الجهاز يطفي من حاله بدون استأذان وش رايكم ؟؟؟ ( اعراض فيروس )

باتريوت

باتريوت

زيزوومى مبدع
إنضم
8 يونيو 2008
المشاركات
1,917
مستوى التفاعل
27
النقاط
680
الإقامة
وش دخلك !
غير متصل
السلام عليكم
كيف حال الشباب
ذلحين الجهاز مالي نصيب فيه وقت العصر والمغرب
وتالي الليل
كل شوي وهو طافي من نفسه
و الاوقات الثانيه شغال تمام
طبعاً هو جهاز التجارب ومافيه موقع كراكات او برنامج الا وقمت بتثبيته عليه
لذلك توقعت المشكله من فايروس

واللي لاحضته اني كل ما ضغطت على ctrl + c طفى
وجميع الادوات اللي في المنتدى استخدمتها
وقمت بفحص الجهاز بواسطة افاست ولم يكتشف شئ .

(( يعني يسجل خروج ويحفظ العمل ثم يطفي ))

هذي التقارير


الهايجاك

​


Logfile of Trend Micro HijackThis v2.0.2
أنقر للتوسيع...

Scan saved at 19:00:59, on 21/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\atievxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\saad\سطح المكتب\الذااكره\خاص بالبرامج\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com;www.plimus.com;regnow.com;www.regnow.com;<local>;*.local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "D:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - D:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - D:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
--
End of file - 6670 bytes
أنقر للتوسيع...




اداة الكمبوفكس


******** 09-02-19.01 - saad 02/21/2009 2:36:08.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.1.1025.18.511.209 [GMT 3:00[FONT=Courier New (Arabic)]][/FONT]
Running from: c:\documents and settings\saad[FONT=Courier New (Arabic)]\سطح المكتب\[/FONT]********.exe
AV: avast! antivirus 4.8.1335 [VPS 090218-0] *On-access scanning disabled* (Updated[FONT=Courier New (Arabic)])[/FONT]
AV: AVG Internet Security *On-access scanning enabled* (Updated[FONT=Courier New (Arabic)])[/FONT]
AV: Rising Antivirus *On-access scanning disabled* (Outdated[FONT=Courier New (Arabic)])[/FONT]
FW: AVG Firewall *enabled[FONT=Courier New (Arabic)]*[/FONT]
[FONT=Courier New (Arabic)]* [/FONT]Created a new restore point
[FONT=Courier New (Arabic)]*
أنقر للتوسيع...
[/FONT]
Resident AV is active

[FONT=Courier New (Arabic)]

[/FONT]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED[FONT=Courier New (Arabic)] !![/FONT]
[FONT=Courier New (Arabic)].[/FONT]

[FONT=Courier New (Arabic)]((((((((((((((((((((((((((((((((((((((( [/FONT]Other Deletions[FONT=Courier New (Arabic)] )))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New (Arabic)].[/FONT]

c:\windows\system32\drivers\RKHit.sys

[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]((((((((((((((((((((((((((((((((((((((( [/FONT]Drivers/Services[FONT=Courier New (Arabic)] )))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New (Arabic)].[/FONT]

[FONT=Courier New (Arabic)]-------\[/FONT]Service_RkHit
[FONT=Courier New (Arabic)]

((((((((((((((((((((((((( ​
[/FONT]
Files Created from 2009-01-20 to 2009-02-20[FONT=Courier New (Arabic)] )))))))))))))))))))))))))))))))[/FONT]

[FONT=Courier New (Arabic)].[/FONT]

No new files created in this timespan

[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)](((((((((((((((((((((((((((((((((((((((( [/FONT]Find3M Report[FONT=Courier New (Arabic)] ))))))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]2009-02-20 23:41 358,885,408 --[/FONT]sha-wc:\windows\system32\drivers\fidbox.dat
[FONT=Courier New (Arabic)]2009-02-20 23:40 --------- ​
[/FONT]
d-----wc:\program files\microsoft frontpage

[FONT=Courier New (Arabic)]2009-02-20 23:39 4,204,004 --​
[/FONT]
sha-wc:\windows\system32\drivers\fidbox.idx

