( تم حل المشكلة ) عندا فتح أحد الدرايفرات يفتح في نافذة أخرى

[القوي]

السلام عليكم

عندي مشكلة بسيط وهي عندا فتح أحد الدرايفرات يفتح في نافذة أخرى مالحل جزاكم الله خير

هذا تقرير هايجك للجهاز

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:04:02 م, on 18/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\agrsmsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\إصلاح مشاكل القرص الصلب\Zyzoom_HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
--
End of file - 5479 bytes

 

[القوي]

أتمنى مساعدتكم يا شباب

 

[Demo-dashDemo-dash is verified member.]

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم​

​

 

[القوي]

دقايق وارفع التقرير مشكور على الرد

 

[القوي]

التقرير

ComboFix 09-05-18.06 - Administrator 05/18/2009 15:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.1015.640 [GMT 3:00]
Running from: F:\ComboFix.exe
AV: avast! antivirus 4.8.1290 [VPS 090518-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\icxpa.cmd
C:\ukvr.bat
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
D:\Autorun.inf
D:\fbak.exe
D:\g1ljsm.com
D:\hkn6k.bat
D:\icxpa.cmd
D:\j.cmd
D:\lc.exe
D:\rbj9jn1n.bat
D:\ukvr.bat
D:\ysep1.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))
.
2009-05-18 10:56 . 2009-05-18 10:56 -------- d-----w c:\windows\LastGood
2009-05-18 10:06 . 2003-03-18 20:20 1060864 ----a-w c:\windows\system32\MFC71.dll
2009-05-18 10:06 . 2009-05-18 10:06 -------- d-----w c:\program files\Alwil Software
2009-05-18 10:02 . 2004-08-03 21:56 4096 -c--a-w c:\windows\system32\dllcache\ksuser.dll
2009-05-18 09:56 . 2005-05-03 01:10 68096 ------w c:\windows\system32\agrsmdel.exe
2009-05-18 09:56 . 2009-05-18 09:56 -------- d-----w c:\windows\Options
2009-05-18 09:56 . 2008-03-07 09:11 54824 ----a-w c:\windows\agrsmdel.exe
2009-05-18 09:56 . 2005-09-10 00:20 88203 ----a-w c:\windows\AGRSMMSG.exe
2009-05-18 09:56 . 2008-02-29 12:13 1202560 ----a-w c:\windows\system32\drivers\AGRSM.sys
2009-05-18 09:38 . 2005-02-25 03:35 22752 ----a-w c:\windows\system32\spupdsvc.exe
2009-05-18 09:38 . 2009-05-18 11:45 -------- d--h--w c:\windows\$hf_mig$
2009-05-18 08:17 . 2009-05-18 08:17 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-18 08:00 . 2009-05-18 08:00 78528 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-18 07:56 . 2008-02-15 09:49 159744 ----a-w c:\windows\system32\igfxres.dll
2009-05-18 07:30 . 2009-05-18 07:30 -------- d-----w c:\documents and settings\Administrator\Application Data\Thinstall
2009-05-18 07:27 . 2008-02-15 10:12 57344 ----a-w c:\windows\system32\igxprd32.dll
2009-05-18 07:27 . 2008-02-15 10:12 5854752 ----a-w c:\windows\system32\drivers\igxpmp32.sys
2009-05-18 07:27 . 2008-02-15 10:12 1670144 ----a-w c:\windows\system32\igxpdv32.dll
2009-05-18 07:27 . 2008-02-15 10:12 151040 ----a-w c:\windows\system32\igxpgd32.dll
2009-05-18 07:27 . 2008-02-15 10:21 147456 ----a-w c:\windows\system32\igfxCoIn_v4926.dll
2009-05-18 07:27 . 2008-02-15 10:12 2643968 ----a-w c:\windows\system32\igxpdx32.dll
2009-05-18 07:27 . 2006-11-10 05:25 319456 ----a-w c:\windows\system32\difxapi.dll
2009-05-18 07:27 . 2008-03-07 09:56 920088 ----a-w c:\windows\system32\igxpun.exe
2009-05-18 07:27 . 2009-05-18 07:27 -------- d-----w c:\windows\system32\Lang
2009-05-18 07:26 . 2007-09-04 16:56 164352 ----a-w c:\windows\system32\unrar.dll
2009-05-18 07:26 . 2004-01-25 16:18 217088 ----a-w c:\windows\system32\yv12vfw.dll
2009-05-18 07:26 . 2008-01-10 12:15 755027 ----a-w c:\windows\system32\xvidcore.dll
2009-05-18 07:26 . 2008-01-10 12:16 159839 ----a-w c:\windows\system32\xvidvfw.dll
2009-05-18 07:26 . 2008-03-21 20:28 81920 ----a-w c:\windows\system32\dpl100.dll
2009-05-18 07:26 . 2008-03-21 20:30 3596288 ----a-w c:\windows\system32\qt-dx331.dll
2009-05-18 07:26 . 2008-03-31 21:25 682496 ----a-w c:\windows\system32\divx.dll
2009-05-18 07:26 . 2008-03-28 17:41 7680 ----a-w c:\windows\system32\ff_vfw.dll
2009-05-18 07:26 . 2009-05-18 07:26 -------- d-----w c:\program files\K-Lite Codec Pack
2009-05-18 07:26 . 2009-05-18 07:26 -------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2009-05-18 07:26 . 2009-05-18 07:26 -------- d-----w c:\documents and settings\Administrator\Application Data\GRETECH
2009-05-18 07:26 . 2009-05-18 07:26 -------- d-----w c:\program files\GRETECH
2009-05-18 07:24 . 2009-05-18 07:24 -------- d-----w c:\program files\Common Files\xing shared
2009-05-18 07:24 . 2009-05-18 07:24 -------- d-----w c:\program files\Real
2009-05-18 07:24 . 2009-05-18 07:24 348160 ----a-w c:\windows\system32\msvcr71.dll
