مشكله فى الانترنت اكسبلور

[ترواده]

عندى مشكله فى الانترنت اكسبلور كل ما ادخل موقع تاتى لى هذه الرسال
dont send <send eror
وقمت بتنصيب اوبرا لكن كل لم ادخل اليو تيوب لا يظهر لى بوتن التحميل حق الريال بلاير مثل ما كان يحدث فى النترنت اكسبلور وكل اما اسجل الدخول فى موقع مثل زيزووم تظهر لى رساله تفيد ان الاسم او كلمه المرور بهم خطا واما ادخل بالاكسلبلور يدخل دون مشاكل ما الحل

 

[Demo-dashDemo-dash is verified member.]

اعمل تقرير للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات .. ويظهر لك تقرير اعمل تحديد الكل ==> انسخه والصقه بردك القادم​

​

 

[PrinceOfPersia]

السلام عليكم

بانتظار تقريرك على برنامج hijack كما تفضل مراقبنا الغالي

وأنصحك باستخام Firefox كبديل ناجح عن الا Internet Explorer

وامسح الملفات المؤقتة في %temp% و temp

 

[ترواده]

وهذا تقرير الهاى جاك

اشكركم على الاهتمام ياخوانى وهذا تقرير الهاى جاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:00:43 PM, on 4/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\explorer.exe
C:\PROGRAM FILES\EASY FILE & FOLDER PROTECTOR\EFPAP.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\cFosSpeed\spd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
G:\برامج عمرو مهمه جدا\برامج النت الجديده\Anty\Zyzoom_HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\dwwin.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GEST] m‘|\ü
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [GoldenFilterPro] C:\Golden Filter Pro\GFPro.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [Camfrog] "C:\Program Files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" 0 C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: إضافة إلى مضاد الشعارات - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{1274BD4B-1161-4E25-8DEC-07615B953901}: NameServer = 213.131.65.20,213.131.66.246
O17 - HKLM\System\CS1\Services\Tcpip\..\{1274BD4B-1161-4E25-8DEC-07615B953901}: NameServer = 213.131.65.20,213.131.66.246
O17 - HKLM\System\CS2\Services\Tcpip\..\{1274BD4B-1161-4E25-8DEC-07615B953901}: NameServer = 213.131.65.20,213.131.66.246
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Easy File & Folder Protector (ACDService) - Unknown owner - C:\PROGRAM FILES\EASY FILE & FOLDER PROTECTOR\EFPAP.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
--
End of file - 5184 bytes

 

[MAAX]

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة

 

[ترواده]

جارى التحميل اخى ماكس لكن ليه الدون لود مانجر لا يعمل مع متصفح اوبرا عندما احمل اى ملف يظهر لى مربع التحميل الخاص باوبرا ولا يظهر الداون لود منجر

 

[ترواده]

انا حملت الاداه وغلقت الكاسبر لكن الداه لا تعمل عندما اضغط عليها تقوم بفك الضغط ولا تعمل

 

[ترواده]

انت نسيتونى ولا

 

[MAAX]

كيف تفك الضغط !!

 

[ترواده]

اقصد الاداه عندما اضغط عليها تقوم بالعمل ولكن لا تكمل المهمه وتختفى

 

[Corporation]

أستخدمها بالوضع الآمن ..

وعطل الكاسبر عن العممل بكليك يمين من جوار الساعة وأعمل له خروج ..​

 

[ترواده]

