يا جماعة الخير النظام صار يتجمد عندي مرفق تقرير هايجك

[abu-hanafy]

مرحبا شباب النظام فجاة صار بطيئ ما بعرف السبب
Logfile of HijackThis v1.99.1
Scan saved at 02:18:36 م, on 28/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Documents and Settings\mahmoud\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file)
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O17 - HKLM\System\CCS\Services\Tcpip\..\{21C5CD6C-D7E4-43DB-81EF-AFE4EBFE85CA}: NameServer = 217.66.226.8
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.exe

 

[KoNaMi]

اعمل الاتي

عطل جميع برامج الحمايه >> تأكد من وقت وتاريخ الجهاز >> لاتغير اسم الاداة احفظها على سطح المكتب

نزل هذه الاداة

​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى الصق التقرير بمشاركتك القادمة​

 

[abu-hanafy]

مرحبا اخي انا عندي برنامج نود 32 ومش عارف اوقفو
ازا بتعرف دلني جزاك الله خيرا

 

[abu-hanafy]

وقفت الانتي فيروس وهاي التقرير
ComboFix 09-04-27.04 - mahmoud 04/28/2009 15:29.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1033.18.510.250 [GMT 2:00]
Running from: c:\documents and settings\mahmoud\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated)
FW: ESET Personal firewall *enabled*
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\mahmoud\Favorites\Translator.url

.
((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-4-28 )))))))))))))))))))))))))))))))
.