[FONT=Courier New (Arabic)]2009-02-20 17:18 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\SWiSHMax2WorkFolder

[FONT=Courier New (Arabic)]2009-02-20 16:22 --------- ​
[/FONT]
d---a-wc:\documents and settings\All Users\Application Data\TEMP

[FONT=Courier New (Arabic)]2009-02-20 16:22 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\DMCache

[FONT=Courier New (Arabic)]2009-02-20 10:56 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\FTWeak

[FONT=Courier New (Arabic)]2009-02-19 21:08 --------- ​
[/FONT]
d-----wc:\program files\Alwil Software

[FONT=Courier New (Arabic)]2009-02-17 20:43 --------- ​
[/FONT]
d-----wc:\program files\Acoustica Shared Effects

[FONT=Courier New (Arabic)]2009-02-17 20:43 --------- ​
[/FONT]
d-----wc:\program files\Acoustica Mixcraft 3

[FONT=Courier New (Arabic)]2009-02-17 20:43 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Acoustica

[FONT=Courier New (Arabic)]2009-02-17 20:42 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Acoustica

[FONT=Courier New (Arabic)]2009-02-17 08:16 --------- ​
[/FONT]
d-----wc:\program files\Common Files\SWiSHzone.com

[FONT=Courier New (Arabic)]2009-02-17 08:12 --------- ​
[/FONT]
d-----wc:\program files\SWiSH Max2

[FONT=Courier New (Arabic)]2009-02-17 05:43 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Adobe

[FONT=Courier New (Arabic)]2009-02-17 05:42 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Adobe Systems Shared

[FONT=Courier New (Arabic)]2009-02-16 16:36 --------- ​
[/FONT]
d-----wc:\program files\TuneUp Utilities 2009

[FONT=Courier New (Arabic)]2009-02-15 06:33 --------- ​
[/FONT]
d-----wc:\program files\Blackstar

[FONT=Courier New (Arabic)]2009-02-15 06:31 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Filseclab

[FONT=Courier New (Arabic)]2009-02-14 12:01 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Passolo Demo

[FONT=Courier New (Arabic)]2009-02-14 10:49 --------- ​
[/FONT]
d-----wc:\program files\Passolo Demo

[FONT=Courier New (Arabic)]2009-02-14 10:49 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Passolo Demo

[FONT=Courier New (Arabic)]2009-02-13 19:45 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\DriverCure

[FONT=Courier New (Arabic)]2009-02-13 19:42 --------- ​
[/FONT]
d--h--wc:\program files\InstallShield Installation Information

[FONT=Courier New (Arabic)]2009-02-13 19:40 --------- ​
[/FONT]
d-----wc:\program files\Common Files\InstallShield

[FONT=Courier New (Arabic)]2009-02-13 19:21 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\DriverCure

[FONT=Courier New (Arabic)]2009-02-13 19:19 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Downloaded Installations

[FONT=Courier New (Arabic)]2009-02-13 12:21 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Smart PC Solutions

[FONT=Courier New (Arabic)]2009-02-13 08:44 --------- ​
[/FONT]
d-----wc:\program files\Common Files\ACD Systems

[FONT=Courier New (Arabic)]2009-02-12 06:20 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Hide IP NG

[FONT=Courier New (Arabic)]2009-02-11 10:55 147,456 ----​
[/FONT]
a-wc:\windows\AVUNTOOL.EXE

[FONT=Courier New (Arabic)]2009-02-10 02:39 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters

[FONT=Courier New (Arabic)]2009-02-10 02:09 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Paltalk

[FONT=Courier New (Arabic)]2009-02-08 22:24 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\GlarySoft

[FONT=Courier New (Arabic)]2009-02-08 02:56 325,128 ----​
[/FONT]
a-wc:\windows\system32\drivers\avgldx86.sys

[FONT=Courier New (Arabic)]2009-02-08 02:56 12,552 ----​
[/FONT]
a-wc:\windows\system32\drivers\avgrkx86.sys

[FONT=Courier New (Arabic)]2009-02-08 02:56 107,272 ----​
[/FONT]
a-wc:\windows\system32\drivers\avgtdix.sys

