مشكله بخصوص الفرومااااااااااااااااات

[غرووورانثى]

السلام عليكم ورحمه الله وبركاته

حبيت استفسرعن مشكله الفرومات انا لامن فرمت الجهاز ارجع وانصب التعاريف

ويخبرني بأنها موجوده من قبل مع العلم اني مفرمته وتغيرت الويندوز فكيف يخبرني

ان التعاريف موجوده ؟

يعني كني اضفت ويندوز والبرامج مازالت موجوده :a لحد يقولي يمكن حطيتي تثبيت على الويندوز يعني

صارت عندي ويندوز ثنتين لا انحذفت الاولى :blbyeh:
​

 

[غرووورانثى]

تقفل قرص الاي عندي

 

[زيزوووم]

طيب ياغالي ,, استخدم النسخه ذي للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم​

 

[غرووورانثى]

Logfile of HijackThis v1.99.1
Scan saved at 8:06:07 AM, on 2/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\zyz_mcafee\VirusScan Enterprise\run.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\XPPRESP3\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7Pro\IE7Pro.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00 (file missing)

 

[غرووورانثى]

اخوي انا دايم من جيت ابحث في برامج الحماية للجهاز تطلع لي الفايرس بنفس المكان
هذا
والصوره هذي

 

[SUL6AN]

التقرير مافيه الاهذي المشكله

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file


وانصحك بمسح نقاط استعادة النظام
وذالك من خلال ايقاف استعادة النظام
وبعدها افحصي جهازك

والنسخه اللي انتي منزلتها على الجهاز
هل هي النسخه اللي جايه مع نفس الجهاز؟!؟

وبعدين لمن تشغلي الجهاز هل تجيك خيارات للوندوز ؟!
او يشتغل مباشره

 

[غرووورانثى]

لا ماتجي اي خيارات نهائي

وبعدين لما اروح لمسح ملفات النظام اضغط عليها واغيرها وترجع نفس قبل وهذي المشكله اللي مبهدلتني

 

[غرووورانثى]

الويندوز اللي انا مركبتها الذكيه ومو هي اللي جايه مع نفس الجهاز

 

[زيزوووم]

بالاضافه لكلاام اخوي الغالي / سلطان

اعملي تقرير كاسبر سكاي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[زيزوووم]

بالاضافه لكلاام الاحبه ,,

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes

انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم​

 

[غرووورانثى]

عملته لكن ماطفى الجهاز

ComboFix 08-02-22.3 - XPPRESP3 2008-02-22 19:17:25.1 - FAT32x86
Running from: C:\Documents and Settings\XPPRESP3\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\bifrost\klog.dat

.
((((((((((((((((((((((((( Files Created from 2008-01-22 to 2008-02-22 )))))))))))))))))))))))))))))))
.

