبعد الانتهاء نعمل كما بالصوره للفحص الشامل للجهاز

m3m2rh4xtf.jpg


وفي حال العثور على فايروس أثناء الفحص وظهرت هذه الرساله

نعمل الاتي لحذف الاصابه وتنظيفها ::

vwopk5zb2n.jpg


ثم ننتظر أنتهاء الفحص الشامل (( قد يتأخر الفحص على حسب حجم ملفاتك على الجهاز ))

وعند الانتهاء نعمل الاتي ::

vgcih1gsrj.jpg


ثم نقوم بحذف الفايروسات المكتشفه ::

1h71ch58um.jpg



 
التعديل الأخير بواسطة المشرف:
توقيع : KoNaMi
بعدين هاجيك جديد
 
توقيع : KoNaMi
اخي احذف الافج بهذه الاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


ثم اعمل تقرير هايجاك جديد
 
كونامي
انا حاليا اعمل سكان و سأرفق لكم التقرير

ماكس
طيب احذف الافج و اجلس من غير حماية عادي؟
 
احذفيه موقتأ يالغاليه

عشان نشوف المشكله يمكن من نفس البرنامج ؟؟

وانا انصحك بالكاسبر يالغاليه
 
توقيع : KoNaMi
كونامي
انا حاليا اعمل سكان و سأرفق لكم التقرير

ماكس
طيب احذف الافج و اجلس من غير حماية عادي؟

نعم احذفيه مؤقتاً
 
هذا تقرير بعد سكان الدكتور ويب :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:15:55 ص, on 18/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\HD\Desktop\متفرقات\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

F2 - REG:system.ini: UserInit=userinit.exe ,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderAdvise - {97421d0d-e07f-40df-8f07-99597b9585ad} - (no file)
O2 - BHO: AVG Security Toolbar - {a057a204-bacc-4d26-9990-79a187e2698e} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [avg8_tray] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{34343FBC-D32A-468B-B6FE-2824C643CEE1}: NameServer = 195.226.228.72 195.226.228.74
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dll,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj.dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoij.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhly.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)
O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - (no file)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 8302 bytes



برب لحذف الافج و راجعة بتقرير آخر .
 
بعد حذف الافج :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:21:16 ص, on 18/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Documents and Settings\HD\Desktop\متفرقات\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

F2 - REG:system.ini: UserInit=userinit.exe ,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderAdvise - {97421d0d-e07f-40df-8f07-99597b9585ad} - (no file)
O2 - BHO: (no name) - {a057a204-bacc-4d26-9990-79a187e2698e} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [HBService32] System.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dll,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj.dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoij.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhly.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)
O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - (no file)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 7203 bytes
 
اعملي الاتي يالغاليه


حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



ثبته على الجهاز ،، ثم شغله واعمل كما الشرح التالي لفحص الجهاز وعمل تقرير




يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي




وبعد انتهاء الفحص اعمل التالي



يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



 
التعديل الأخير بواسطة المشرف:
توقيع : KoNaMi
كل الروابط المرفوعة على هذا السيرفر تظهر لي هكذا :
The page cannot be found



:(



يوجد رابط اخر عزيزي ؟
 
التعديل الأخير بواسطة المشرف:
بحثت عن البرنامج و وجدته , قام بالفحص و حذف الملفات و هذا تقرير هايجاك جديد :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:25 م, on 18/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Documents and Settings\HD\Desktop\متفرقات\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {a057a204-bacc-4d26-9990-79a187e2698e} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dll,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj.dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoij.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhly.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 6931 bytes
 
امممم ,,, الى الأن لا يوجد تغير الأصابه لم تحذف


اعمل التالي


حمل هذه الأداة


شرح الاداة

متوافق مع فستا واكس بي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


او
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

او



يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي





بعد تشغيل الاداة ,, تقوم الاداة بعمل اختصار لها على سطح المكتب باسم Totally Clean

ثم تظهر الواجهه

zyzoom-b60ef3050d.jpg



اول شي اعمله

الضغط على رقم (1) >> انتر >> لتحديث الاداة ان وجد ((ستعود القائمه الرئيسيه تلقائيا" عند الانتهاء من التحديث))


ثاني شي

الضغط على (3) >> انتر >> لعمل فحص وحجر الملفات المصابه وانشاء تقرير <<< ويفضل الفحص من الوضع الامن وسيطلب الجهاز اعادة تشغيل عند الانتهاء


