(تم حل المشكلة)مشكلة أمر cmd ..بسرعه..؟؟

[xxoxx22]

السلام عليكم


كيفكم ان شاء الله بخيرk:

المهم أرجو مساعدتي في هذي المشكلة لانو


لم أضغط تشغيل و أكتب أمر cmd يختفي شريط المهام و يرجع :no:

مادري شو المشكلة مع العلم أن ملف cmd.exe موجود في ملفات الوندوز

أرجو الرد السريع​

 

[MAAX]

الله يحييك اخوي
حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم​

 

[KoNaMi]

يعني يالغلا امر cmd شغال معاك ولا لا ؟؟
​

 

[KoNaMi]

الله يحييك اخوي
حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم​

ماشاء الله سرعه الخط عندك طلقه :hh:

معليش يابعدي مانتبهت لردك :q:
​

 

[xxoxx22]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:58:30 م, on 24/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\No-IP\DUC20.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\CamStudio\vscap.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\services.exe
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GroupManager] C:\Program Files\Microsoft Windows Security Update\groupmanager.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: hpstp - C:\WINDOWS\
O21 - SSODL: oledll - {59945B67-9234-9234-D929-7F84D923BC79} - C:\WINDOWS\system32\wh18tokl.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\services.exe (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 6798 bytes

بنتضار الرد

 

[MAAX]

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة​

 

[xxoxx22]

تفضل أخوي أن شاء الله خير:d:


ComboFix 09-04-25.03 - USER 04/25/2009 14:14.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.255.77 [GMT 4:00]
Running from: c:\documents and settings\USER\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\LocalService\Application Data\twain_32
c:\documents and settings\LocalService\Application Data\twain_32\user.ds
c:\documents and settings\NetworkService\Application Data\twain_32
c:\documents and settings\NetworkService\Application Data\twain_32\user.ds
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Installr\1.bin\F3EZSETP.DLL
c:\program files\Microsoft Common
c:\program files\Microsoft Common\svchost.exe
c:\system\S-1-5-21-1482476501-1644491937-682003330-1013
c:\system\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
C:\test.txt
c:\windows\ktd32.atm
c:\windows\system32\Bifrost
c:\windows\system32\Bifrost\logg.dat
c:\windows\system32\dlds8.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\k86.bin
c:\windows\system32\kakle.dll
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\twain_32
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
c:\windows\system32\vx.tll
c:\windows\system32\WanPacket.dll
c:\windows\system32\winitn.dll
c:\windows\system32\wpcap.dll
c:\windows\wiaserviv.log
c:\windows\win.exe
c:\windows\winhelp.ini
d:\recycler\office_crack.rar

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Legacy_POWERMANAGER
-------\Service_NPF
-------\Service_PowerManager


((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-4-25 )))))))))))))))))))))))))))))))
.

