الجهاز يتوقف عند شاشة الويندوز . أرجو الحل

[mehrez02]

مساء الخير عليكم جميعا
انقذونني ما المشكل في جهازي
بدأت مشكلتي عندما قمت اليوم بفتح جهازي لكن المشكلة التي اعترضتني ان جهازي توقف و لم يكمل الفتح
توقف قبل هذه المرحلة التي في الصورة ادني هذا الموضوع
لم يكمل الفتح لكن في الاخير بعد عدد محولات فتح و الحمد لله عندما قمت باغلاق الكمبيوتر عدة مرات و فتحه
كل مرة يفعل بي هكذا ما المشكل يا تري

وهذا تقرير هايجاك

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:34:55, on 02/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Virtual PC\Virtual PC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 5672 bytes

 

[format]

هذا جهاز وهمي ؟؟​

 

[mehrez02]

الصورة التي التقطت منها الميثال من جهازي الوهمي لكن المشكلة في جهازي الاصلي

 

[format]

قم بحذف التالي
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe


O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)


طريقة الحذف للاكس بي

بعدين استخدم ها الادوات



التحميل من هنا

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبي فقط





شرح الاستخدام ,,,,,,




عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))

بعدين

عطل جميع برامج الحمايه ,,

نزل هذه الاداة

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى الصق التقرير بمشاركتك القادمة​

​

 

[mehrez02]

شكرا اخي ولكنني في كل مرة اعمل تقرير هايجاك واجد هذه الاصابات و احذفها واستعمل الاداة الثانية لكن دون جدوي
وهل مشكلتي التي بصدد التحري عنها سببها الفيروسات ام ماذا

 

[format]

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

اذا كانت نفس الاصابات ولاتنحذف

استخدم هذا

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

وهات التقريرالكاسبر في ردك القادم​

 

[mehrez02]

انا بصدد القيام بما قلت لي لكن اود ان استفسر
ما سبب مشكلة جهازي

 

[format]

هذا جزء من المشكله
C:\Program Files\NOS\bin\getPlus_HelperSvc.exe​

 

[أعتز بك]

عذراًُ بتعديل العنوان للأفضل

موفق ..

 

[mehrez02]

اخ فرمات عند قيامي بالفحص باداة الكسبر تعلق الجهاز مما ادي بي ال اغلاقه

 

[mehrez02]

ماذا افعل اذا

 

[mehrez02]

up

 

[mehrez01]

up

 

[mehrez01]

b

 

[mehrez01]

لم تحل مشكلتي الي حد الان

 

[mehrez01]

ارجو اجابتي

 

[mehrez01]

ComboFix 09-05-31.06 - Administrateur 02/06/2009 22:59.6 - NTFSx86 MINIMAL
Running from: D:\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-05-02 to 2009-06-02 )))))))))))))))))))))))))))))))
.