[FONT=Courier New (Arabic)]2009-02-08 02:54 29,208 ----​
[/FONT]
a-wc:\windows\system32\drivers\avgfwdx.sys

[FONT=Courier New (Arabic)]2009-02-08 02:54 --------- ​
[/FONT]
d-----wc:\program files\AVG

[FONT=Courier New (Arabic)]2009-02-08 02:54 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\avg8

[FONT=Courier New (Arabic)]2009-02-07 23:45 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Ashampoo

[FONT=Courier New (Arabic)]2009-02-07 07:01 --------- ​
[/FONT]
d-----wc:\program files\Common Files\xing shared

[FONT=Courier New (Arabic)]2009-02-07 07:01 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Real

[FONT=Courier New (Arabic)]2009-02-07 03:45 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Babylon

[FONT=Courier New (Arabic)]2009-02-07 00:17 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Lunascape

[FONT=Courier New (Arabic)]2009-02-04 14:34 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Thinstall

[FONT=Courier New (Arabic)]2009-02-03 22:49 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Wise Installation Wizard

[FONT=Courier New (Arabic)]2009-02-03 20:14 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\WIPE

[FONT=Courier New (Arabic)]2009-02-03 20:11 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\FaceOnBody

[FONT=Courier New (Arabic)]2009-02-02 19:36 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\VitySoft

[FONT=Courier New (Arabic)]2009-01-30 14:53 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Quicksys

[FONT=Courier New (Arabic)]2009-01-29 14:14 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Systweak

[FONT=Courier New (Arabic)]2009-01-29 14:14 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Systweak

[FONT=Courier New (Arabic)]2009-01-29 14:10 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\PE Explorer

[FONT=Courier New (Arabic)]2009-01-28 13:51 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Norton

[FONT=Courier New (Arabic)]2009-01-27 22:50 --------- ​
[/FONT]
d-----wc:\program files\NCH Swift Sound

[FONT=Courier New (Arabic)]2009-01-27 22:50 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\NCH Swift Sound

[FONT=Courier New (Arabic)]2009-01-26 19:19 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\DriverScanner

[FONT=Courier New (Arabic)]2009-01-26 08:26 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Rising

[FONT=Courier New (Arabic)]2009-01-22 18:16 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\FRISK Software

[FONT=Courier New (Arabic)]2009-01-22 08:10 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Cisco Systems

[FONT=Courier New (Arabic)]2009-01-21 17:11 --------- ​
[/FONT]
d-----wc:\program files\Wipe

[FONT=Courier New (Arabic)]2009-01-21 07:28 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Symantec

[FONT=Courier New (Arabic)]2009-01-21 07:25 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\NortonInstaller

[FONT=Courier New (Arabic)]2009-01-20 13:50 --------- ​
[/FONT]
d-----wc:\program files\Bonjour

[FONT=Courier New (Arabic)]2009-01-20 13:28 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Macrovision Shared

[FONT=Courier New (Arabic)]2009-01-18 08:47 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Babylon

[FONT=Courier New (Arabic)]2009-01-17 16:53 --------- ​
[/FONT]
d-----wc:\program files\Microsoft Silverlight

[FONT=Courier New (Arabic)]2009-01-17 06:05 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Windows Live

[FONT=Courier New (Arabic)]2009-01-17 05:42 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\ConeXware

[FONT=Courier New (Arabic)]2009-01-16 23:24 --------- ​
[/FONT]
d--h--wc:\documents and settings\All Users\Application Data\{B1BDF027-079E-4994-B197-C7DE61E11398[FONT=Courier New (Arabic)]}[/FONT]

[FONT=Courier New (Arabic)]2009-01-16 22:25 --------- [/FONT]d-----wc:\program files\MSECache
[FONT=Courier New (Arabic)]2009-01-16 19:29 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\OfficeUpdate12

[FONT=Courier New (Arabic)]2009-01-16 19:25 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Office Genuine Advantage

[FONT=Courier New (Arabic)]2009-01-13 13:28 --------- ​
[/FONT]
dc-h--wc:\documents and settings\All Users\Application Data\{D5ABFFAD-D592-4F98-B02B-587125B4801F[FONT=Courier New (Arabic)]}[/FONT]

