إسماعيل

زيزوومى فعال
إنضم
16 يناير 2008
المشاركات
249
مستوى التفاعل
1
النقاط
330
الإقامة
ksa
غير متصل
السلام عليكم ورحمة الله وبركاته

جعلني الله وإياكم من السعداء ..

جهازي الآخر يصدر رسائل إغلاق ، وينطفئ فجأة

ما سببه ؟؟ هل هو فيروس ؟؟ هل خلل في الهارد ؟؟

ـ تم عمل فورمات مرتين .. ونفس الوضع ـ

مثل هذه الرسالة .. تتعدد إغلاقات أسماء البرامج كل مرة اسم آخر

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


هذا تقرير من الجهاز :

كود:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:12:24 م, on 02/06/09
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
H:\أدوات زيزوم\Zyzoom_HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://runonce.msn.com/?v=msgrv75[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 3732 bytes
 

عطل جميع برامج الحمايه

حمل هذه الاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes

اثناء الفحص ممكن يعاد تشغيل الجهاز

وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى
الصق التقرير فى ردك القادم
 
توقيع : king_man
أخي الكريم .. شكر الله سعيك
وجزاك الله خيرا فيما تقدمه لإخوتك

هذا التقرير ـ بعد أن ظهرت رسائل كثيرة متعددة ورسائل خطأ .. المهم :