2009-06-02 20:03 . 2009-06-02 20:03 -------- d-sh--w- c:\documents and settings\Administrateur\IECompatCache
2009-06-02 20:03 . 2009-06-02 20:03 -------- d-sh--w- c:\documents and settings\Administrateur\PrivacIE
2009-06-02 20:00 . 2009-06-02 20:00 -------- d-----w- c:\windows\system32\dllcache
2009-06-02 18:24 . 2009-06-02 18:24 -------- d-sh--w- c:\documents and settings\majid\IETldCache
2009-06-02 17:03 . 2009-06-02 17:38 782368 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-01 18:33 . 2009-06-02 16:23 165232 ---ha-w- c:\documents and settings\user\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll
2009-06-01 18:30 . 2009-06-01 18:30 -------- d-----w- c:\program files\Microsoft Virtual PC
2009-06-01 17:02 . 2009-06-01 17:02 -------- d-----w- c:\program files\KONAMI
2009-06-01 16:05 . 2009-06-01 16:05 -------- d-sh--w- c:\documents and settings\Administrateur\IETldCache
2009-06-01 15:46 . 2009-06-01 15:46 -------- d-----w- c:\program files\Wanadoo Edition
2009-06-01 15:18 . 2009-06-01 15:18 -------- d-sh--w- c:\documents and settings\user\IECompatCache
2009-06-01 15:18 . 2009-06-01 15:18 -------- d-sh--w- c:\documents and settings\user\PrivacIE
2009-06-01 14:24 . 2008-04-14 02:33 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-01 14:21 . 2009-06-01 14:21 -------- d-sh--w- c:\documents and settings\user\IETldCache
2009-06-01 14:18 . 2009-06-01 14:18 -------- d-----w- c:\windows\ie8updates
2009-06-01 14:17 . 2009-06-01 14:17 -------- dc-h--w- c:\windows\ie8
2009-06-01 13:55 . 2009-06-01 13:55 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-01 13:52 . 2009-06-01 13:53 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-06-01 13:52 . 2009-06-01 13:52 -------- d-----w- c:\windows\system32\LogFiles
2009-06-01 09:32 . 2009-06-01 14:20 -------- d-----w- c:\windows\system32\fr-fr
2009-06-01 09:32 . 2009-06-01 09:32 -------- d-----w- c:\windows\l2schemas
2009-06-01 09:32 . 2009-06-01 09:32 -------- d-----w- c:\windows\system32\fr
2009-06-01 09:32 . 2009-06-01 09:32 -------- d-----w- c:\windows\system32\bits
2009-06-01 09:30 . 2009-06-01 09:32 -------- d-----w- c:\windows\ServicePackFiles
2009-05-31 19:29 . 2007-10-23 07:27 110592 ----a-w- c:\documents and settings\user\Application Data\U3\temp\cleanup.exe
2009-05-31 19:27 . 2008-05-02 08:41 3493888 ---ha-w- c:\documents and settings\user\Application Data\U3\temp\Launchpad Removal.exe
2009-05-31 18:42 . 2009-05-31 18:42 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Adobe
2009-05-31 18:41 . 2009-05-31 18:41 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-05-31 18:33 . 2009-05-31 18:33 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-05-31 18:33 . 2009-03-03 12:53 17464 ----a-w- c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\eqnigg3n.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\chrome\content\getPlus_Adobe_reg.exe
2009-05-31 18:33 . 2009-03-03 12:53 12792 ----a-w- c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\eqnigg3n.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\chrome\content\getPlus_Adobe_reg_bootstrap.exe
2009-05-31 18:33 . 2009-03-03 12:53 109420 ----a-w- c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\eqnigg3n.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll
2009-05-31 18:31 . 2009-05-31 18:31 73216 ----a-w- c:\windows\cadkasdeinst01f.exe
2009-05-29 19:01 . 2009-05-29 19:01 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-05-29 18:32 . 2009-05-29 18:32 -------- d-----w- c:\documents and settings\user\Application Data\Big Fish Games
2009-05-29 18:32 . 2009-05-29 18:32 -------- d-----w- c:\program files\Azada
2009-05-29 17:37 . 2009-05-29 17:37 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Mozilla
2009-05-29 13:07 . 2009-05-29 14:59 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-29 13:02 . 2004-08-03 20:29 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2009-05-28 20:31 . 2008-06-14 17:33 272768 ------w- c:\windows\system32\drivers\bthport.sys
2009-05-28 18:00 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\drivers\mstee.sys
2009-05-28 18:00 . 2008-04-13 18:46 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2009-05-28 18:00 . 2008-04-13 18:46 15232 ----a-w- c:\windows\system32\drivers\streamip.sys
2009-05-28 18:00 . 2008-04-13 18:46 11136 ----a-w- c:\windows\system32\drivers\slip.sys
2009-05-28 18:00 . 2008-04-13 18:46 19200 ----a-w- c:\windows\system32\drivers\wstcodec.sys
2009-05-28 18:00 . 2008-04-13 18:46 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2009-05-28 18:00 . 2008-04-13 18:46 17024 ----a-w- c:\windows\system32\drivers\ccdecode.sys
2009-05-28 18:00 . 2008-04-14 02:33 54784 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-05-28 17:59 . 2007-11-02 09:07 6656 ----a-w- c:\windows\system32\CoInst_071102.dll