[FONT=Courier New (Arabic)]2009-01-12 11:41 --------- [/FONT]d-----wc:\program files\iVocalize Web Conference 4
[FONT=Courier New (Arabic)]2009-01-08 15:45 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Nitro PDF

[FONT=Courier New (Arabic)]2009-01-06 14:34 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\TechSmith

[FONT=Courier New (Arabic)]2009-01-01 23:52 --------- ​
[/FONT]
dc-h--wc:\documents and settings\All Users\Application Data\{2840BBCB-9BEC-47F6-BA0F-10D3C34BF151[FONT=Courier New (Arabic)]}[/FONT]

[FONT=Courier New (Arabic)]2009-01-01 23:14 --------- [/FONT]d-----wc:\program files\Windows Live SkyDrive
[FONT=Courier New (Arabic)]2008-12-29 18:28 --------- ​
[/FONT]
d-----wc:\program files\Microsoft Visual Studio 9.0

[FONT=Courier New (Arabic)]2008-12-29 18:28 --------- ​
[/FONT]
d-----wc:\program files\Microsoft Synchronization Services

[FONT=Courier New (Arabic)]2008-12-29 18:28 --------- ​
[/FONT]
d-----wc:\program files\Microsoft SQL Server Compact Edition

[FONT=Courier New (Arabic)]2008-12-29 18:27 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Microsoft Help

[FONT=Courier New (Arabic)]2008-12-29 18:17 --------- ​
[/FONT]
d-----wc:\program files\Microsoft SDKs

[FONT=Courier New (Arabic)]2008-12-29 18:14 --------- ​
[/FONT]
d-----wc:\program files\MSBuild

[FONT=Courier New (Arabic)]2008-12-29 18:13 --------- ​
[/FONT]
d-----wc:\program files\Reference Assemblies

[FONT=Courier New (Arabic)]2008-12-28 23:04 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\GrabPro

[FONT=Courier New (Arabic)]2008-12-26 19:57 --------- ​
[/FONT]
d-----wc:\program files\Windows Media Connect 2

[FONT=Courier New (Arabic)]2008-12-25 13:07 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Innovative Solutions

[FONT=Courier New (Arabic)]2008-12-25 09:26 --------- ​
[/FONT]
d-----wc:\program files\Remoteus2008

[FONT=Courier New (Arabic)]2008-12-25 09:26 --------- ​
[/FONT]
d-----wc:\program files\Common Files\Multilizer 2007

[FONT=Courier New (Arabic)]2008-12-22 09:09 --------- ​
[/FONT]
d-----wc:\documents and settings\saad\Application Data\Grisoft

[FONT=Courier New (Arabic)]2008-12-22 09:08 --------- ​
[/FONT]
d-----wc:\documents and settings\All Users\Application Data\Grisoft

[FONT=Courier New (Arabic)]2008-12-04 16:54 524,288 ----​
[/FONT]
a-wc:\windows\opuc.dll

[FONT=Courier New (Arabic)].[/FONT]

[FONT=Courier New (Arabic)]((((((((((((((((((((((((((((((((((((( [/FONT]Reg Loading Points[FONT=Courier New (Arabic)] ))))))))))))))))))))))))))))))))))))))))))))))))))[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]*[/FONT]Note* empty entries & legit default entries are not shown
REGEDIT4

[FONT=Courier New (Arabic)][[/FONT]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [04/15/2008 12:29 AM 15360[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]ccleaner"="d:\program files\CCleaner\CCleaner.exe" [10/23/2008 09:34 PM 1336560[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [04/14/2008 01:13 AM 208952[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [04/14/2008 01:13 AM 59392[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [04/14/2008 01:13 AM 455168[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [04/14/2008 01:13 AM 455168[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [02/08/2009 05:55 AM 1601304[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [02/07/2009 10:01 AM 185872[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]SoundMan"="SOUNDMAN.EXE" [04/16/2007 03:28 PM 577536 c:\windows\soundman.exe[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [04/15/2008 12:29 AM 15360[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]nltide_2"="shell32" [X[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]NoRecentDocsNetHood"= 1 (0x1[FONT=Courier New (Arabic)])[/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]02/08/2009 05:56 [/FONT]AM 10520 c:\windows\system32\avgrsstx.dll
[FONT=Courier New (Arabic)]
[​
[/FONT]
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager[FONT=Courier New (Arabic)]][/FONT]