2009-05-18 07:24 . 2009-05-18 07:24 499712 ----a-w c:\windows\system32\msvcp71.dll
2009-05-18 07:24 . 2009-05-18 07:24 -------- d-----w c:\program files\Common Files\Real
2009-05-18 07:23 . 2009-05-18 07:23 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-05-18 07:23 . 2009-05-18 07:23 -------- d-----w c:\program files\Common Files\Adobe
2009-05-18 07:22 . 2009-05-18 07:22 -------- d-----w c:\program files\The KMPlayer
2009-05-18 07:05 . 2009-05-18 07:09 -------- d-----w c:\documents and settings\All Users\Application Data\DriverScanner
2009-05-18 07:05 . 2009-05-18 07:05 -------- d-----w c:\program files\Uniblue
2009-05-18 07:05 . 2009-05-18 07:05 -------- d-----w c:\documents and settings\Administrator\Application Data\Uniblue
2009-05-18 06:14 . 2009-05-18 06:14 -------- d-----w c:\program files\3GP Player
2009-05-18 06:14 . 2009-05-18 06:14 -------- d-----w c:\program files\FlashGet
2009-05-18 06:02 . 2009-05-18 08:17 -------- d-----w c:\program files\Java
2009-05-18 06:01 . 2009-05-18 06:01 -------- d-----w c:\program files\Common Files\Java
2009-05-18 00:08 . 2001-08-17 13:59 3072 ----a-w c:\windows\system32\drivers\audstub.sys
2009-05-18 00:08 . 2004-08-03 22:59 57472 ----a-w c:\windows\system32\drivers\redbook.sys
2009-05-18 00:07 . 2001-08-17 13:58 9344 ----a-w c:\windows\system32\drivers\compbatt.sys
2009-05-18 00:07 . 2001-08-17 13:57 14080 ----a-w c:\windows\system32\drivers\battc.sys
2009-05-18 00:07 . 2004-08-03 23:07 14080 ----a-w c:\windows\system32\drivers\CmBatt.sys
2009-05-18 00:07 . 2001-08-17 13:46 6400 ----a-w c:\windows\system32\drivers\enum1394.sys
2009-05-18 00:07 . 2004-08-03 21:56 74240 -c--a-w c:\windows\system32\dllcache\usbui.dll
2009-05-18 00:07 . 2004-08-03 21:56 74240 ----a-w c:\windows\system32\usbui.dll
2009-05-18 00:04 . 2009-05-17 21:25 -------- d-----w C:\Documents and Settings
2009-05-18 00:04 . 2009-05-17 21:20 -------- d-----w c:\documents and settings\All Users
2009-05-18 00:04 . 2009-05-17 22:33 -------- d--h--w c:\documents and settings\Default User
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-18 10:02 . 2009-05-18 10:02 -------- d-----w c:\program files\Realtek
2009-05-18 10:02 . 2009-05-18 10:00 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-18 10:02 . 2009-05-18 09:59 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-17 22:26 . 2009-05-17 22:26 -------- d-----w c:\program files\Common Files\L&H
2009-05-17 22:26 . 2009-05-17 22:26 -------- d-----w c:\program files\Microsoft.NET
2009-05-17 22:25 . 2009-05-17 22:25 -------- d-----w c:\program files\Microsoft ActiveSync
2009-05-17 22:25 . 2009-05-17 22:25 -------- d-----w c:\program files\Microsoft Works
2009-05-17 21:21 . 2009-05-17 21:21 -------- d-----w c:\program files\microsoft frontpage
2009-05-17 21:17 . 2009-05-17 21:17 21640 ----a-w c:\windows\system32\emptyregdb.dat
.
------- Sigcheck -------
[7] 2004-08-03 20:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\system32\dllcache\tcpip.sys
[-] 2004-08-03 20:14 359040 6A603809F598332DBEDD535BDBCE313E c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-18 185896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-07-22 16261632]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-17 2879488]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-09-10 88203]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [28/02/2006 07:00 ص 34880]
R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [22/06/2006 09:09 ص 29184]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18/05/2009 01:06 م 110160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18/05/2009 01:06 م 20560]
S3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [17/08/2001 04:52 م 18688]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - AAVMKER4
*NewlyCreated* - AGEREMODEMAUDIO
*NewlyCreated* - ASWFSBLK
*NewlyCreated* - ASWMON2
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSP
*NewlyCreated* - ASWTDI
*NewlyCreated* - ASWUPDSV
*NewlyCreated* - AVAST!_ANTIVIRUS
*NewlyCreated* - AVAST!_MAIL_SCANNER
*NewlyCreated* - AVAST!_WEB_SCANNER
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.sa/
uInternet Connection Wizard,ShellNext = hxxp://03compu.ru/start
IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-05-18 15:21
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-05-18 15:22
ComboFix-quarantined-files.txt 2009-05-18 12:22
Pre-Run: 32,473,370,624 bytes free
Post-Run: 32,583,434,240 bytes free
173 --- E O F --- 2009-05-18 09:39

 

[القوي]

أخوي مشكور ماقصرة الله يوفقك لكل خير انحلت المشكلة بعد إستخدام الأداة
مشكور مرة أخرى