2009-04-24 18:54 . 2009-04-24 18:54 646 ----a-w c:\windows\system32\%LocalXml%
2009-04-24 17:55 . 2009-04-24 17:55 -------- d-----w c:\program files\Trend Micro
2009-04-23 18:46 . 2009-04-24 10:49 101287 ----a-w c:\windows\system32\drivers\klin.dat
2009-04-23 18:46 . 2009-04-24 10:49 89601 ----a-w c:\windows\system32\drivers\klick.dat
2009-04-23 18:28 . 2009-04-25 10:01 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-23 18:28 . 2009-04-23 18:28 -------- d-----w c:\program files\Kaspersky Lab
2009-04-23 18:28 . 2009-04-25 10:17 409632 --sha-w c:\windows\system32\drivers\fidbox2.dat
2009-04-23 18:28 . 2009-04-25 10:17 3528 --sha-w c:\windows\system32\drivers\fidbox2.idx
2009-04-23 18:28 . 2009-04-24 23:14 2290208 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-04-23 18:28 . 2009-04-24 23:14 20020 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-04-23 12:45 . 2008-10-16 10:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-04-23 12:45 . 2008-10-16 10:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-23 12:45 . 2008-10-16 10:06 208744 ----a-w c:\windows\system32\muweb.dll
2009-04-23 11:52 . 2009-04-23 11:52 -------- dc----w c:\documents and settings\All Users\Application Data\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1}
2009-04-23 04:47 . 2009-04-23 04:47 -------- d-----w c:\documents and settings\USER\Local Settings\Application Data\Stardock
2009-04-23 04:38 . 2009-04-23 12:47 -------- d-----w c:\program files\Paltalk Messenger
2009-04-22 19:10 . 2007-12-29 13:33 -------- d-----w C:\netcat
2009-04-21 13:44 . 2009-04-21 13:44 90153 ----a-w c:\documents and settings\USER\update.exe
2009-04-21 10:15 . 2005-01-27 17:13 607744 ----a-w c:\windows\system32\urlmon.backup
2009-04-21 10:15 . 2004-08-03 22:56 37888 ----a-w c:\windows\system32\url.backup
2009-04-21 10:15 . 2005-01-27 17:13 1483264 ----a-w c:\windows\system32\shdocvw.backup
2009-04-21 10:15 . 2004-08-03 22:56 549376 ----a-w c:\windows\system32\shdoclc.backup
2009-04-21 10:15 . 2005-01-27 17:13 1016832 ----a-w c:\windows\system32\browseui.backup
2009-04-21 10:15 . 2004-08-03 22:56 358400 ----a-w c:\windows\system32\inetcpl.backup
2009-04-21 10:14 . 2001-08-23 12:00 90112 ----a-w c:\windows\system32\mycomput.backup
2009-04-21 10:12 . 2008-07-18 18:10 53448 ----a-w c:\windows\system32\wuauclt.backup
2009-04-21 10:12 . 2004-08-03 22:56 183808 ----a-w c:\windows\system32\accwiz.backup
2009-04-21 10:12 . 2004-08-03 22:56 337920 ----a-w c:\windows\system32\zipfldr.backup
2009-04-21 10:12 . 2004-08-03 22:56 2897920 ----a-w c:\windows\system32\xpsp2res.backup
2009-04-21 10:12 . 2004-08-03 22:56 589312 ----a-w c:\windows\system32\wiashext.backup
2009-04-21 10:12 . 2004-08-03 22:56 276480 ----a-w c:\windows\system32\webcheck.backup
2009-04-21 10:12 . 2004-08-03 22:56 191488 ----a-w c:\windows\system32\syncui.backup
2009-04-21 10:12 . 2004-08-03 22:56 438272 ----a-w c:\windows\system32\shimgvw.backup
2009-04-21 10:12 . 2004-12-21 20:49 8450048 ----a-w c:\windows\system32\shell32.backup
2009-04-21 10:10 . 2005-01-27 17:13 3006976 ----a-w c:\windows\system32\mshtml.backup
2009-04-21 10:01 . 2004-08-03 22:56 218624 ----a-w c:\windows\system32\uxtheme.backup
2009-04-21 10:01 . 2004-08-03 22:56 514560 ----a-w c:\windows\system32\logonui.backup
2009-04-21 10:00 . 2009-04-21 10:15 -------- d-----w c:\windows\Icon_Patcher
2009-04-21 09:54 . 2009-04-21 09:54 -------- d-----w C:\Temp
2009-04-20 19:01 . 2008-01-29 21:41 25216 ----a-w c:\windows\system32\drivers\tap0901.sys
2009-04-19 14:45 . 2009-04-19 14:45 -------- d-----w c:\program files\WinPcap
2009-04-19 14:43 . 2009-04-19 14:51 -------- d-----w c:\program files\Cain