2008-02-22 19:08 . 2008-02-22 19:08 <DIR> d-------- C:\Documents and Settings\XPPRESP3\Application Data\XnView
2008-02-22 17:57 . 2008-02-22 17:57 268 --ah----- C:\sqmdata01.sqm
2008-02-22 17:57 . 2008-02-22 17:57 244 --ah----- C:\sqmnoopt01.sqm
2008-02-22 17:51 . 2008-02-22 17:51 268 --ah----- C:\sqmdata00.sqm
2008-02-22 17:51 . 2008-02-22 17:51 244 --ah----- C:\sqmnoopt00.sqm
2008-02-22 17:48 . 2008-02-22 17:48 <DIR> d-------- C:\Documents and Settings\XPPRESP3\Contacts
2008-02-22 08:35 . 2008-02-22 08:35 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-22 08:19 . 2008-02-22 08:19 <DIR> d-------- C:\WINDOWS\Sun
2008-02-22 07:54 . 2008-02-22 07:54 <DIR> d-------- C:\log
2008-02-22 07:47 . 2008-02-22 07:47 <DIR> d-------- C:\Documents and Settings\XPPRESP3\Application Data\Zyzoom_Autorun_Viruses_cleaner
2008-02-22 07:30 . 2006-06-06 10:10 126,976 --a------ C:\WINDOWS\system32\igfxres.dll
2008-02-22 07:29 . 2008-02-22 07:29 <DIR> d--hs---- C:\FOUND.001
2008-02-22 07:24 . 2008-02-22 07:24 <DIR> d-------- C:\QUARANTINE
2008-02-22 07:24 . 2008-02-22 07:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2008-02-22 07:16 . 2005-10-31 15:30 987,136 --a------ C:\WINDOWS\system32\BttnCmn.dll
2008-02-22 07:16 . 2004-08-03 22:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-02-22 07:14 . 2005-12-12 15:00 1,120,352 --a------ C:\WINDOWS\system32\drivers\AGRSM.sys
2008-02-22 07:14 . 2005-12-12 15:00 88,203 --a------ C:\WINDOWS\AGRSMMSG.exe
2008-02-22 07:14 . 2005-12-12 15:00 68,096 --------- C:\WINDOWS\system32\agrsmdel.exe
2008-02-22 07:14 . 2005-12-12 15:00 68,096 --a------ C:\WINDOWS\agrsmdel.exe
2008-02-22 07:14 . 2006-01-13 16:10 9,728 --------- C:\WINDOWS\HPModemVersion.dll
2008-02-22 07:13 . 2004-08-03 22:59 5,504 --a------ C:\WINDOWS\system32\drivers\intelide.sys
2008-02-22 07:08 . 2006-06-14 11:17 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-02-22 07:08 . 2001-08-17 14:00 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2008-02-22 07:08 . 2004-08-03 23:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2008-02-22 07:08 . 2006-06-14 10:50 6,272 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-02-22 07:05 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-22 07:03 . 2008-02-22 07:03 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-02-22 07:02 . 2008-02-22 07:02 <DIR> d-------- C:\Documents and Settings\XPPRESP3\Application Data\Talkback
2008-02-22 05:52 . 2008-02-22 05:52 <DIR> d-------- C:\Program Files\Bifrost
2008-02-21 21:53 . 2008-02-21 21:53 <DIR> d-------- C:\WINDOWS\Bifrost
2008-02-21 01:09 . 2008-02-21 01:09 <DIR> d-------- C:\zyz_mcafee
2008-02-20 17:59 . 2008-02-20 17:59 <DIR> d--hs---- C:\FOUND.000
2008-02-19 20:50 . 2008-02-19 20:50 <DIR> d-------- C:\WINDOWS\PCHEALTH
2008-02-19 20:48 . 2008-02-19 20:48 <DIR> d--hs---- C:\Recycled
2008-02-19 20:46 . 2008-02-19 20:46 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-19 01:07 . 2008-02-19 01:07 <DIR> d-------- C:\Documents and Settings\Palestine\Application Data\skypePM
2008-02-19 01:00 . 2008-02-19 01:00 <DIR> d-------- C:\Documents and Settings\Palestine\Application Data\Skype
2008-02-19 00:54 . 2008-02-19 00:54 <DIR> d-------- C:\Program Files\No-IP
2008-02-19 00:37 . 2008-02-19 00:37 <DIR> d-------- C:\Program Files\MP3Resizer
2008-02-19 00:33 . 2008-02-19 00:33 <DIR> d-------- C:\Program Files\Skype
2008-02-19 00:33 . 2008-02-19 00:33 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-02-19 00:02 . 2008-02-19 00:02 <DIR> d-------- C:\Program Files\Real
2008-02-19 00:02 . 2008-02-19 00:02 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-19 00:02 . 2008-02-19 00:02 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-18 23:37 . 2008-02-18 23:37 <DIR> d-------- C:\Documents and Settings\Palestine\Contacts
2008-02-18 23:31 . 2008-02-18 23:31 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-02-18 23:30 . 2008-02-18 23:30 <DIR> d-------- C:\Program Files\TechSmith
2008-02-18 23:30 . 2008-02-18 23:30 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-18 23:27 . 2008-02-18 23:27 <DIR> d-------- C:\Program Files\Windows Live
2008-02-18 23:23 . 2008-02-18 23:23 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-18 23:23 . 2008-02-18 23:23 <DIR> d-------- C:\Program Files\Ahead