مشكور اخى هذا هو التقرير

ComboFix 09-04-03.01 - Administrator 2009-04-04 15:26:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.20.1033.18.1013.646 [GMT 2:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Data(1).dll
c:\windows\system32\Data(10).dll
c:\windows\system32\Data(2).dll
c:\windows\system32\Data(3).dll
c:\windows\system32\Data(4).dll
c:\windows\system32\Data(7).dll
c:\windows\system32\Data(L).dll
c:\windows\system32\win.dll
c:\windows\v10keysformatic.dll
.
((((((((((((((((((((((((( Files Created from 2009-03-04 to 2009-04-04 )))))))))))))))))))))))))))))))
.
2009-04-03 20:01 . 2009-04-03 20:02 <DIR> d-------- c:\program files\Yahoo!
2009-04-03 19:05 . 2009-04-03 19:05 <DIR> d-------- c:\program files\ICQ6Toolbar
2009-04-03 19:05 . 2009-04-03 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\ICQ
2009-04-03 19:04 . 2009-04-03 19:16 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ICQ
2009-04-03 18:58 . 2009-04-03 19:16 <DIR> d-------- c:\program files\ICQ6.5
2009-04-03 18:53 . 2009-04-03 18:53 13,824 --a------ c:\windows\system32\drivers\splitcam.sys
2009-04-03 18:52 . 2009-04-03 18:57 <DIR> d-------- c:\program files\SplitCam
2009-04-03 18:52 . 2003-05-14 21:07 389,120 --a------ c:\windows\system32\actskn43.ocx
2009-04-03 18:01 . 2009-04-03 19:56 43 --a------ c:\windows\system32\OEMInfo.ini
2009-04-03 17:59 . 2009-04-03 17:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Prevx
2009-04-03 17:57 . 2007-11-16 14:51 <DIR> d-------- c:\program files\VIPhd
2009-04-03 17:39 . 2009-04-03 17:39 <DIR> d-------- c:\temp\DwnlData
2009-04-03 16:40 . 2004-08-03 23:10 19,328 --a------ c:\windows\system32\drivers\WSTCODEC.SYS
2009-04-03 16:40 . 2004-08-03 23:10 19,328 --a--c--- c:\windows\system32\dllcache\wstcodec.sys
2009-04-03 16:40 . 2004-08-04 00:56 16,384 --a------ c:\windows\system32\ipsink.ax
2009-04-03 16:40 . 2004-08-04 00:56 16,384 --a--c--- c:\windows\system32\dllcache\ipsink.ax
2009-04-03 16:40 . 2004-08-03 23:10 15,360 --a------ c:\windows\system32\drivers\StreamIP.sys
2009-04-03 16:40 . 2004-08-03 23:10 15,360 --a--c--- c:\windows\system32\dllcache\streamip.sys
2009-04-03 16:40 . 2004-08-03 23:10 11,136 --a------ c:\windows\system32\drivers\SLIP.sys
2009-04-03 16:40 . 2004-08-03 23:10 11,136 --a--c--- c:\windows\system32\dllcache\slip.sys
2009-04-03 16:40 . 2004-08-03 23:10 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys
2009-04-03 16:40 . 2004-08-03 23:10 10,880 --a--c--- c:\windows\system32\dllcache\ndisip.sys
2009-04-03 16:40 . 2004-08-03 22:58 5,504 --a------ c:\windows\system32\drivers\MSTEE.sys
2009-04-03 16:40 . 2004-08-03 22:58 5,504 --a--c--- c:\windows\system32\dllcache\mstee.sys
2009-04-03 16:39 . 2009-04-03 16:46 <DIR> d-------- c:\program files\ShiningMorning
2009-04-02 19:55 . 2009-04-02 19:55 <DIR> d-------- c:\program files\BuddyCheck
2009-04-02 18:11 . 2009-04-02 18:11 <DIR> d-------- c:\program files\Common Files\xing shared
2009-04-02 18:10 . 2009-04-02 18:10 499,712 --a------ c:\windows\system32\msvcp71.dll
2009-04-02 13:04 . 2009-04-02 13:04 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Talkback
2009-04-02 13:04 . 2009-04-02 13:04 0 --a------ c:\windows\nsreg.dat
2009-04-02 12:35 . 2004-08-04 00:56 116,224 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll
2009-04-02 12:35 . 2001-08-17 22:37 99,865 --a--c--- c:\windows\system32\dllcache\xlog.exe
2009-04-02 12:35 . 2001-08-17 22:37 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe
2009-04-02 12:35 . 2001-08-17 22:36 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll
2009-04-02 12:35 . 2004-08-03 22:29 19,455 --a--c--- c:\windows\system32\dllcache\wvchntxx.sys
2009-04-02 12:35 . 2001-08-17 22:36 17,408 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll
2009-04-02 12:35 . 2001-08-17 12:11 16,970 --a--c--- c:\windows\system32\dllcache\xem336n5.sys
2009-04-02 12:35 . 2004-08-03 22:29 12,063 --a--c--- c:\windows\system32\dllcache\wsiintxx.sys
2009-04-02 12:35 . 2004-08-04 00:56 8,192 --a--c--- c:\windows\system32\dllcache\wshirda.dll
2009-04-02 12:35 . 2001-08-17 22:37 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe
2009-04-02 12:33 . 2001-08-17 22:36 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll
2009-04-02 12:32 . 2004-08-03 22:41 404,990 --a--c--- c:\windows\system32\dllcache\slntamr.sys
2009-04-02 12:31 . 2001-08-17 13:28 899,146 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys
2009-04-02 12:30 . 2004-08-04 00:56 4,274,816 --a--c--- c:\windows\system32\dllcache\nv4_disp.dll
2009-04-02 12:29 . 2004-08-04 00:56 1,737,856 --a--c--- c:\windows\system32\dllcache\mtxparhd.dll
2009-04-02 12:28 . 2001-08-17 13:28 802,683 --a--c--- c:\windows\system32\dllcache\ltsm.sys