2009-04-27 22:26 . 2009-04-27 22:26 -------- d-----w c:\windows\system32\VIRepair
2009-04-27 22:15 . 2009-04-27 22:15 -------- d-----w c:\documents and settings\mahmoud\Application Data\GRETECH
2009-04-27 18:01 . 2009-04-27 21:28 -------- d-----w c:\documents and settings\mahmoud\Application Data\IObit
2009-04-26 18:07 . 2009-04-26 18:07 64184 ---ha-w c:\windows\system32\mlfcache.dat
2009-04-26 14:42 . 2009-04-26 14:42 -------- d-----w c:\program files\ViSplore
2009-04-26 14:42 . 2009-04-26 14:42 -------- d-----w c:\program files\TrueTransparency
2009-04-26 14:42 . 2009-04-26 14:42 -------- d-----w c:\program files\WinFlip
2009-04-26 14:42 . 2009-04-27 22:26 -------- d-----w c:\program files\Styler
2009-04-26 14:42 . 2009-04-26 14:42 -------- d-----w c:\program files\Vista Rainbar
2009-04-26 14:38 . 2009-04-27 22:27 -------- d-----w c:\windows\system32\VITrans
2009-04-26 14:37 . 2006-12-03 15:15 111104 ----a-w c:\windows\system32\Uharc.exe
2009-04-26 14:37 . 2006-12-03 15:15 19968 ----a-w c:\windows\system32\reico.exe
2009-04-26 14:37 . 2006-12-03 15:14 8636 ----a-w c:\windows\system32\modifype.exe
2009-04-26 14:37 . 2006-12-03 15:15 69632 ----a-w c:\windows\system32\moveex.exe
2009-04-26 14:37 . 2004-11-27 17:00 94208 ----a-w c:\windows\system32\pskill.exe
2009-04-26 14:37 . 2008-11-11 21:22 20480 ----a-w c:\windows\system32\scrnrdr.exe
2009-04-18 21:57 . 2009-04-23 17:50 -------- d-----w c:\documents and settings\mahmoud\Application Data\dvdcss
2009-04-18 21:49 . 2009-04-18 21:49 -------- d-----w c:\program files\Webteh
2009-04-16 10:13 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 10:13 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 10:13 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 10:13 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 10:13 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 10:13 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 10:13 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 10:13 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 10:13 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 21:50 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-15 21:50 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-10 22:27 . 2009-04-10 22:27 46719 ----a-w c:\windows\BricoPackUninst.cmd
2009-04-10 22:27 . 2009-04-10 22:27 -------- d-----w c:\documents and settings\mahmoud\Local Settings\Application Data\Stardock
2009-04-10 22:25 . 2009-04-10 22:27 2445 ----a-w c:\windows\BricoPackFoldersDelete.cmd
2009-04-10 22:24 . 2009-04-10 22:34 -------- d-----w c:\windows\BricoPacks
2009-04-10 18:05 . 2009-04-25 12:48 98304 ----a-w c:\windows\system32\CmdLineExt.dll
2009-04-10 17:44 . 2009-04-10 17:44 -------- d-----w c:\windows\Winning Eleven 9
2009-04-05 20:30 . 2009-04-05 20:30 -------- d-----w c:\documents and settings\All Users\Application Data\BitDefender
2009-04-05 20:30 . 2009-04-05 21:16 -------- d-----w c:\documents and settings\mozy
2009-04-01 23:26 . 2009-04-27 22:15 -------- d-----w c:\program files\GRETECH
2009-04-01 23:22 . 2009-04-01 23:22 -------- d-----w c:\documents and settings\All Users\Application Data\VistaCodecs
2009-04-01 22:38 . 2009-04-01 22:38 -------- d--h--w c:\windows\system32\GroupPolicy
2009-04-01 22:27 . 2009-04-01 22:27 -------- d-----w c:\program files\CCleaner
2009-04-01 22:22 . 2009-04-26 18:05 -------- d-----w c:\documents and settings\mahmoud\Application Data\Apple Computer
2009-04-01 22:22 . 2009-04-17 19:25 -------- d-----w c:\program files\Common Files\Real
2009-04-01 22:22 . 2009-04-01 22:47 -------- d-----w c:\documents and settings\mahmoud\Application Data\Media Player Classic
2009-04-01 21:39 . 2009-04-01 21:39 -------- d-----w c:\documents and settings\mahmoud\Application Data\BSplayer Pro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-27 22:12 . 2009-04-27 22:12 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-27 10:00 . 2009-03-08 06:05 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-26 17:32 . 2009-03-07 20:41 81672 ----a-w c:\documents and settings\mahmoud\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-24 21:40 . 2004-08-04 12:00 218624 ----a-w c:\windows\system32\uxtheme.dll
2009-04-17 19:25 . 2009-03-12 09:09 -------- d-----w c:\program files\Real
2009-04-17 13:00 . 2009-03-28 22:21 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-04-17 13:00 . 2009-03-28 22:13 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-04-16 10:01 . 2009-03-08 08:31 -------- d-----w c:\program files\Java
2009-04-10 17:59 . 2009-03-08 06:05 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-10 17:21 . 2009-03-14 02:44 -------- d-----w c:\program files\Internet Download Manager
2009-04-06 16:19 . 2009-03-08 15:16 -------- d-----w c:\program files\Windows Media Connect 2
2009-03-26 14:46 . 2009-03-26 14:46 -------- d-----w c:\program files\MSBuild
2009-03-26 14:11 . 2009-03-26 14:11 -------- d-----w c:\program files\Microsoft
2009-03-26 14:11 . 2009-03-26 14:08 -------- d-----w c:\program files\Windows Live
2009-03-22 22:07 . 2009-03-22 22:07 -------- d-----w c:\program files\Reference Assemblies
2009-03-22 17:22 . 2009-03-22 17:22 64 --sh--r c:\windows\system32\SESdemo.drv
2009-03-22 17:21 . 2009-03-22 17:21 -------- d-----w c:\program files\ArzooSoft Solutions
2009-03-22 16:54 . 2009-03-22 16:54 81920 ----a-w c:\documents and settings\mahmoud\Application Data\ezpinst.exe
2009-03-22 16:54 . 2009-03-22 16:54 47360 ----a-w c:\windows\system32\drivers\pcouffin.sys
2009-03-22 16:54 . 2009-03-22 16:54 47360 ----a-w c:\documents and settings\mahmoud\Application Data\pcouffin.sys
2009-03-17 01:21 . 2009-03-12 08:35 -------- d-----w c:\program files\VideoLAN
2009-03-16 18:50 . 2009-03-16 18:50 81984 ----a-w c:\windows\system32\bdod.bin
2009-03-14 19:10 . 2009-03-14 19:10 -------- d-----w c:\program files\Microsoft.NET
2009-03-14 18:37 . 2009-03-14 18:37 -------- d-----w c:\program files\ESET
2009-03-12 08:12 . 2009-03-08 06:53 -------- d-----w c:\program files\anoooos
2009-03-09 03:19 . 2009-03-08 14:09 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-08 15:23 . 2009-03-08 15:23 -------- d-----w c:\program files\Common Files\Windows Live
2009-03-08 14:21 . 2009-03-08 05:59 87263 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-03-08 08:31 . 2009-03-08 08:31 -------- d-----w c:\program files\Common Files\Java
2009-03-08 07:13 . 2009-03-08 07:13 0 ----a-w c:\windows\nsreg.dat
2009-03-08 06:47 . 2009-03-08 06:47 -------- d-----w c:\program files\Common Files\Adobe
2009-03-08 06:08 . 2009-03-08 06:08 -------- d-----w c:\program files\Analog Devices
2009-03-08 06:07 . 2009-03-08 06:07 -------- d-----w c:\program files\intel
2009-03-08 06:00 . 2009-03-08 06:00 -------- d-----w c:\program files\microsoft frontpage
2009-03-08 05:59 . 2004-08-04 12:00 67 --sha-w c:\windows\Fonts\desktop.ini
2009-03-08 05:56 . 2009-03-08 05:56 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-03-08 02:34 . 2004-08-04 12:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-08-04 12:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-08-04 12:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-08-04 12:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-08-04 12:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2004-08-04 12:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2004-08-04 12:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2004-08-04 12:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2004-08-04 12:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2004-08-04 12:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2004-08-04 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-09 12:10 . 2004-08-04 12:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 12:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 12:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 12:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 12:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 17:02 . 2004-08-03 22:59 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 16:52 . 2009-02-06 16:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 11:11 . 2004-08-04 12:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2004-08-04 12:00 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-04 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-08-04 12:00 56832 ----a-w c:\windows\system32\secur32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-04-03 2794928]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\English\\setup.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\mahmoud\\My Documents\\برامج\\BM_Radio_v3.0\\BM Radio v3.0.exe"=

