تقرير هايجاك ، ارجو تحليله

[الحزين511]

هذا التقرير ..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:22:35 م, on 28/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\STacSV.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\User\Desktop\1\HiJackThis.exe
C:\Documents and Settings\User\User.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O1 - Hosts:
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\sw g.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [User] C:\Documents and Settings\User\User.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\STacSV.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\WINDOWS\system32\DRIVERS\xaudio.exe
--
End of file - 7951 bytes​

 

[Demo-dashDemo-dash is verified member.]

اهلااا بك اخي

وعذرا بنقله للقسم المناسب للمتابعة مع تعديل العنوان
هذا القسم خاص بتحليل تقارير برامج الحماية ،، وباقي التقارير تكون عند الطلب فقط​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​

 

[MAAX]

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة

 

[الحزين511]

تفضل اخوي هذي نتيجة التقرير ..

ComboFix 09-03-27.02 - User 03/28/2009 17:31:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.2038.1557 [GMT 3:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\User\User.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\digeste.dll
c:\windows\system32\kakle.dll
c:\windows\system32\prsgrc.dll
c:\windows\system32\ssprs.dll
c:\windows\wiaserviv.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_PCIDump

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-28 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-28 14:31 --------- d-----w c:\documents and settings\User\Application Data\DMCache
2009-03-28 12:40 --------- d-----w c:\program files\Trojan Remover
2009-03-28 12:25 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-28 11:11 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-28 11:11 --------- d-----w c:\program files\Nokia
2009-03-28 11:11 --------- d-----w c:\program files\Common Files\Nokia
2009-03-28 03:15 --------- d-----w c:\program files\Video Convert Master
2009-03-27 12:55 --------- d-----w c:\program files\Google
2009-03-24 12:00 --------- d-----w c:\program files\GoldWave
2009-03-23 06:35 --------- d-----w c:\program files\K-Lite Codec Pack
2009-03-23 05:44 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-23 05:37 --------- d-----w c:\program files\Common Files\Adobe
2009-03-23 05:31 --------- d-----w c:\documents and settings\User\Application Data\Media Player Classic
2009-03-22 00:56 --------- d-----w c:\documents and settings\All Users\Application Data\VertusTech
2009-03-21 12:15 --------- d-----w c:\program files\Common Files\Vbox
2009-03-21 11:48 81,920 ----a-w c:\documents and settings\User\Application Data\ezpinst.exe
2009-03-21 11:48 47,360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-03-21 11:48 47,360 ----a-w c:\documents and settings\User\Application Data\pcouffin.sys
2009-03-21 11:48 --------- d-----w c:\documents and settings\User\Application Data\Vso
2009-03-21 10:35 --------- d-----w c:\program files\SWiSH Max2
2009-03-21 10:34 --------- d-----w c:\program files\Common Files\SWiSHzone.com
2009-03-21 08:05 --------- d-----w c:\program files\Messenger Plus! Live
2009-03-21 07:04 --------- d-----w c:\program files\Internet Download Manager
2009-03-21 06:33 --------- d-----w c:\documents and settings\User\Application Data\IDM
2009-03-21 06:23 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-21 06:21 --------- d-----w c:\program files\Windows Live
2009-03-21 06:19 --------- d-----w c:\program files\Hotspot Shield
2009-03-21 06:17 --------- d-----w c:\program files\Power Mp3 Cutter(Mp3 Sound Cutter)
2009-03-21 06:16 --------- d-----w c:\program files\Unlocker
2009-03-21 06:14 --------- d-----w c:\documents and settings\User\Application Data\Desktopicon
2009-03-21 06:05 --------- d-----w c:\program files\Fortop Digital
2009-03-21 06:01 --------- d-----w c:\program files\CCleaner
2009-03-21 05:54 --------- d-----w c:\program files\Real_SC
2009-03-21 05:46 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-03-21 05:46 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-03-21 05:46 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-03-21 03:53 --------- d-----w c:\program files\Java
2009-03-21 03:17 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-03-20 17:58 --------- d-----w c:\documents and settings\User\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-03-20 17:49 --------- d-----w c:\documents and settings\User\Application Data\Nero
2009-03-20 17:48 --------- d-----w c:\documents and settings\User\Application Data\AVGTOOLBAR
2009-02-17 15:11 --------- d-----w c:\program files\Microsoft.NET
2009-02-17 15:11 --------- d-----w c:\program files\Common Files\L&H
2009-02-17 15:10 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-17 15:09 --------- d-----w c:\program files\Microsoft Works
2009-02-17 15:08 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-02-17 15:06 --------- d-----w c:\program files\Yahoo!
2009-02-17 15:04 --------- d-----w c:\program files\Common Files\Java