2009-04-02 12:27 . 2001-08-17 22:36 242,176 --a--c--- c:\windows\system32\dllcache\kdsusd.dll
2009-04-02 12:26 . 2004-08-04 00:56 702,845 --a--c--- c:\windows\system32\dllcache\i81xdnt5.dll
2009-04-02 12:25 . 2001-08-17 14:56 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll
2009-04-02 12:24 . 2001-08-17 12:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys
2009-04-02 12:23 . 2001-08-17 12:13 980,034 --a--c--- c:\windows\system32\dllcache\cicap.sys
2009-04-02 12:22 . 2001-08-17 13:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys
2009-04-02 12:21 . 2004-08-04 00:56 1,888,992 --a--c--- c:\windows\system32\dllcache\ati3duag.dll
2009-04-02 12:20 . 2004-08-03 23:18 2,148,352 --a--c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-02 12:09 . 2009-04-03 15:04 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Nuotex
2009-03-31 18:40 . 2009-03-31 18:41 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Wildfire
2009-03-31 18:40 . 2009-03-31 18:40 4,096 --a------ c:\windows\d3dx.dat
2009-03-31 18:10 . 2009-03-31 19:05 17 --a------ c:\windows\popcinfo.dat
2009-03-31 14:34 . 2009-03-31 14:34 <DIR> d-------- c:\program files\WinASO
2009-03-30 15:51 . 2009-03-30 15:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-30 13:14 . 2009-03-30 13:14 <DIR> d-------- c:\program files\Messenger Plus! Live
2009-03-30 13:14 . 2009-03-30 13:14 <DIR> d-------- c:\program files\Cirle Developement
2009-03-30 13:13 . 2009-03-30 13:14 <DIR> d-------- c:\program files\MSN Messenger
2009-03-30 12:56 . 2009-03-30 13:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\SweetIM
2009-03-30 12:23 . 2009-03-30 13:03 <DIR> d-------- c:\program files\SweetIM
2009-03-30 12:12 . 2009-03-30 12:55 <DIR> d-------- c:\program files\STOIK
2009-03-28 14:36 . 2009-03-28 14:36 245,760 --------- c:\windows\Setup1.exe
2009-03-28 14:36 . 2009-03-28 14:36 73,216 --a------ c:\windows\ST6UNST.EXE
2009-03-28 12:33 . 2009-03-28 12:40 <DIR> d-------- c:\program files\ElcomSoft
2009-03-28 12:01 . 2009-03-28 12:38 <DIR> d-------- c:\program files\ESTsoft
2009-03-28 12:01 . 2009-03-28 12:38 <DIR> d-------- c:\documents and settings\Administrator\Application Data\ESTsoft
2009-03-28 00:51 . 2009-03-28 11:30 843 --a------ c:\windows\ks.ini
2009-03-27 23:44 . 2009-03-27 23:55 <DIR> d-------- c:\windows\system32\SystemFiles
2009-03-26 23:39 . 2009-03-26 23:39 <DIR> d-------- c:\program files\Windows Live
2009-03-26 23:39 . 2009-03-26 23:39 <DIR> d-------- c:\program files\Circle Dvelopement
2009-03-26 22:55 . 2009-03-26 22:55 <DIR> d---s---- c:\documents and settings\Administrator\UserData
2009-03-26 22:00 . 2009-03-26 22:00 <DIR> d-------- c:\documents and settings\Administrator\Contacts
2009-03-25 14:07 . 2009-03-25 14:07 <DIR> d-------- c:\windows\system32\LogFiles
2009-03-25 11:25 . 2009-03-25 11:25 <DIR> d-------- c:\documents and settings\Administrator\Application Data\WNR
2009-03-25 09:50 . 2009-04-03 17:33 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Camfrog
2009-03-25 07:07 . 2009-03-25 07:07 <DIR> d-------- c:\program files\Easy File & Folder Protector
2009-03-25 07:07 . 2005-03-04 15:07 44,928 --a------ c:\windows\system32\drivers\FDCBNT.SYS
2009-03-25 06:48 . 2009-03-25 06:48 <DIR> d-------- c:\program files\Common Files\SWiSHzone.com
2009-03-24 17:00 . 2009-03-24 17:00 2 --a------ c:\windows\v10keysformatic.ocx
2009-03-24 15:43 . 2009-03-24 15:46 <DIR> d-------- c:\program files\Common Files\Adobe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-04 13:33 13,452,576 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-04 13:32 --------- d-----w c:\documents and settings\Administrator\Application Data\DMCache
2009-04-04 13:31 --------- d-----w c:\program files\cFosSpeed
2009-04-04 13:30 38,120 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-04 13:30 344,608 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-04 13:30 201,908 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-04 12:53 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-03 21:16 --------- d-----w c:\documents and settings\Administrator\Application Data\Skype
2009-04-03 17:05 --------- d--h--w c:\program files\InstallShield Installation Information
2009-04-03 04:45 --------- d-----w c:\program files\Winamp
2009-04-02 18:21 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-02 16:11 --------- d-----w c:\program files\Common Files\Real
2009-04-02 16:10 348,160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-02 16:10 --------- d-----w c:\program files\Real
2009-03-30 10:54 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-26 21:09 --------- d-----w c:\documents and settings\Administrator\Application Data\dvdcss