BootExecuteREG_MULTI_SZ autocheck autochk *\0sasnative32

[FONT=Courier New (Arabic)][[/FONT]HKLM\~\startupfolder\C:^Documents and Settings^All Users[FONT=Courier New (Arabic)]^قائمة ابدأ^البرامج^بدء التشغيل^[/FONT]HP Digital Imaging Monitor.lnk[FONT=Courier New (Arabic)]][/FONT]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[FONT=Courier New (Arabic)][[/FONT]HKLM\~\startupfolder\C:^Documents and Settings^All Users[FONT=Courier New (Arabic)]^قائمة ابدأ^البرامج^بدء التشغيل^[/FONT]PalTalk.lnk[FONT=Courier New (Arabic)]][/FONT]
backup=c:\windows\pss\PalTalk.lnkCommon Startup

[FONT=Courier New (Arabic)][[/FONT]HKLM\~\startupfolder\C:^Documents and Settings^saad[FONT=Courier New (Arabic)]^قائمة ابدأ^البرامج^بدء التشغيل^[/FONT]Adobe Gamma.lnk[FONT=Courier New (Arabic)]][/FONT]
path=c:\documents and settings\saad[FONT=Courier New (Arabic)]\قائمة ابدأ\البرامج\بدء التشغيل\[/FONT]Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[FONT=Courier New (Arabic)][[/FONT]HKLM\~\startupfolder\C:^Documents and Settings^saad[FONT=Courier New (Arabic)]^قائمة ابدأ^البرامج^بدء التشغيل^[/FONT]is-R9IEC.lnk[FONT=Courier New (Arabic)]][/FONT]
backup=c:\windows\pss\is-R9IEC.lnkStartup

[FONT=Courier New (Arabic)][[/FONT]HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast[FONT=Courier New (Arabic)]!][/FONT]
[FONT=Courier New (Arabic)]--[/FONT]a------ 02/06/2009 12:08 AM 81000 c:\program files\Alwil Software\Avast4\ashDisp.exe
[FONT=Courier New (Arabic)]
[​
[/FONT]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)]--[/FONT]a------ 08/22/2007 04:31 PM 80896 d:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
[FONT=Courier New (Arabic)]
[​
[/FONT]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)]--[/FONT]a------ 02/07/2009 10:01 AM 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe
[FONT=Courier New (Arabic)]
[​
[/FONT]
HKEY_LOCAL_MACHINE\software\microsoft\security center[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)]"[/FONT]AntiVirusDisableNotify"=dword:00000001
[FONT=Courier New (Arabic)]
[​
[/FONT]
HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)]"[/FONT]EnableFirewall"= 0 (0x0[FONT=Courier New (Arabic)])[/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\Bonjour\\mDNSResponder.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\Windows Live\\Messenger\\livecall.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\LeapFTP 3.0\\LeapFTP.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\Messenger\\msmsgs.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"%[/FONT]windir%\\Network Diagnostic\\xpnetdiag.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"%[/FONT]windir%\\system32\\sessmgr.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\AVG\\AVG8\\avgam.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\AVG\\AVG8\\avgupd.exe[FONT=Courier New (Arabic)]"=[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]c:\\Program Files\\AVG\\AVG8\\avgnsx.exe[FONT=Courier New (Arabic)]"=[/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List[FONT=Courier New (Arabic)]][/FONT]
[FONT=Courier New (Arabic)]"30078:[/FONT]TCP"= 30078:TCP:*:Disabled:SolidNetworkManager
[FONT=Courier New (Arabic)]"30078:​
[/FONT]
UDP"= 30078:UDP:*:Disabled:SolidNetworkManager

[FONT=Courier New (Arabic)]"52789:​
[/FONT]
TCP"= 52789:TCP:*:Disabled:SolidNetworkManager