2009-04-18 19:58 . 2009-04-18 19:58 75951 ----a-w c:\windows\Test.jpg
2009-04-18 19:58 . 2009-04-18 19:58 2359350 ----a-w c:\windows\Test.bmp
2009-04-18 19:17 . 2009-04-20 10:30 20866 ----a-w c:\windows\OF.sys
2009-04-18 17:53 . 2009-04-23 12:35 -------- d-----w c:\windows\system32\Ads
2009-04-17 16:53 . 2009-04-17 16:53 -------- d-sh--r C:\BIN
2009-04-17 16:53 . 2009-04-17 16:53 33795 ----a-w c:\documents and settings\USER\cDFDF.EXE
2009-04-17 15:13 . 2009-04-17 15:13 -------- d-sh--r C:\Driver
2009-04-17 13:40 . 2009-04-20 17:33 -------- d-----w c:\program files\update
2009-04-16 13:55 . 2009-04-16 13:55 -------- d-----w c:\program files\Microsoft.NET
2009-04-16 03:46 . 2009-04-16 05:51 -------- d--h--w c:\windows\Bifrost
2009-04-16 03:46 . 2009-04-16 03:46 24693 ---h--w c:\documents and settings\USER\Application Data\addons.exe
2009-04-15 12:48 . 2009-04-15 12:50 -------- d--h--w c:\windows\system32\GroupPolicy
2009-04-11 20:25 . 2009-04-11 20:25 0 ----a-w c:\windows\system32\dmram.sys
2009-04-11 18:11 . 2009-04-23 07:31 2181888 ----a-w c:\windows\system32\kernel1.exe
2009-04-11 18:11 . 2009-04-11 19:07 2193280 ----a-w c:\windows\system32\KERNEL.TMP
2009-04-11 18:06 . 2008-02-17 03:39 211 --sha-w C:\BOOT.BKK
2009-04-11 15:01 . 2009-04-11 15:01 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-11 14:52 . 2009-04-11 14:52 -------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2009-04-11 14:45 . 2004-08-03 22:56 77312 ----a-w c:\windows\system32\msiexec.exe
2009-04-11 14:45 . 2004-08-03 22:56 77312 ----a-w c:\windows\system32\dllcache\msiexec.exe
2009-04-11 14:45 . 2004-08-03 22:56 44032 ----a-w c:\windows\system32\msisip.dll
2009-04-11 14:45 . 2004-08-03 22:56 44032 ----a-w c:\windows\system32\dllcache\msisip.dll
2009-04-11 14:45 . 2004-08-03 22:56 331264 ----a-w c:\windows\system32\msihnd.dll
2009-04-11 14:45 . 2004-08-03 22:56 331264 ----a-w c:\windows\system32\dllcache\msihnd.dll
2009-04-11 14:45 . 2004-08-03 22:56 2804224 ----a-w c:\windows\system32\msi.dll
2009-04-11 14:45 . 2004-08-03 22:56 2804224 ----a-w c:\windows\system32\dllcache\msi.dll
2009-04-11 14:45 . 2004-08-03 22:56 884736 ----a-w c:\windows\system32\msimsg.dll
2009-04-11 14:45 . 2004-08-03 22:56 884736 ----a-w c:\windows\system32\dllcache\msimsg.dll
2009-04-11 13:10 . 2009-04-21 08:28 45 ----a-w C:\TEST.XML
2009-04-11 13:06 . 2009-04-11 13:06 86016 ----a-w c:\windows\system32\wh18tokl.dll
2009-04-11 13:06 . 2009-04-11 13:06 1952 ----a-w c:\windows\system32\sys18h.dll
2009-04-11 11:51 . 2009-04-11 11:51 -------- d-----w c:\program files\TGTSoft
2009-04-09 11:59 . 2009-04-09 11:59 589 ----a-w c:\windows\pass.html
2009-04-09 11:58 . 2009-04-09 11:58 33 ----a-w c:\windows\mspass.bat
2009-04-09 05:39 . 2009-04-09 05:44 -------- d-----w c:\program files\ASProtect 1.35 Demo
2009-04-09 05:15 . 2009-04-09 05:24 -------- d-----w c:\documents and settings\USER\Application Data\Resource Tuner
2009-04-07 13:41 . 2008-10-25 16:23 480832 ----a-w c:\windows\system32\openport.exe
2009-04-07 11:13 . 2009-04-09 11:11 -------- d-----w c:\program files\Ivacy Monitor
2009-04-05 09:30 . 2009-04-05 09:30 -------- d-----w c:\program files\BreakPoint Software
2009-04-03 15:24 . 2009-04-07 13:55 44069 ----a-w c:\windows\3104.jpeg
2009-04-02 23:02 . 2009-04-19 19:51 54156 ---ha-w c:\windows\QTFont.qfn
2009-04-02 23:02 . 2009-04-02 23:02 1409 ----a-w c:\windows\QTFont.for
2009-04-02 17:24 . 2009-04-02 17:24 -------- d-----w c:\program files\Opera
2009-03-29 19:02 . 2009-04-24 14:30 -------- d-----w c:\program files\Common Files\Multilizer 2007
2009-03-29 19:00 . 2009-04-24 14:30 -------- d-----w c:\program files\Multilizer2007