2009-05-28 17:59 . 2007-10-25 16:31 616064 ----a-w- c:\windows\system32\drivers\PFC027.SYS
2009-05-28 17:59 . 2007-10-04 15:42 48128 ----a-w- c:\windows\system32\Remove.exe
2009-05-28 17:59 . 2009-05-28 17:59 -------- d-----w- c:\program files\Fichiers communs\PAC207
2009-05-28 17:59 . 2009-05-28 17:59 -------- d-----w- c:\windows\PixArt
2009-05-28 17:59 . 2006-10-12 09:57 14336 ----a-w- c:\windows\system32\P207USD.dll
2009-05-28 12:38 . 2009-05-28 12:38 -------- d--h--w- c:\windows\PIF
2009-05-27 18:42 . 2009-05-27 18:42 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-05-27 10:01 . 2009-05-27 10:01 -------- d-----w- c:\documents and settings\majid\Application Data\ESET
2009-05-26 19:18 . 2009-05-26 19:18 -------- d-----w- c:\program files\Nero
2009-05-26 18:55 . 2009-05-26 18:55 -------- d-----w- c:\documents and settings\user\Application Data\Apple Computer
2009-05-26 18:52 . 2009-05-26 18:53 -------- d-----w- c:\program files\QuickTime
2009-05-26 18:52 . 2009-05-26 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-26 18:52 . 2009-05-26 18:52 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Apple
2009-05-26 18:52 . 2009-05-26 18:52 -------- d-----w- c:\program files\Apple Software Update
2009-05-26 18:52 . 2009-05-26 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-05-26 18:52 . 2009-05-26 18:52 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Apple Computer
2009-05-26 17:40 . 2009-05-26 17:40 -------- d-----w- c:\documents and settings\user\Application Data\Babuki.7FFE1EF3C0EAF397E48071BD36BB45EFAE41A826.1
2009-05-26 12:30 . 2009-05-31 19:29 -------- d-----w- c:\documents and settings\user\Application Data\U3
2009-05-25 19:16 . 2009-05-25 19:17 -------- d-----w- c:\program files\USB Disk Security
2009-05-25 10:36 . 2009-05-25 10:36 -------- d-----w- c:\program files\Fichiers communs\xing shared
2009-05-25 10:36 . 2009-05-25 10:36 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-25 10:36 . 2009-05-25 10:36 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-25 10:36 . 2009-05-25 10:36 -------- d-----w- c:\program files\Real
2009-05-25 10:36 . 2009-05-25 10:36 -------- d-----w- c:\program files\Fichiers communs\Real
2009-05-25 10:32 . 2008-09-16 19:23 168448 ----a-w- c:\windows\system32\unrar.dll
2009-05-25 10:32 . 2009-05-25 10:32 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-24 19:41 . 2004-08-19 14:09 4096 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll
2009-05-24 19:23 . 2009-05-24 19:23 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-05-24 19:23 . 2009-05-24 19:23 -------- d-----w- c:\program files\MSECache
2009-05-24 17:48 . 2009-05-24 17:48 -------- d-----w- c:\program files\Trend Micro
2009-05-24 17:32 . 2009-05-24 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-05-24 16:39 . 2009-01-07 16:21 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-24 16:39 . 2009-06-01 14:18 -------- d--h--w- c:\windows\$hf_mig$
2009-05-24 16:34 . 2009-05-24 16:34 0 ----a-w- c:\windows\nsreg.dat
2009-05-24 16:34 . 2009-05-24 16:34 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Mozilla
2009-05-24 16:12 . 2009-05-24 19:33 89976 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-24 15:07 . 2008-04-14 02:32 76288 ----a-w- c:\windows\system32\uniime.dll
2009-05-24 15:05 . 2001-09-28 12:00 6656 ----a-w- c:\windows\system32\c_is2022.dll
2009-05-24 15:02 . 2001-08-17 21:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2009-05-24 15:02 . 2008-04-14 02:33 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-05-24 15:02 . 2008-04-14 01:57 58752 ----a-w- c:\windows\system32\drivers\redbook.sys
2009-05-24 15:01 . 2008-04-14 02:33 77312 ----a-w- c:\windows\system32\usbui.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-02 17:38 . 2009-06-02 17:03 10244 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-01 18:32 . 2001-09-28 12:00 50136 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-01 18:32 . 2001-09-28 12:00 371018 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-01 17:05 . 2009-05-24 13:51 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-01 16:03 . 2009-05-30 22:14 -------- d-----w- c:\documents and settings\user\Application Data\cleaner
2009-06-01 09:35 . 2009-05-24 13:38 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-31 19:56 . 2009-05-24 13:49 -------- d-----w- c:\program files\Dell
2009-05-30 22:14 . 2009-05-30 22:14 -------- d-----w- c:\documents and settings\user\Application Data\CyberScrub
2009-05-28 20:12 . 2009-05-24 14:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-24 14:06 . 2009-05-24 14:06 -------- d-----w- c:\program files\Microsoft Works
2009-05-24 14:06 . 2009-05-24 14:06 -------- d-----w- c:\program files\MSBuild
2009-05-24 13:55 . 2009-05-24 13:55 1915520 ----a-w- c:\documents and settings\user\Application Data\Macromedia\Flash Player\