S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-07-01 468224]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b48405c9-2a8d-11de-91a5-000874d05755}]
\Shell\AutoRun\command - I:\USBNB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-04-28 c:\windows\Tasks\User_Feed_Synchronization-{DB43A56F-5903-466F-B499-A6624A85145F}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 02:31]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = local
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
TCP: {21C5CD6C-D7E4-43DB-81EF-AFE4EBFE85CA} = 217.66.226.8
FF - ProfilePath - c:\documents and settings\mahmoud\Application Data\Mozilla\Firefox\Profiles\pjcixlpe.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=chrff-brandt_off&type=000104X001US&p=
FF - component: c:\documents and settings\mahmoud\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.
.
------- File Associations -------
.
txtfile=c:\windows\notepad.exe %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-04-28 15:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-28 15:32
ComboFix-quarantined-files.txt 2009-04-28 13:32

Pre-Run: 9,603,223,552 bytes free
Post-Run: 9,618,849,792 bytes free

192 --- E O F --- 2009-04-16 10:18

 

[السّاجد لله]

اعمل تقرير هايجاك جديد الان
​

 

[abu-hanafy]

Logfile of HijackThis v1.99.1
Scan saved at 05:38:00 م, on 28/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\mahmoud\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O17 - HKLM\System\CCS\Services\Tcpip\..\{21C5CD6C-D7E4-43DB-81EF-AFE4EBFE85CA}: NameServer = 217.66.226.8
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.exe

 

[KoNaMi]

الان اعمل الاتي

حمل الاداة التالية
​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيل الاداة نضغط كما محدد بالصورة التالية​

ونوافق على الرسائل التي تخرج وفي حال خروج تحذير من برنامج الحماية نعمل له سماح

=====================================

وبعدها حمل هذه الأداءة ...

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

دبل كليك عليه ...

أتركها حتى تنتهي ...

===========================================

بعدين

حمل هذه الاداة من هنا

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

او

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

بعد تنزيل الاداة دبل كلك ستظهر لديك مثل هذه النافذة خذ صورة لها وارفقها بردك القادم

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​

​

​