كود:
ComboFix 09-05-31.06 - medoo 06/03/2009  1:38.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1256.966.1025.18.3061.2334 [GMT 3:00]
Running from: h:\أدوات زيزوم\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
  Error: Cfiles.dat
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\kakle.dll
c:\windows\system32\videocore.dll
c:\windows\system32\videoformat.dll
.
(((((((((((((((((((((((((   Files Created from 2009-05-02 to 2009-06-02  )))))))))))))))))))))))))))))))
.
2009-06-02 22:39 . 2009-06-02 22:39 -------- d-----w- c:\users\medoo\AppData\Local\temp
2009-06-02 11:27 . 2009-06-02 11:27 -------- d-----w- c:\program files\RdDrv001
2009-06-02 11:16 . 2009-06-02 11:20 -------- d-----w- c:\program files\timeworks
2009-06-02 11:16 . 1998-11-22 00:13 53248 ----a-w- c:\windows\system32\stu.dll
2009-06-02 11:16 . 1998-01-23 09:22 304128 ----a-w- c:\windows\IsUninst.exe
2009-06-02 11:12 . 2009-06-02 11:12 -------- d-----w- c:\windows\Downloaded Installations
2009-05-31 21:07 . 2008-01-25 08:46 106496 ----a-w- c:\windows\system32\drivers\Rtlh86.sys
2009-05-30 20:35 . 2006-10-26 16:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2009-05-30 20:34 . 2009-05-30 20:34 -------- d-----w- c:\program files\Microsoft Works
2009-05-30 20:34 . 2009-05-30 20:34 -------- d-----w- c:\program files\Microsoft.NET
2009-05-30 20:32 . 2009-05-30 20:32 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-05-30 20:31 . 2009-05-30 20:31 -------- d-----w- c:\users\medoo\AppData\Local\Microsoft Help
2009-05-30 20:31 . 2009-05-30 20:35 -------- d-----w- c:\programdata\Microsoft Help
2009-05-30 20:31 . 2009-05-30 20:31 -------- d--h--r- C:\MSOCache
2009-05-30 19:44 . 2009-05-30 19:44 -------- d-----w- c:\programdata\Messenger Plus!
2009-05-30 19:40 . 2009-05-30 19:40 -------- d-----w- c:\program files\Golden Al-Wafi Translator
2009-05-30 19:40 . 2009-05-30 19:40 172032 ------w- c:\windows\Setup1.exe
2009-05-30 19:40 . 2009-05-30 19:40 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-05-30 19:37 . 2009-05-30 19:37 -------- d-----w- c:\users\medoo\AppData\Local\Adobe
2009-05-30 19:37 . 2009-05-30 19:37 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-30 19:27 . 2009-05-30 19:27 390664 ----a-w- c:\users\medoo\AppData\Roaming\Real\RealPlayer\Update\RealPlayer11.exe
2009-05-30 19:26 . 2009-05-30 19:26 -------- d-----w- c:\users\medoo\AppData\Roaming\Ashampoo
2009-05-30 19:25 . 2009-05-30 19:25 -------- d-----w- c:\users\medoo\AppData\Local\ashampoo
2009-05-30 19:25 . 2009-05-30 19:25 -------- d-----w- c:\programdata\ashampoo
2009-05-30 19:25 . 2009-05-30 19:25 -------- d-----w- c:\windows\system32\ebay
2009-05-30 19:25 . 2009-05-30 19:25 -------- d-----w- c:\program files\Ashampoo
2009-05-30 19:25 . 2009-05-30 19:25 -------- d-----w- C:\dalel v1
2009-05-30 19:24 . 2009-05-30 19:24 -------- d-----w- c:\program files\Nokia
2009-05-30 19:24 . 2009-05-30 19:24 -------- d-----w- c:\program files\Typing Arabic
2009-05-30 19:24 . 2009-05-30 19:24 286720 ----a-w- c:\windows\iun506.exe
2009-05-30 19:24 . 2009-05-30 19:24 -------- d-----w- c:\program files\قاموس صخر
2009-05-30 19:23 . 2009-05-30 19:23 -------- d-----w- c:\program files\GRETECH
2009-05-30 19:23 . 2009-05-30 19:23 -------- d-----w- c:\program files\Webteh
2009-05-30 19:23 . 2009-05-30 19:23 -------- d-----w- c:\program files\JetAudio
2009-05-30 19:23 . 2009-05-30 19:23 -------- d-----w- c:\program files\Common Files\COWON
2009-05-30 19:23 . 2009-05-30 19:23 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-30 19:21 . 2009-05-30 19:21 -------- d-----w- c:\program files\Common Files\xing shared
2009-05-30 19:20 . 2009-05-30 19:20 -------- d-----w- c:\users\medoo\AppData\Roaming\uTorrent
2009-05-30 19:20 . 2009-05-30 19:20 -------- d-----w- c:\program files\uTorrent
2009-05-30 19:20 . 2009-05-30 19:20 -------- d-----w- c:\windows\system32\Macromed
2009-05-30 19:20 . 2002-02-18 07:23 46352 ----a-w- c:\windows\setdebug.exe
2009-05-30 19:20 . 2002-02-18 07:22 171280 ----a-w- c:\windows\system32\jit.dll
2009-05-30 19:20 . 2002-02-18 07:22 139536 ----a-w- c:\windows\system32\javaee.dll
2009-05-30 19:20 . 2002-02-18 04:35 6550 ----a-w- c:\windows\jautoexp.dat
2009-05-30 19:20 . 2002-02-18 04:34 313856 ----a-w- c:\windows\system32\dx3j.dll
2009-05-30 19:20 . 2009-05-30 19:20 -------- d-----w- c:\windows\Java
2009-05-30 19:20 . 2009-05-30 20:01 -------- d-----w- c:\program files\Adverts
2009-05-30 19:18 . 2009-05-30 19:18 95928 ----a-w- c:\users\medoo\AppData\Roaming\IDM\idmmzcc\components\idmmzcc.dll