2009-03-25 04:43 --------- d-----w c:\documents and settings\Administrator\Application Data\IDM
2009-03-24 12:21 89,601 ----a-w c:\windows\system32\drivers\klick.dat
2009-03-24 12:21 101,287 ----a-w c:\windows\system32\drivers\klin.dat
2009-03-24 11:54 --------- d-----w c:\program files\AIMP2
2009-03-24 11:52 --------- d-----w c:\documents and settings\Administrator\Application Data\AIMP
2009-03-24 11:47 --------- d-----w c:\program files\Camfrog
2009-03-24 11:44 --------- d-----w c:\program files\Skype
2009-03-24 11:44 --------- d-----w c:\program files\Common Files\Skype
2009-03-24 11:44 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-03-24 11:25 --------- d-----w c:\program files\Kaspersky Lab
2009-03-24 11:17 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-03-24 11:05 --------- d-----w c:\program files\Internet Download Manager
2009-03-24 10:49 --------- d-----w c:\program files\VS Revo Group
2009-03-24 10:48 --------- d-----w c:\documents and settings\Administrator\Application Data\vlc
2009-03-24 10:47 --------- d-----w c:\program files\VideoLAN
2009-03-24 10:37 16,608 ----a-w c:\windows\gdrv.sys
2009-03-24 10:37 --------- d-----w c:\program files\Realtek
2009-03-24 10:37 --------- d-----w c:\documents and settings\Administrator\Application Data\InstallShield
2009-03-24 10:35 315,392 ----a-w c:\windows\HideWin.exe
2009-03-24 10:32 --------- d-----w c:\program files\Intel
2009-03-24 10:27 --------- d-----w c:\program files\microsoft frontpage
2009-02-08 16:19 324,096 ----a-w c:\windows\system32\drivers\mcdevice.sys
2009-01-28 11:17 290,008 ----a-w c:\windows\system32\cfosspeed.dll
2008-02-02 10:07 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-02-02 10:07 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-02-02 10:07 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-02-02 10:07 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-02-02 10:07 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-03-24 2745776]
"Camfrog"="c:\program files\Camfrog\Camfrog Video Chat\CamfrogNet.exe" [2003-09-29 36352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m‘|\ü" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-05 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-05 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-05 137752]
"cFosSpeed"="c:\program files\cFosSpeed\cFosSpeed.exe" [2009-01-28 876760]
"GoldenFilterPro"="c:\golden filter pro\GFPro.exe" [2008-04-21 1671168]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-02 198160]
"Vistadrv"="c:\program files\VIPhd\vsdrv.exe" [2006-07-30 121089]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-27 199184]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-03-24 113664]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ACDService]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FDCBNT.SYS]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 FDCBNT;FDCBNT;c:\windows\system32\drivers\FDCBNT.SYS [2009-03-25 44928]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2009-04-03 222456]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-12-13 24592]
S3 mcdevice;mcdevice;c:\windows\system32\drivers\mcdevice.sys [2009-04-03 324096]
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-msnmsgr - ~c:\program files\MSN Messenger\msnmsgr.exe
HKCU-Run-ICQ - ~c:\program files\ICQ6.5\ICQ.exe
HKCU-Run-Messenger (Yahoo!) - ~c:\program files\Yahoo!\Messenger\YahooMessenger.exe
MSConfigStartUp-msnmsgr - ~c:\program files\MSN Messenger\msnmsgr.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.eg/
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {1274BD4B-1161-4E25-8DEC-07615B953901} = 213.131.65.20,213.131.66.246
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\1bonvna6.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.eg/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: c:\documents and settings\Administrator\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-04-04 15:32:25
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1440)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\windows\system32\klogon.dll
- - - - - - - > 'lsass.exe'(1496)
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll
c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\fssync.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Easy File & Folder Protector\EFPAP.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\cFosSpeed\spd.exe
c:\program files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-04-04 15:36:12 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2009-04-04 13:36:07
Pre-Run: 3,970,695,168 bytes free
Post-Run: 4,014,608,384 bytes free
252

 

[ترواده]

هذا التقرير الذى طلبته منى