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 10:18 . 2009-03-08 14:36 1632 ----a-w c:\windows\system32\d3d8caps.dat
2009-04-24 10:56 . 2008-01-29 13:29 33808 ----a-w c:\windows\system32\drivers\klbg.sys
2009-04-21 10:14 . 2004-08-03 22:56 863744 ----a-w c:\windows\system32\shdoclc.dll
2009-04-21 10:09 . 2008-02-17 03:45 83456 ----a-w c:\windows\system32\charmap.exe
2009-04-21 10:01 . 2004-08-03 22:56 218624 ----a-w c:\windows\system32\uxtheme.dll
2009-04-21 10:01 . 2004-08-03 22:56 1949184 ----a-w c:\windows\system32\logonui.exe
2009-04-16 05:41 . 2008-12-14 13:58 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-04-16 05:38 . 2009-03-19 18:24 -------- d-----w c:\program files\CamStudio
2009-04-16 05:34 . 2008-11-02 16:32 -------- d-----w c:\program files\Acoustica Shared Effects
2009-04-16 05:34 . 2008-11-02 16:32 -------- d-----w c:\program files\Acoustica Mixcraft
2009-04-16 04:47 . 2008-12-16 18:21 -------- d-----w c:\program files\Classic Menu for Office
2009-04-11 14:33 . 2009-01-16 09:04 -------- d-----w c:\program files\MSN Messenger
2009-04-07 13:48 . 2009-03-20 09:03 -------- d-----w c:\program files\No-IP
2009-04-05 08:13 . 2009-03-12 11:57 -------- d-----w c:\program files\Opera 9.5 beta
2009-04-05 02:39 . 2008-02-17 05:07 226248 ----a-w c:\documents and settings\USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-03 13:03 . 2008-10-13 17:18 1744 ----a-w c:\windows\system32\d3d9caps.dat
2009-03-26 22:33 . 2009-03-26 22:24 44191 ----a-w C:\testlog.txt
2009-03-23 17:59 . 2009-03-23 12:41 987501 ----a-w c:\documents and settings\USER\dasda.exe
2009-03-21 18:40 . 2009-03-21 18:40 -------- d-----w c:\documents and settings\USER\Application Data\AdobeUM
2009-03-18 23:14 . 2009-03-18 23:14 -------- d-----w c:\program files\Microsoft Windows Security Update
2009-03-18 23:14 . 2009-03-18 23:14 987501 ----a-w c:\documents and settings\USER\dada.exe
2009-03-16 20:04 . 2009-03-16 20:04 -------- d-----w c:\documents and settings\All Users\Application Data\Installations
2009-03-16 19:55 . 2009-03-16 19:55 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2009-03-16 19:54 . 2009-03-16 19:54 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-03-12 15:06 . 2008-02-17 05:37 -------- d-----w c:\program files\Golden Al-Wafi Translator
2009-03-12 08:35 . 2008-11-12 22:53 -------- d-----w c:\program files\LeapFTP
2009-03-11 07:04 . 2009-01-16 08:39 -------- d-----w c:\program files\RegCleaner
2009-03-02 18:40 . 2008-12-06 17:55 -------- d-----w c:\program files\Circle Developement
2009-03-01 12:30 . 2009-03-01 12:01 -------- d-----w c:\program files\Kelk 2000
2009-02-28 15:30 . 2008-11-06 05:07 -------- d-----w c:\program files\TurboFTP
2009-02-28 13:00 . 2008-11-06 05:09 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-02-06 14:52 . 2009-02-06 14:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-05 20:24 . 2008-02-17 05:35 1245184 ----a-w c:\windows\system32\bkll.dll
2009-02-05 20:24 . 2008-11-02 19:26 215552 ----a-w c:\windows\system32\ALOWMVFile.dll
2009-02-05 20:24 . 2008-11-02 19:25 403968 ----a-w c:\windows\system32\ALOWMAFile2.dll
2009-02-05 20:23 . 2008-11-02 19:25 188416 ----a-w c:\windows\system32\ALOVideoFile.dll
2009-02-05 20:23 . 2008-02-17 05:35 2846720 ----a-w c:\windows\system32\agsaamj.dll
2009-02-05 20:23 . 2008-11-02 19:24 495104 ----a-w c:\windows\system32\ALOVideoCoreM.dll
2009-02-05 20:23 . 2008-02-17 05:35 90112 ----a-w c:\windows\system32\agsaami.dll
2009-02-05 20:22 . 2008-11-02 19:24 626688 ----a-w c:\windows\system32\agsaamh.dll
2009-02-05 20:22 . 2008-02-17 05:35 753664 ----a-w c:\windows\system32\agsaamg.dll
2009-02-05 20:22 . 2008-11-02 19:23 780288 ----a-w c:\windows\system32\ALOVideoCompress.dll
2009-02-05 20:21 . 2008-11-02 19:24 551424 ----a-w c:\windows\system32\agsaame.dll
2009-02-05 20:21 . 2008-11-02 19:23 249856 ----a-w c:\windows\system32\ALOQuickTimeFile.dll
2009-02-05 20:21 . 2008-11-02 19:23 90112 ----a-w c:\windows\system32\ALOAudioFormatSettings3.dll
2009-02-05 20:21 . 2008-11-02 19:23 382464 ----a-w c:\windows\system32\ALOAVIFile.dll
2009-02-05 20:21 . 2008-11-02 19:23 877568 ----a-w c:\windows\system32\ALOAudioFile2.dll
2009-02-05 20:21 . 2008-11-02 19:23 2846720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
2009-02-05 20:21 . 2008-11-02 19:23 544256 ----a-w c:\windows\system32\agsaamd.dll
2009-02-05 20:21 . 2008-02-17 05:35 372736 ----a-w c:\windows\system32\agsaamc.dll
2009-02-05 20:20 . 2008-11-02 19:23 538624 ----a-w c:\windows\system32\agsaamb.dll
2009-02-05 20:20 . 2008-11-02 19:22 331776 ----a-w c:\windows\system32\agsaama.dll