[FONT=Courier New (Arabic)]"52789:​
[/FONT]
UDP"= 52789:UDP:*:Disabled:SolidNetworkManager


R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-08 12552[FONT=Courier New (Arabic)]][/FONT]
R0 ulsata2;ulsata2;c:\windows\system32\drivers\ulsata2.sys [2008-05-07 124928[FONT=Courier New (Arabic)]][/FONT]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-20 114768[FONT=Courier New (Arabic)]][/FONT]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-08 325128[FONT=Courier New (Arabic)]][/FONT]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-08 107272[FONT=Courier New (Arabic)]][/FONT]
R1 is-R9IECdrv;is-R9IECdrv;c:\windows\system32\drivers\40962673.sys [2008-12-07 148496[FONT=Courier New (Arabic)]][/FONT]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-20 20560[FONT=Courier New (Arabic)]][/FONT]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-08 298264[FONT=Courier New (Arabic)]][/FONT]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-02-08 1339600[FONT=Courier New (Arabic)]][/FONT]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2008-11-25 603904[FONT=Courier New (Arabic)]][/FONT]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-02-08 29208[FONT=Courier New (Arabic)]][/FONT]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-02-08 29208[FONT=Courier New (Arabic)]][/FONT]
S3 BCASPROT;Advanced System Protector;\??\c:\program files\Systweak\Advanced System Protector\sasprot32.sys --> c:\program files\Systweak\Advanced System Protector\sasprot32.sys[FONT=Courier New (Arabic)] [?][/FONT]
S3 uti4ndaz;AVZ Kernel Driver;c:\windows\system32\drivers\uti4ndaz.sys [2008-12-13 7168[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost[FONT=Courier New (Arabic)]][/FONT]
HPZ12REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmtREG_MULTI_SZ hpqcxs08 hpqddsvc

[FONT=Courier New (Arabic)][[/FONT]HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea71a65f-ede7-11dd-85bd-000e2eef543f[FONT=Courier New (Arabic)]}][/FONT]
[FONT=Courier New (Arabic)]\[/FONT]Shell\AutoRun\command - eb.bat
[FONT=Courier New (Arabic)]\​
[/FONT]
Shell\explore\Command - eb.bat

[FONT=Courier New (Arabic)]\​
[/FONT]
Shell\open\Command - eb.bat

[FONT=Courier New (Arabic)].[/FONT]
*******s of the 'Scheduled Tasks' folder

[FONT=Courier New (Arabic)]2009-02-20 [/FONT]c:\windows\Tasks\1-Click Maintenance.job
[FONT=Courier New (Arabic)]- ​
[/FONT]
c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [11/20/2008 04:28 PM[FONT=Courier New (Arabic)]][/FONT]


[FONT=Courier New (Arabic)]2009-02-20 [/FONT]c:\windows\Tasks\OGADaily.job
[FONT=Courier New (Arabic)]- ​
[/FONT]
c:\windows\system32\OGAVerify.exe [12/31/2008 05:04 PM[FONT=Courier New (Arabic)]][/FONT]


[FONT=Courier New (Arabic)]2009-02-20 [/FONT]c:\windows\Tasks\OGALogon.job
[FONT=Courier New (Arabic)]- ​
[/FONT]
c:\windows\system32\OGAVerify.exe [12/31/2008 05:04 PM[FONT=Courier New (Arabic)]][/FONT]

[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]- - - - [/FONT]ORPHANS REMOVED[FONT=Courier New (Arabic)] - - - -[/FONT]

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file[FONT=Courier New (Arabic)])[/FONT]
HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file[FONT=Courier New (Arabic)])[/FONT]


[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]------- [/FONT]Supplementary Scan[FONT=Courier New (Arabic)] -------[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = plimus.com;www.plimus.com;regnow.com;www.regnow.com;<local>;*.local
uInternet Settings,ProxyServer = socks[FONT=Courier New (Arabic)]=[/FONT]
FF - ProfilePath - c:\documents and settings\saad\Application Data\Mozilla\Firefox\Profiles\67rdpgs2.default[FONT=Courier New (Arabic)]\[/FONT]
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.20926.0.dll
FF - plugin: d:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: d:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: d:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll
[FONT=Courier New (Arabic)].[/FONT]