2009-05-30 19:17 . 2009-05-30 19:50 -------- d-----w- c:\users\medoo\AppData\Roaming\DMCache
2009-05-30 19:17 . 2009-05-30 19:18 -------- d-----w- c:\users\medoo\AppData\Roaming\IDM
2009-05-30 19:17 . 2009-05-30 19:44 -------- d-----w- c:\program files\Internet Download Manager
2009-05-30 19:17 . 2009-05-30 19:17 -------- d-----w- c:\program files\Ace Utilities
2009-05-30 17:55 . 2009-05-30 17:58 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-05-30 17:55 . 2009-05-30 17:58 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-05-30 17:55 . 2009-05-30 17:55 -------- d-----w- c:\programdata\Avira
2009-05-30 17:55 . 2009-05-30 17:55 -------- d-----w- c:\program files\Avira
2009-05-30 17:54 . 2009-06-02 11:15 -------- d-sh--w- c:\windows\Installer
2009-05-30 17:47 . 2009-05-30 17:47 240128 ----a-w- c:\windows\system32\drivers\royal.sys
2009-05-30 17:44 . 2009-05-30 17:44 -------- d-----w- c:\program files\Realtek
2009-05-30 17:44 . 2009-05-30 19:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-30 17:44 . 2009-05-30 17:44 -------- d-----w- c:\users\medoo\AppData\Roaming\InstallShield
2009-05-30 17:44 . 2007-06-21 06:34 203328 ----a-r- c:\windows\GSetup.exe
2009-05-30 17:44 . 2009-05-30 17:45 16376 ----a-w- c:\windows\gdrv.sys
2009-05-30 17:35 . 2009-05-30 17:35 48600 ----a-w- c:\users\medoo\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-30 17:26 . 2009-05-30 17:26 -------- d-sh--we c:\users\Default\قائمة ابدأ
2009-05-30 17:26 . 2009-05-30 17:26 -------- d-sh--we c:\programdata\قائمة ابدأ
2009-05-30 17:26 . 2009-05-30 17:26 -------- d-sh--we c:\programdata\سطح المكتب
2009-05-30 17:20 . 2009-05-30 17:55 -------- d-----w- c:\windows\system32\catroot2
2009-05-30 17:20 . 2009-05-30 17:26 -------- d-----w- c:\windows\Debug
2009-05-30 17:18 . 2009-05-30 17:22 -------- d-----w- c:\windows\Panther
2009-05-30 17:18 . 2009-05-30 17:18 -------- d-sh--w- C:\Boot
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-02 16:02 . 2006-12-05 05:23 80552 ----a-w- c:\windows\system32\perfc001.dat
2009-06-02 16:02 . 2006-12-05 05:23 459676 ----a-w- c:\windows\system32\perfh001.dat
2009-06-02 15:56 . 2009-05-30 17:34 680 ----a-w- c:\users\medoo\AppData\Local\d3d9caps.dat
2009-05-30 20:34 . 2006-11-02 12:37 -------- d-----w- c:\program files\MSBuild
2009-05-30 19:55 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-05-30 19:54 . 2009-05-30 19:21 -------- d-----w- c:\program files\Google
2009-05-30 19:54 . 2009-05-30 19:19 -------- d-----w- c:\program files\Messenger Plus! Live
2009-05-30 19:21 . 2009-05-30 19:21 -------- d-----w- c:\program files\Common Files\Real
2009-05-30 19:21 . 2009-05-30 19:21 499712 ----a-w- c:\windows\system32\msvcp71.dll
2007-03-12 09:04 . 2009-05-30 19:20 66672 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-03-12 09:04 . 2009-05-30 19:20 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-03-12 09:04 . 2009-05-30 19:20 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-03-12 09:04 . 2009-05-30 19:20 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-03-12 09:04 . 2009-05-30 19:20 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"IDMan"=c:\program files\Internet Download Manager\IDMan.exe /onboot
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" /background
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe"  -osboot
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4132347602-468123948-2199125375-1001]
"EnableNotificationsRef"=dword:00000002
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{90955BF4-0FA0-44BD-87DF-719F758A9F1F}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{541F1985-5986-444D-9DFD-863D2E75C456}"= UDP:c:\program files\uTorrent\utorrent.exe:µTorrent
"{D6572646-7B16-45C6-ACFA-245F770789F8}"= TCP:c:\program files\uTorrent\utorrent.exe:µTorrent
"{AF07F770-2DD1-46EA-957B-9FCE33FD05A0}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{C7AB5301-307F-42FA-A354-E9BBDAA6D6D1}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{EE81C75B-F755-48D3-AF0A-D6A62FE86A24}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{F60D24AD-82F4-44CF-BF14-CFEAB653D232}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8351916B-0A54-41D7-B89B-5E97F71B3FD8}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{7E680F7E-5C12-4017-B7E5-C568C59E339A}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{1196B10F-384D-454B-8E4D-C8390F0EEB56}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [30/05/09 08:55 م 108289]
S0 OemBiosDevice;Royalty OEM Bios Extension;c:\windows\System32\drivers\royal.sys [30/05/09 08:47 م 240128]
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys

.
------- Supplementary Scan -------
.
IE: Download All Links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - [URL]file:///C:/Windows/Java/classes/xmldso.cab[/URL]
FF - ProfilePath - 
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel",             1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad",                   false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom",  "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "[URL]http://sb.google.com/safebrowsing/update?client={moz:client}&mozver={moz:version}-{moz:buildid[/URL]}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "[URL]http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&mozver={moz:version}-{moz:buildid[/URL]}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "[URL]http://sb.google.com/safebrowsing/report[/URL]?");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [URL]http://www.gmer.net[/URL]
Rootkit scan 2009-06-03 01:39
Windows 6.0.6000  NTFS
scanning hidden processes ...  
scanning hidden autostart entries ... 
scanning hidden files ...  
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-06-02  1:40
ComboFix-quarantined-files.txt  2009-06-02 22:40
Pre-Run: 33,370,898,432 bytes free
Post-Run: 33,343,750,144 bytes free
180
 
هل حدثت الوندز ؟

وهات هايجك جديد​
 
توقيع : format
هل حدثت الوندز ؟



وهات هايجك جديد



بارك الله فيك أخي الكريم ..
لا لم أحدث الويندوز .. تم عمل فورمات مرتين

تفضل هذا التقرير الجديد
كود:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:51:29 ص, on 03/06/09
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wermgr.exe
H:\أدوات زيزوم\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://runonce.msn.com/?v=msgrv75[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [URL]http://go.microsoft.com/fwlink/?LinkId=54896[/URL]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://go.microsoft.com/fwlink/?LinkId=69157[/URL]
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 3154 bytes


وهذه صورة لإحدى النوافذ التي تظهر لي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
 
اللهم صل وسلم على سيدنا محمد ..
 
عليه أفضل الصلوآت وأتم التسليم ..

التقرير بدون كود ياغالي ,,​
 
توقيع : Corporation
تفضل .. هذا آخر تقرير
وشكرا لك على اطلاعك


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:51:29 ص, on 03/06/09
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wermgr.exe
H:\أدوات زيزوم\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 3154 bytes
 
قبل كل شئ أطفئ البرنامج وشغله بهذه الطريقة ,,

تشغيل كمسؤول >> لا تنسى

بعدها أحذف القيم التالية

O1 - Hosts: ::1 localhost

O13 - Gopher Prefix:

بعدها تقرير هايجاك جديد ,,​
 
توقيع : Corporation
قبل كل شئ أطفئ البرنامج وشغله بهذه الطريقة ,,​


تشغيل كمسؤول >> لا تنسى​

بعدها أحذف القيم التالية​

o1 - hosts: ::1 localhost​

o13 - gopher prefix:​


بعدها تقرير هايجاك جديد ,,​

يعطيك العافية ..
ما هو البرنامج الذي أشغله كمسؤول ؟
وكيف الطريقة ؟ حتى لا أفقد شيئا
وبارك الله فيك ..
 
برنآمج الهـآيجـآك تبع التقارير ,,

الطريقة ..

كليك يمين على الملف ,,

وبعدين تشغيل كمسؤول أذا عربي

وأذا انجليزي

run as adimn​
 
توقيع : Corporation
بارك الله فيك أخي الكريم ..
وآسف لبعدي عن الجهازي
هذا التقرير بعدما طلبت كمسؤول :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:07:40 م, on 04/06/09
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Users\medoo\Desktop\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 3130 bytes
 
عودة
أعلى