2008-02-18 23:22 . 2008-02-18 23:22 <DIR> d-------- C:\Program Files\Yahoo!
2008-02-18 23:22 . 2008-02-18 23:22 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-02-18 23:22 . 2008-02-18 23:22 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-02-18 23:22 . 2008-02-18 23:22 <DIR> d-------- C:\Program Files\CCleaner
2008-02-18 23:22 . 2008-02-18 23:22 <DIR> d-------- C:\Documents and Settings\Palestine\Application Data\IDM
2008-02-18 23:22 . 2008-02-18 23:22 <DIR> d-------- C:\Documents and Settings\Palestine\Application Data\DMCache
2008-02-18 23:12 . 2008-02-18 23:12 <DIR> d-------- C:\Program Files\Texas Instruments Inc
2008-02-18 23:04 . 2008-02-18 23:04 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE
2008-02-18 23:00 . 2008-02-18 23:00 <DIR> d-------- C:\Program Files\HPQ
2008-02-18 23:00 . 2005-09-19 13:24 9,344 --a------ C:\WINDOWS\system32\drivers\CPQBttn.sys
2008-02-18 23:00 . 2005-09-19 13:23 7,808 --a------ C:\WINDOWS\system32\drivers\eabfiltr.sys
2008-02-18 23:00 . 2005-09-19 13:24 5,760 --a------ C:\WINDOWS\system32\drivers\EabUsb.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-22 04:53 --------- d-----w C:\Program Files\PopCap Games
2008-02-22 04:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-02-22 04:52 218,624 ----a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-02-22 04:51 --------- d-----w C:\Program Files\Winamp
2008-02-22 04:51 --------- d-----w C:\Program Files\Win32Pad
2008-02-22 04:51 --------- d-----w C:\Program Files\Wesmosis
2008-02-22 04:51 --------- d-----w C:\Program Files\MSN Messenger
2008-02-22 04:51 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Gena01
2008-02-22 04:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-02-22 04:50 --------- d-----w C:\Program Files\VistaCodecPack
2008-02-22 04:50 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Media Player Classic
2008-02-22 04:48 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-22 04:48 --------- d-----w C:\Program Files\ScreenMaker
2008-02-22 04:48 --------- d-----w C:\Program Files\Rainlendar2
2008-02-22 04:48 --------- d-----w C:\Program Files\Orbitdownloader
2008-02-22 04:48 --------- d-----w C:\Program Files\Java
2008-02-22 04:48 --------- d-----w C:\Program Files\Common Files\Java
2008-02-22 04:48 --------- d-----w C:\Documents and Settings\XPPRESP3\Application Data\Orbit
2008-02-22 04:48 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-02-22 04:45 --------- d-----w C:\Program Files\Mythicsoft
2008-02-22 04:45 --------- d-----w C:\Program Files\Foxit Software
2008-02-22 04:45 --------- d-----w C:\Program Files\FolderSize
2008-02-22 04:45 --------- d-----w C:\Program Files\FlashGet
2008-02-22 04:45 --------- d-----w C:\Program Files\Driver Genius Pro 2007
2008-02-22 04:45 --------- d-----w C:\Program Files\DAEMON Tools
2008-02-22 04:45 --------- d-----w C:\Program Files\Copy Handler
2008-02-22 04:42 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-22 04:41 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-22 04:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-22 04:37 --------- d-----w C:\Program Files\Softland
2008-02-22 04:37 --------- d-----w C:\Program Files\DAMN NFO Viewer
2008-02-22 04:37 --------- d-----w C:\Program Files\CPU-Z
2008-02-22 04:33 --------- d-----w C:\Program Files\RocketDock
2008-02-22 04:33 --------- d-----w C:\Program Files\LClock
2008-02-22 04:32 --------- d-----w C:\Program Files\Utilities
2008-02-22 04:32 --------- d-----w C:\Program Files\SysInternals
2008-02-22 04:32 --------- d-----w C:\Program Files\Graphics
2008-02-22 04:32 --------- d-----w C:\Program Files\Desktop
2008-02-18 20:57 --------- d-----w C:\Program Files\Synaptics
2008-02-18 20:55 --------- d-----w C:\Program Files\Intel
2008-02-18 20:52 --------- d-----w C:\Program Files\Analog Devices
2008-02-18 20:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-18 20:51 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-18 20:50 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-18 20:50 --------- d-----w C:\Program Files\Broadcom
2008-02-18 20:39 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-18 20:35 --------- d-----w C:\Program Files\Windows Media Connect 2
2006-07-10 13:46 27,179 ----a-w C:\WINDOWS\Media\vistasounds.reg
.