[FONT=Courier New (Arabic)]**************************************************************************[/FONT]

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-02-21 02:41:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes[FONT=Courier New (Arabic)] ... [/FONT]

scanning hidden autostart entries[FONT=Courier New (Arabic)] ... [/FONT]

scanning hidden files[FONT=Courier New (Arabic)] ... [/FONT]

scan completed successfully
hidden files: 0

[FONT=Courier New (Arabic)]**************************************************************************[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]--------------------- [/FONT]LOCKED REGISTRY KEYS[FONT=Courier New (Arabic)] ---------------------[/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC[FONT=Courier New (Arabic)]}][/FONT]
[FONT=Courier New (Arabic)]@[/FONT]Denied: (Full) (Everyone[FONT=Courier New (Arabic)])[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]scansk"=hex(0):0f,34,64,76,7a,a3,f8,50,d5,81,49,b7,0a,7d,8d,f8,2e,9b,15,e0,eb[FONT=Courier New (Arabic)],[/FONT]
[FONT=Courier New (Arabic)]83,[/FONT]eb,82,d9,f9,9d,ad,84,d1,8b,b0,37,27,bc,34,19,b6,e6,51,00,00,00,00,00,00[FONT=Courier New (Arabic)],\[/FONT]

[FONT=Courier New (Arabic)][[/FONT]HKEY_LOCAL_MACHINE\software\Classes\CLSID\{8f4b73e8-cfcf-49f0-92f1-265d18d567a6[FONT=Courier New (Arabic)]}][/FONT]
[FONT=Courier New (Arabic)]@[/FONT]Denied: (Full) (Everyone[FONT=Courier New (Arabic)])[/FONT]
[FONT=Courier New (Arabic)]"[/FONT]Model"=dword:00000024
[FONT=Courier New (Arabic)]"​
[/FONT]
Therad"=dword:0000000f

[FONT=Courier New (Arabic)]"​
[/FONT]
MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,dd,d1,b1,6a,1d[FONT=Courier New (Arabic)],[/FONT]

cd,d7,6a,05,98,32,02,34,2b,da,61,dc,6d,06,f2,88,45,45,e0,87,82,8e,8d,1e,06[FONT=Courier New (Arabic)],\[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]------------------------ [/FONT]Other Running Processes[FONT=Courier New (Arabic)] ------------------------[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\windows\system32\atievxx.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
[FONT=Courier New (Arabic)].[/FONT]
[FONT=Courier New (Arabic)]**************************************************************************[/FONT]
[FONT=Courier New (Arabic)].[/FONT]
Completion time: 02/21/2009 2:46:23 - machine was rebooted [saad[FONT=Courier New (Arabic)]][/FONT]
********-quarantined-files.txt 2009-02-20 23:46:17

Pre-Run: 10,748,932,096 bytes free
Post-Run: 10,735,394,816 bytes free

[FONT=Courier New (Arabic)]270 --- [/FONT]E O F ---[FONT=Courier New (Arabic)] 2009-02-20 01:30:20[/FONT]

​
أنقر للتوسيع...

​
​
 

ترتيب حسب التاريخ ترتيب حسب الأصوات
انا ابي اعرف المشكله فيروس
او
هاردوير

؟؟
 
تأييد 0
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



شوف النقاش اللي دار هنا بالرابط اكيد مشكلتك ماتخرج عنها
 
تأييد 0
التقارير سليمة اخي
تاكد من المراوح انها تعمل بشكل صحيح
 
تأييد 0
windows installer قال:
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



شوف النقاش اللي دار هنا بالرابط اكيد مشكلتك ماتخرج عنها
أنقر للتوسيع...

MAAX قال:
التقارير سليمة اخي
تاكد من المراوح انها تعمل بشكل صحيح
أنقر للتوسيع...


يعطيكم العافيه ياغوالي

لاهنتوا جميعاً

على العموم جاري بيع الجهاز >>> يتطلق عليه من مده

الله يعين اللي بياخذه :d:
 
تأييد 0
يجب تسجيل الدخول أو التسجيل كي تتمكن من الرد هنا.
عودة
أعلى