بعد ما تخلص عطني تقرير هذه الأداة وتقرير هايجاك جديد بعد اعادة التشغيل

بالأنتظار
 
توقيع : AbOdy
عملت سكان في السيف مود بكل البرامج التي استخدمتها من بداية متابعتكم لمشكلتي
حتى أن الكاسبر لم يكتشف أي ملف !
هذا تقرير هايجاك :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:33:51 م, on 18/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\HD\Desktop\متفرقات\Zyzoom_HijackThis.exe
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {a057a204-bacc-4d26-9990-79a187e2698e} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: is-F2EFC.lnk = C:\Documents and Settings\HD\Desktop\Virus Removal Tool\is-F2EFC\startup.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: add to amv converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: mediamanager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{34343FBC-D32A-468B-B6FE-2824C643CEE1}: NameServer = 195.226.228.72 195.226.228.74
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - AppInit_DLLs: gnbcmgcp.dll,khcdmhoi.dll,ahnhefmg.dll,nkcndbnm.dll,depfjjnn.dll,fcggofbn.dll,nidaiolj.dll,geklddoj.dll,ddedkeoo.dll,mdhlhabp.dll,lkdjpcnn.dll,abnjmoij.dll,aglpppfm.dll,obogkolh.dll,fcbgckdl.dll,hbmhly.dll,hbshq.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,jcjjnnfa.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,glfcegbc.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,gccpaoel.dll,hbmhly.dll,hbshq.dll,hbwulin2.dll,hbzhuxian.dll,hbchibi.dll,HBmhly.dll,HBSHQ.dll,HBWULIN2.dll,HBZHUXIAN.dll,HBCHIBI.dll,pdhonaog.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O21 - SSODL: 1C9375DB - {1C9375DB-93A1-4644-80F9-5B75E0EEDCC6} - C:\WINDOWS\system32\hcpjnldb.dll (file missing)
O21 - SSODL: E8F893C5 - {E8F893C5-6187-4FD5-BF51-DA060DCF15A9} - C:\WINDOWS\system32\eofopjcl.dll (file missing)
O21 - SSODL: C3BC90D4 - {C3BC90D4-412D-47A9-A3B5-B11DAEF9C496} - C:\WINDOWS\system32\cjbcpgdk.dll (file missing)
O21 - SSODL: FBDA1790 - {FBDA1790-F810-4CF7-A354-5670AF32B6AD} - C:\WINDOWS\system32\fbdahnpg.dll (file missing)
O21 - SSODL: AB736823 - {AB736823-3D1F-42B2-AD67-FDA376C1345B} - C:\WINDOWS\system32\abnjmoij.dll (file missing)
O21 - SSODL: 6D151AB9 - {6D151AB9-8295-4819-9525-53DE3EE1D3CB} - C:\WINDOWS\system32\mdhlhabp.dll (file missing)
O21 - SSODL: 0CC9A8E5 - {0CC9A8E5-747B-49E1-AA6B-E64EF96C567D} - C:\WINDOWS\system32\gccpaoel.dll (file missing)
O21 - SSODL: 74C7DB76 - {74C7DB76-7505-4934-8C04-58439D101425} - C:\WINDOWS\system32\nkcndbnm.dll (file missing)
O21 - SSODL: DDED4E88 - {DDED4E88-5CD0-4615-B3BA-EBAFE58DC4A5} - C:\WINDOWS\system32\ddedkeoo.dll (file missing)
O21 - SSODL: 0E45DD83 - {0E45DD83-03E6-4BFD-A5CA-5093E8B54667} - C:\WINDOWS\system32\geklddoj.dll (file missing)
O21 - SSODL: 54D39C77 - {54D39C77-CE20-41C8-9280-E58A6C063231} - C:\WINDOWS\system32\lkdjpcnn.dll (file missing)
O21 - SSODL: 41CD6182 - {41CD6182-19BB-4493-8495-F8CD733386AD} - C:\WINDOWS\system32\khcdmhoi.dll (file missing)
O21 - SSODL: FCB0C4D5 - {FCB0C4D5-1F94-4C35-A5C2-5F6388EF2BBF} - C:\WINDOWS\system32\fcbgckdl.dll (file missing)
O21 - SSODL: 8B804851 - {8B804851-76B0-4C75-ADB3-22CC0FF9CAB7} - C:\WINDOWS\system32\obogkolh.dll (file missing)
O21 - SSODL: A05999F6 - {A05999F6-C7F4-43FE-809C-F1DEA2ED37DE} - C:\WINDOWS\system32\aglpppfm.dll (file missing)
O21 - SSODL: 05FCE0BC - {05FCE0BC-CD1F-4171-840F-7741EB71618A} - C:\WINDOWS\system32\glfcegbc.dll (file missing)
O21 - SSODL: 3C3377FA - {3C3377FA-FF22-4029-9975-DF8CCBA8ECA2} - C:\WINDOWS\system32\jcjjnnfa.dll (file missing)
O21 - SSODL: 9D187A80 - {9D187A80-6D23-4725-A134-EC732CD8817D} - C:\WINDOWS\system32\pdhonaog.dll (file missing)
O21 - SSODL: 72DA2853 - {72DA2853-9931-44F0-8ABF-47B47291CCB0} - C:\WINDOWS\system32\nidaiolj.dll (file missing)
O21 - SSODL: FC008FB7 - {FC008FB7-B97C-4282-84E3-98AAB6A39588} - C:\WINDOWS\system32\fcggofbn.dll (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer (servicelayer) - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 7164 bytes
 
عودة
أعلى