2009-02-05 20:20 . 2008-11-02 19:22 778240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
2009-02-05 20:19 . 2008-11-02 19:22 81920 ----a-w c:\windows\system32\viscomwave.dll
2009-02-05 20:19 . 2008-11-02 19:22 98304 ----a-w c:\windows\system32\viscomtran.dll
2009-02-05 20:18 . 2008-11-02 19:22 48640 ----a-w c:\windows\system32\viscomsamplerate.dll
2009-02-05 20:18 . 2008-11-02 19:22 118784 ----a-w c:\windows\system32\viscomrmenc.dll
2009-02-05 20:18 . 2008-11-02 19:22 147456 ----a-w c:\windows\system32\viscomqtenc.dll
2009-02-05 20:18 . 2008-11-02 19:22 602112 ----a-w c:\windows\system32\viscomqtde.dll
2009-02-05 20:18 . 2008-11-02 19:22 1470464 ----a-w c:\windows\system32\viscomm4aenc.dll
2009-02-05 20:18 . 2008-11-02 19:22 86016 ----a-w c:\windows\system32\viscomframe.dll
2009-02-05 20:18 . 2008-11-02 19:22 1462272 ----a-w c:\windows\system32\viscomflvenc.dll
2009-02-05 20:18 . 2008-11-02 19:22 118784 ----a-w c:\windows\system32\viscomflvdec.dll
2009-02-05 20:18 . 2008-11-02 19:22 1470464 ----a-w c:\windows\system32\viscomdata3.dll
2009-02-05 20:17 . 2008-11-02 19:22 1454080 ----a-w c:\windows\system32\viscomdata2.dll
2009-02-05 20:16 . 2008-11-02 19:22 1462272 ----a-w c:\windows\system32\viscomdata1.dll
2009-02-05 20:15 . 2008-11-02 19:23 344064 ----a-w c:\windows\system32\dkll.dll
2009-02-05 20:15 . 2008-02-17 05:35 196608 ----a-w c:\windows\system32\maag.dll
2009-02-05 20:15 . 2008-11-02 19:22 18628608 ----a-w c:\windows\system32\viscomavi.dll
2009-02-05 20:15 . 2008-02-17 05:35 1212416 ----a-w c:\windows\system32\ckll.dll
2009-02-05 20:15 . 2008-11-02 19:22 110592 ----a-w c:\windows\system32\viscomaudioencoder.dll
2009-02-05 20:15 . 2008-11-02 19:22 94208 ----a-w c:\windows\system32\viscomaudiodata.dll
2009-02-05 20:15 . 2008-11-02 19:22 1454080 ----a-w c:\windows\system32\viscomamrenc.dll
2009-02-05 20:15 . 2008-11-02 19:22 1462272 ----a-w c:\windows\system32\viscom3gpenc.dll
2009-02-05 20:15 . 2008-11-02 19:22 6963712 ----a-w c:\windows\system32\videotrans.dll
2009-02-05 20:14 . 2008-11-02 19:22 452608 ----a-w c:\windows\system32\videoformat.dll
2009-02-05 20:14 . 2008-11-02 19:22 18599936 ----a-w c:\windows\system32\videoencode.dll
2009-02-05 20:14 . 2008-11-02 19:22 19456 ----a-w c:\windows\system32\videocore.dll
2009-02-05 20:14 . 2008-11-02 19:22 90112 ----a-w c:\windows\system32\ssvideo.dll
2009-02-05 20:14 . 2008-11-02 19:22 1128128 ----a-w c:\windows\system32\NMSDVDXU.dll
2009-02-05 20:14 . 2008-11-02 19:22 18595840 ----a-w c:\windows\system32\coredata.dll
2009-02-05 20:14 . 2008-02-17 05:35 1986560 ----a-w c:\windows\system32\akll.dll
2009-02-04 05:41 . 2008-10-11 12:46 1854 ----a-w c:\windows\mozver.dat
2009-01-30 22:31 . 2009-01-30 22:31 9729 ----a-w c:\windows\system32\shutdown.zip
2008-09-14 11:42 . 2008-10-14 11:42 59 ----a-w c:\documents and settings\USER\Local Settings\Application Data\SUMQU0C1-FE20-APII-YE7M-BEDSDWMY5R6A.dat
2008-09-14 11:41 . 2008-10-14 11:41 82 ----a-w c:\documents and settings\All Users\Application Data\SUMQU0C1-FE20-APII-YE7M-BEDSDWMY5R6A.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 1443072]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-11 185872]
"GroupManager"="c:\program files\Microsoft Windows Security Update\groupmanager.exe" [2009-03-18 32256]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-24 206088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\USER\Start Menu\Programs\Startup\
No-IP DUC.lnk - c:\program files\No-IP\DUC20.exe [2009-4-7 1172992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-2-17 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\program files\TGTSoft\StyleXP\Logon\CurrentLogon.EXE"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmram.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CaptureWiz.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\CaptureWiz.lnk
backup=c:\windows\pss\CaptureWiz.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\LeapFTP\\LeapFTP.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\msn-imatawen\\Msn Admin v3.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\ViRuSMaN\\Poison Ivy 2.3.0\\Sa3eka Open Ports.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\Asb May 2.2.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\BiFrOsT_BaD_BoY\\DZ-GENIUSES Copy 1.2d.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\Spy-Net [RAT] v1.7\\spynet.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\BiFrOsT_BaD_BoY\\Bifrosta.exe"=
"d:\\My Pictures\\مجلد خاص\\azooz\\king\\Slh Final\\NewClient.exe"=