2009-02-17 15:03 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2009-02-17 15:02 --------- d-----w c:\program files\Nero
2009-02-17 15:02 --------- d-----w c:\program files\Common Files\Nero
2009-02-17 15:00 --------- d-----w c:\program files\AVG
2009-02-17 14:58 --------- d-----w c:\documents and settings\User\Application Data\vlc
2009-02-17 14:57 --------- d-----w c:\program files\VideoLAN
2009-02-17 14:57 --------- d-----w c:\program files\Real
2009-02-17 14:57 --------- d-----w c:\program files\Common Files\xing shared
2009-02-17 14:57 --------- d-----w c:\program files\Common Files\Real
2009-02-17 14:56 --------- d-----w c:\documents and settings\User\Application Data\DivX
2009-02-17 14:55 --------- d-----w c:\program files\DVD X Studios
2009-02-17 14:55 --------- d-----w c:\program files\DivX
2009-02-17 14:55 --------- d-----w c:\documents and settings\User\Application Data\Apple Computer
2009-02-17 14:55 --------- d-----w c:\documents and settings\All Users\Application Data\DVD X Studios
2009-02-17 14:55 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-02-17 14:54 --------- d-----w c:\program files\QuickTime
2009-02-17 14:53 --------- d-----w c:\program files\Apple Software Update
2009-02-17 14:53 --------- d-----w c:\program files\AIMP2
2009-02-17 14:53 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-02-17 14:44 --------- d-----w c:\program files\CONEXANT
2009-02-17 14:40 --------- d-----w c:\program files\Marvell
2009-02-17 14:40 --------- d-----w c:\documents and settings\User\Application Data\TMP
2009-02-17 14:38 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-02-17 14:38 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2009-02-17 14:37 --------- d-----w c:\program files\DellTPad
2009-02-17 14:36 --------- d-----w c:\program files\SigmaTel
2009-02-17 14:34 --------- d-----w c:\program files\Intel
2009-02-17 14:24 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 03:00 PM 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [08/16/2007 04:19 PM 5728112]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [12/17/2007 05:13 PM 3810544]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [08/04/2004 01:06 AM 1667584]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [03/21/2009 08:59 AM 2594224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [11/16/2007 01:33 AM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [11/16/2007 01:32 AM 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [11/16/2007 01:33 AM 137752]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [07/03/2007 12:29 AM 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [05/10/2007 09:22 PM 405504]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [03/28/2008 11:37 PM 413696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [02/17/2009 05:57 PM 185896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [03/21/2009 08:46 AM 1601304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [06/12/2008 02:38 AM 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [03/21/2009 06:53 AM 148888]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 12:56 AM 110592 c:\windows\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 03:00 PM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
03/21/2009 08:46 AM 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 12/17/2007 05:13 PM 3810544 c:\program files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\userinit.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-17 325128]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-17 107272]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-17 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-21 298264]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-02-18 37296]
S2 acpi32;acpi32;\??\c:\windows\system32\drivers\acpi32.sys --> c:\windows\system32\drivers\acpi32.sys [?]
S2 amd64si;amd64si;\??\c:\windows\system32\drivers\amd64si.sys --> c:\windows\system32\drivers\amd64si.sys [?]
S2 ati64si;ati64si;\??\c:\windows\system32\drivers\ati64si.sys --> c:\windows\system32\drivers\ati64si.sys [?]
S2 fips32cup;fips32cup;\??\c:\windows\system32\drivers\fips32cup.sys --> c:\windows\system32\drivers\fips32cup.sys [?]
S2 netsik;netsik;\??\c:\windows\system32\drivers\netsik.sys --> c:\windows\system32\drivers\netsik.sys [?]
S2 nicsk32;nicsk32;\??\c:\windows\system32\drivers\nicsk32.sys --> c:\windows\system32\drivers\nicsk32.sys [?]
S2 port135sik;port135sik;\??\c:\windows\system32\drivers\port135sik.sys --> c:\windows\system32\drivers\port135sik.sys [?]
S2 securentm;securentm; [x]
S2 systemntmi;systemntmi;\??\c:\windows\system32\drivers\systemntmi.sys --> c:\windows\system32\drivers\systemntmi.sys [?]
S2 ws2_32sik;ws2_32sik;\??\c:\windows\system32\drivers\ws2_32sik.sys --> c:\windows\system32\drivers\ws2_32sik.sys [?]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2009-02-17 110080]
.
Contents of the 'Scheduled Tasks' folder
2009-03-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [08/29/2007 02:57 PM]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-User - c:\documents and settings\User\User.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe

.
------- Supplementary Scan -------
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\Internet Download Manager\IEGetVL.htm
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-03-28 17:35:05
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\rundll32.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\hidfind.exe
c:\program files\DellTPad\ApntEx.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 03/28/2009 17:36:46 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-28 14:36:43
Pre-Run: 32,206,884,864 bytes free
Post-Run: 33,301,639,168 bytes free
217
​

 

[MAAX]

ارفع تقرير هايجاك جديد
وما هي المشكلة التي تواجهها ؟

 

[الحزين511]

ارفع تقرير هايجاك جديد

وما هي المشكلة التي تواجهها ؟​

هلا بك ..

اشلون ارفع تقرير !!​

يعني انزل موضوع جديد فيه التقرير الأخير ..​

بخصوص مشكلتي انا دخلت موقع معين وطلعت عادي
وعقبه برنامج الحماية كل شوي يطلعلي صور ان فيه فايروسات بالسستم يجب ازالتها
ومو قادر يشيلها للأسف ..​

وهذي الصور​

وبعد مااختار remove selected infections يطلع هالمسج ..​

شوف لي حل..​

الله يجزاك كل خيررررررررررررر ..​

 

[MAAX]

اخي ادخل بالوضع الامن للجهاز
وشغل برنامج الحماية واعمل فحص كامل للنظام

 

[الحزين511]

اخي ادخل بالوضع الامن للجهاز
وشغل برنامج الحماية واعمل فحص كامل للنظام

اشلون ..

ياليت توضح لي اكثر بخطوات بسيطة

الله يجزاك خير ..​

 

[MAAX]

طريقة تشغيل الجهاز في الوضع الأمن



عند تشغيل الجهاز تبدأ بالضغط على F8


بشكل متكرر حتى تظهر هذه الشاشة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[الحزين511]

سويت كل اللي قلته اخوي

حتى سويت فحص شامل للنظام..

بس اشلون اتأكد ان الفايروسات مو موجودة بالسستم ..؟؟​

 

[MAAX]

اخوي بعد التشغيل بالوضع العادي اعمل فحص جديد للتاكد

 

[الحزين511]

اخوي بعد التشغيل بالوضع العادي اعمل فحص جديد للتاكد

​

انتهيت من الفحص وطلعت النتيجة ولله الحمد no infections..​

​

بس طلع للأسف warnings .. مدري شنو المقصود فيها​

عالعموم الله يجزاك خير حبيبي
تعبتك معاي
ورحم الله والديك ...​