------- Sigcheck -------

"C:\WINDOWS\system32\drivers\tcpip.sys"
----a-w 360,704 2007-08-08 14:28:24 C:\WINDOWS\system32\drivers\tcpip.sys

"C:\WINDOWS\system32\ntoskrnl.exe"
----a-w 2,321,792 2007-08-29 12:33:26 C:\WINDOWS\system32\ntoskrnl.exe

"C:\WINDOWS\explorer.exe"
----a-w 950,784 2007-08-08 14:40:42 C:\WINDOWS\explorer.exe
----a-w 950,784 2007-08-08 14:40:42 C:\WINDOWS\XPize\Backup\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-19 00:05 630784]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24 167368]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 09:12 1298432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [2006-10-05 20:56 280779]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-19 12:27 65536]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-22 06:46 949376]
"Resume copy"="copyfstq.exe" [2002-03-24 13:54 46080 C:\WINDOWS\COPYFSTQ.EXE]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-06 14:06 716800]
"AGRSMMSG"="AGRSMMSG.exe" [2005-12-12 15:00 88203 C:\WINDOWS\AGRSMMSG.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 16:01 761946]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 15:39 131072]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-06-06 10:09 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-06-06 10:06 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-06-06 10:10 118784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-19 00:05 630784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2007-08-08 16:24 124928 C:\WINDOWS\system32\advpack.dll]
"ShowDeskFix"="regsvr32 /s /n /i:u l32" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"= %windir%\\Network Diagnostic\\xpnetdiag.exexpsp3res.dll,-20000
"%windir%\\system32\\sessmgr.exe"= %windir%\\system32\\sessmgr.exexpsp2res.dll,-22019
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WudfServiceGroup REG_SZ hex(7):57,00,55,00,44,00,46,00,53,00,76,00,63,00,00,00,00,00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ad6b5d1-34db-11dc-ad72-806d6172696f}]
\l\AutoRun\command - D:\setup.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-02-22 19:18:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfPf]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,57,00,75,00,64,00,66,00,50,00,66,00,2e,00,73,00,79,00,73,00,00,00"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfRd]
"ImagePath"="hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,75,00,64,00,66,00,72,00,64,00,2e,00,73,00,79,00,73,00,00,00"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WudfSvc]
"ImagePath"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,64,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,00,00,00"
"ServiceDll"="hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,55,00,44,00,46,00,53,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00"
.
Completion time: 2008-02-22 19:19:32
ComboFix-quarantined-files.txt 2008-02-22 17:19:30

 

[زيزوووم]

الجهاز مطعوج :hh:
وقبل اي شئ اعملي نسخه لبرامجك الخاصه بعدها​

حملي هذه الاداة ,,
واتبعي الشرح التالي ,, لتنظيف جهازك من الفيروسات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,​

رابط الاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,​

ولحفظ التقرير اعمل التالي ,,​

بعدهاا ارفع التقرير على هذا الموقع ,, وارفق الرابط بردك القادم

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[غرووورانثى]

:hh::hh::hh::hh:

خوووذ هذا اللي طلع معي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[غرووورانثى]

?.,,mknmhmkj

 

[زيزوووم]

ماصاد شئ عليه الكلاام :hh:

معليش بتعبك معي افحصي جهازك هناا

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ولاتنسين التقرير ,,

برب ,,

<<<<<<<<<<<<< نوم​

 

[al_laizer]

ممكن سؤال :: هل التعاريف موجوده والا لا
كرت الصوت معرف ويوجد صوت في الجهاز كرت الشاشه معرف .. كرت الشبكه معرف

ارجو الافاده لان مشكلتك الظاهر بسيطه