ههههههههههه
عشان كذا ماطبقت الخطوات السابقة في الوضع العادي
ولايهمك يالغلا
هذا شرح فيديو لطريقة تشغيل الوضع الامن
وبانتظار التقرير يالغاالي
:d:
وصلت الى الوضع الامن واحترت ماذا اضغط لاني ابقيته على سيف مود وضغطت انتر ولم تخرج لي رسالة الوضع الامن فاقفلت الجهاز بالاستمرار بالضغط على زر بدأ التشغيل ومن ثم نزلت على الاختيار الاول وضغطت انتر وكذلك لم تخرج لي رسالة الوضع الامن
******** 09-02-10.01 - almada 02/10/2009 23:23:16.3 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.502.271 [GMT 3:00]
Running from: c:\documents and settings\almada\سطح المكتب\********.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 19:33 --------- d-----w c:\program files\Common Files\delet
2009-02-10 17:34 --------- d-----w c:\documents and settings\almada\Application Data\CyberScrub
2009-02-10 17:34 --------- d-----w c:\documents and settings\almada\Application Data\cleaner
2009-02-10 17:25 --------- d-----w c:\program files\Kaspersky Lab
2009-02-09 22:01 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-09 20:34 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-12-13 06:36 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
.
(((((((((((((((((((((((((((((
SnapShot@Tue 02-10-2009_22.01.38.21 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-10 18:09:48 40,316 ----a-w c:\windows\system32\perfc001.dat
+ 2009-02-10 19:30:04 40,316 ----a-w c:\windows\system32\perfc001.dat
- 2009-02-10 18:09:48 40,326 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-10 19:30:04 40,326 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-10 18:09:48 251,946 ----a-w c:\windows\system32\perfh001.dat
+ 2009-02-10 19:30:04 251,946 ----a-w c:\windows\system32\perfh001.dat
- 2009-02-10 18:09:48 311,938 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-10 19:30:04 311,938 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-10 20:22:24 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_1ec.dat
+ 2009-02-10 20:09:40 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_864.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/14/2008 06:59 PM 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [01/19/2007 12:55 PM 5748080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [06/08/2005 06:02 AM 167936]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [06/08/2005 05:59 AM 151552]
"Persistence"="c:\windows\system32\igfxpers.exe" [06/08/2005 06:03 AM 114688]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [06/11/2005 02:51 PM 126976]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [01/17/2005 06:25 PM 204800]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [02/10/2009 01:01 AM 206232]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [06/01/2005 01:58 AM 263720]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [01/07/2005 05:07 PM 139776 c:\windows\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [08/09/2005 10:17 AM 14743552 c:\windows\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/14/2008 06:59 PM 15360]
c:\documents and settings\All Users\çںê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-16 651325]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\HDAShCut.exe"=
"c:\\WINDOWS\\ALCMTR.EXE"=
"c:\\WINDOWS\\RTHDCPL.EXE"=
"c:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\FP_AX_CAB_INSTALLER.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=
"c:\\WINDOWS\\system32\\spider.exe"=
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\hkghpn.sys --> c:\windows\system32\drivers\hkghpn.sys [?]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyServer = 212.102.0.103:8080
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-02-10 23:24:03
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 02/10/2009 23:24:43
********-quarantined-files.txt 2009-02-10 20:24:44
********3.txt 2009-02-10 19:02:24
********2.txt 2009-02-10 19:09:14
Pre-Run: 15,094,218,752 bytes free
Post-Run: 15,092,039,680 bytes free
116 --- E O F --- 2009-02-10 14:59:47