R1 b10dc63a;b10dc63a;c:\windows\System32\drivers\b10dc63a.sys [2008-10-23 0]
R1 dmram;MDRAM Connector;c:\windows\system32\dmram.sys [2009-04-11 0]
R2 LoIbeokcfa;LoIbeokcfa;c:\windows\System32\svchost.exe [2004-08-03 14336]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\DRIVERS\A3AB.sys [2006-05-11 472096]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\DRIVERS\tap0901.sys [2008-01-29 25216]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-04-24 33808]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-03-13 33800]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-03-13 472320]
S2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe [2004-08-03 14336]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640]
S2 Vcs;Vcs support;c:\windows\system32\Drivers\Vcs.sys [2002-12-10 6852]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
LoIbeokcfa

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0658e355-12db-11de-9ee7-0008024312ad}]
\Shell\AutoRun\command - f:\restore\k-1-3542-4232123213-7676767-8888886\Ogard.exe
\Shell\open\command - f:\restore\k-1-3542-4232123213-7676767-8888886\Ogard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5f9be976-14fb-11de-9eed-0008024312ad}]
\Shell\AutoRun\command - f:\restore\k-1-3542-4232123213-7676767-8888886\Ogard.exe
\Shell\open\command - f:\restore\k-1-3542-4232123213-7676767-8888886\Ogard.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{78ec65c0-2c5e-11de-9f26-0008024312ad}]
\Shell\AutoRun\command - f:\driver\Files\Drago.exe
\Shell\open\command - f:\driver\Files\Drago.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{89c059cd-a4d1-11dd-9e38-0008024312ad}]
\Shell\AutoRun\command - SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\OgarD.exe
\Shell\open\command - SYSTEM\S-1-5-21-1482476501-1644491937-682003330-1013\OgarD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c68003e-1b8d-11de-9efe-0008024312ad}]
\Shell\AutoRun\command - f:\bin\RECYCLE\Bin.exe
\Shell\open\command - f:\bin\RECYCLE\Bin.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac4a3506-936a-11dd-be03-0008024312ad}]
\Shell\AutoRun\command - F:\zPharaoh.exe
\Shell\explore\command - F:\zPharaoh.exe
\Shell\open\command - F:\zPharaoh.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{feb83075-9522-11dd-9e16-0008024312ad}]
\Shell\AutoRun\command - f:\system\S-1-5-21-1482476501-1644491937-682003330-1013\OgarD.exe
\Shell\open\command - f:\system\S-1-5-21-1482476501-1644491937-682003330-1013\OgarD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{67KLN5J0-4OPM-00WE-AAX5-74CC2A322142}]
c:\driver\Files\Drago.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{67KLN5J0-4OPM-00WE-AAX5-74CC2A323342}]
c:\bin\RECYCLE\Bin.exe
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
Notify-hpstp - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ae/
mStart Page = hxxp://home.sweetim.com
IE: Add to Banner Ad Blocker - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
Trusted Zone: hotmail.com\www
Trusted Zone: lycos.co.uk\members
Trusted Zone: nizwa7.com\www
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-04-25 14:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\cscui.dll