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

2009-05-24 13:51 . 2009-05-24 13:51 -------- d-----w- c:\program files\Analog Devices
2009-05-24 13:39 . 2009-05-24 13:39 -------- d-----w- c:\program files\microsoft frontpage
2009-05-24 13:38 . 2009-05-24 13:38 -------- d-----w- c:\program files\Services en ligne
2009-05-24 13:36 . 2009-05-24 13:36 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-24 13:23 . 2009-05-24 13:23 -------- d-----w- c:\documents and settings\user\Application Data\ESET
2009-05-24 13:21 . 2009-05-24 13:21 -------- d-----w- c:\program files\ESET
2009-05-24 13:21 . 2009-05-24 13:21 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-05-24 13:09 . 2009-05-24 13:09 -------- d-----w- c:\program files\Lexmark 1200 Series
2009-05-24 13:01 . 2009-05-24 12:56 -------- d-----w- c:\program files\ATI Technologies
2009-05-24 12:55 . 2009-05-24 13:49 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2009-05-24 12:53 . 2009-05-24 12:53 -------- d-----w- c:\program files\Broadcom
2009-05-14 13:49 . 2009-05-14 13:49 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2009-05-14 13:49 . 2009-05-14 13:49 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2009-05-14 13:49 . 2009-05-14 13:49 133000 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-05-14 13:47 . 2009-05-14 13:47 107256 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2009-05-14 13:41 . 2009-05-14 13:41 114472 ----a-w- c:\windows\system32\drivers\eamon.sys
2009-03-08 02:34 . 2004-08-19 14:09 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-08-19 14:09 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-08-19 14:09 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-08-19 14:09 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-08-19 14:09 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2004-08-19 14:09 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2004-08-19 14:09 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2004-08-19 14:08 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2004-08-19 14:10 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2001-09-28 12:00 156160 ----a-w- c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-19 14:09 286720 ----a-w- c:\windows\system32\pdh.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-05-25 198160]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-09-23 798720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [24/05/2009 14:54 3456]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14/05/2009 15:47 107256]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14/05/2009 15:47 731840]
S3 PAC207;Eye 110;c:\windows\system32\drivers\PFC027.SYS [28/05/2009 19:59 616064]
S3 scrcap;scrcap;c:\windows\system32\DRIVERS\scrcap.sys --> c:\windows\system32\DRIVERS\scrcap.sys [?]
S4 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe --> c:\program files\NOS\bin\getPlus_HelperSvc.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-06-02 c:\windows\Tasks\User_Feed_Synchronization-{BF3D3DBA-70FB-4B2F-80EB-BA1AFD81337D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]

2009-06-02 c:\windows\Tasks\User_Feed_Synchronization-{F16FB740-72B4-4D2A-99E7-B55881EFBB2D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\n0cf4mpi.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
vbefile\shell\edit\command=c:\windows\Notepad.exe %1
vbsfile\shell\edit\command=c:\windows\Notepad.exe %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-06-02 23:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1844237615-1275210071-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a9,40,49,43,8f,07,d2,44,8b,92,7b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a9,40,49,43,8f,07,d2,44,8b,92,7b,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(664)
c:\windows\system32\ieframe.dll
c:\windows\system32\eappprxy.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\PDFShell.FRA
.
Completion time: 2009-06-02 23:13
ComboFix-quarantined-files.txt 2009-06-02 21:13
ComboFix2.txt 2009-06-02 18:00

Pre-Run: 79 083 302 912 octets libres
Post-Run: 79 133 257 728 octets libres

235 --- E O F --- 2009-06-01 09:41

 

[mehrez01]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:25:31, on 02/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول أو التسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 4568 bytes

 

[SWW]

انا كانت لدي نفس المشكلة وطلع السبب مروحة المعالج غير مثبت وبعد التثبيت انحلت المشكلة

 

[mehrez01]

ما دخل المروحة