- - - - - - - > 'explorer.exe'(5928)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
Completion time: 2009-04-25 14:29
ComboFix-quarantined-files.txt 2009-04-25 10:28

Pre-Run: 2,331,295,744 bytes free
Post-Run: 2,373,251,072 bytes free

366

 

[AbOdy]

يعطيكم العافية

عطني تقرير هايجاك جديد

 

[xxoxx22]

:king:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:01:37 م, on 25/04/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\No-IP\DUC20.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\No-IP\DUC20.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GroupManager] C:\Program Files\Microsoft Windows Security Update\groupmanager.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: No-IP DUC.lnk = C:\Program Files\No-IP\DUC20.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Eset HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 5725 bytes

 

[AbOdy]

حدد القيم واحذفها

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O15 - Trusted Zone:

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

طريقة الحذف ​

​

​

​

بعدها اذهب الى اضافة وازالة البرامج واحذف التولبار الموجود عندك (toolbar)>> ممكن ما يكون موجود​

ثم نزل هذه الاداة واتبع الشرح التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​

او

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط ​

شرح الاستخدام ,,,,,,
عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))

بعد عمل المطلوب شوف لنا اخبار مشكلتك

هل لازالت مستمره ؟؟​

​

 

[xxoxx22]

الحمدالله تم حذف القيم


و المشكلة أنحلت أشكرا لكم


الله يوفقكم ان شاء الله

 

[AbOdy]

الحمدلله على انتهاء المشكلة

بالتوفيق يارب