الرجاء حل مشكلتي مع الاتورن بشكله الغريبة

[جارجور]

السلام عليكم

أخواني الكرام اصاب جهازي فيروس من الفلاش ميموري مع أنني عندي افضل الحمايات

الفيروس من فصيلة autorun

كل مجلد رئيسي في كل قرص يتحول الى ملف تطبيقي

امتداده exe

و يصبح تشغيل المجلد تلقائي


ارجو الحل
​

 

[SUL6AN]

ياخوي معناته انها مازالت متآصله بجهازك

عموما

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم

عطل برنامج الحمايه واستخدم اداة SmitfraudFix

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

​

​

بالتوفيق

 

[جارجور]

ComboFix 09-06-04.A1 - abujarad1900 06/07/2009 16:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.962.1033.18.255.15 [GMT 3:00]
Running from: f:\internet\AntiVirus\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files.exe
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\smartmgr.exe
C:\WINDOWS.exe
c:\windows\system\csrss.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-07 to 2009-06-07 )))))))))))))))))))))))))))))))
.

2009-06-07 13:27 . 2009-01-23 20:48 84992 ----a-w- C:\ComboFix.exe
2009-06-07 13:18 . 2009-06-07 13:18 17542 ----a-r- c:\documents and settings\abujarad1900\Application Data\Microsoft\Installer\{F830BBC2-9E28-4645-A366-78DCE8B23084}\_598A706DF23057C757C562.exe
2009-06-07 13:18 . 2009-06-07 13:18 17542 ----a-r- c:\documents and settings\abujarad1900\Application Data\Microsoft\Installer\{F830BBC2-9E28-4645-A366-78DCE8B23084}\_3992BBAAED1C17949B1D8B.exe
2009-06-07 13:18 . 2009-06-07 13:18 10134 ----a-r- c:\documents and settings\abujarad1900\Application Data\Microsoft\Installer\{F830BBC2-9E28-4645-A366-78DCE8B23084}\_50B93149EF1EFA18FFCEE6.exe
2009-06-07 13:18 . 2009-06-07 13:18 10134 ----a-r- c:\documents and settings\abujarad1900\Application Data\Microsoft\Installer\{F830BBC2-9E28-4645-A366-78DCE8B23084}\_26CE16CB35D68E117052B3.exe
2009-06-07 13:18 . 2009-06-07 13:18 -------- d-----w- c:\program files\ArpanTECH
2009-06-07 09:29 . 2009-01-23 20:48 84992 ----a-w- C:\Qoobox.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 ----a-w- C:\Golden Filter Pro.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 ----a-w- C:\Documents and Settings.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 ----a-w- C:\CC Get MAC Address.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 ----a-w- C:\BookmarksBar.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 ----a-w- C:\Autorun.inf.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 --sh--r- c:\windows\windowsxp.exe
2009-06-07 09:29 . 2009-01-23 20:48 84992 --sh--r- c:\windows\system\windows.exe
2009-06-06 16:19 . 2009-06-06 16:19 -------- d-----w- c:\program files\Obsidium Software Protection System
2009-06-06 16:14 . 2009-06-06 16:14 -------- d-----w- c:\program files\BreakPoint Software
2009-06-06 16:13 . 2009-06-06 18:27 -------- d-----w- c:\program files\UPX-iT
2009-06-05 22:12 . 2009-06-05 22:12 -------- d-----w- c:\program files\Java
2009-06-05 22:12 . 2009-06-05 22:12 152576 ----a-w- c:\documents and settings\abujarad1900\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-06-05 15:29 . 2009-06-06 18:24 -------- d-----w- c:\program files\No-IP
2009-06-05 10:00 . 2009-06-05 10:00 -------- d-----w- c:\documents and settings\abujarad1900\DoctorWeb
2009-06-04 10:18 . 2009-06-04 10:18 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Foxit
2009-06-04 10:17 . 2009-06-04 10:17 -------- d-----w- c:\program files\Foxit Software
2009-06-02 17:53 . 2009-06-02 18:07 -------- d-----w- c:\windows\system32\wcntrl
2009-06-02 17:53 . 2009-06-02 17:53 -------- d-----w- c:\windows\waleef
2009-06-02 10:14 . 2009-06-04 15:56 -------- d-sh--r- C:\CC Get MAC Address
2009-06-02 09:53 . 2009-06-02 09:57 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\eMuleTV
2009-06-01 23:08 . 2009-06-01 23:10 -------- d-----w- c:\program files\MyiQ
2009-06-01 15:37 . 2009-02-23 21:56 430080 ----a-w- c:\documents and settings\abujarad1900\u94.exe
2009-05-30 21:59 . 2009-05-30 21:59 24064 ----a-w- c:\documents and settings\abujarad1900\Application Data\Thinstall\SpeedConnect Internet Accelerator v.7.5\4000001600002i\ShowNetworkActivity.exe
2009-05-30 21:57 . 2009-05-30 21:57 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Thinstall
2009-05-30 21:26 . 2009-05-30 21:27 -------- d-----w- c:\program files\7-Zip
2009-05-30 20:41 . 2009-05-30 20:41 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Watermark Master
2009-05-30 20:38 . 2009-06-01 05:19 -------- d-----w- c:\program files\Videocharge Software
2009-05-26 18:01 . 2009-05-26 18:01 16299862 ------w- C:\Persi0.sys
2009-05-26 18:01 . 2009-05-26 18:01 -------- d-----w- c:\program files\Faronics
2009-05-26 14:25 . 2009-05-26 14:25 -------- d-----w- c:\program files\Common Files\xing shared
2009-05-26 14:24 . 2009-05-26 14:24 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-05-26 14:24 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-25 16:43 . 2009-05-27 06:57 -------- d-----w- c:\documents and settings\abujarad1900\Local Settings\Application Data\Sphere
2009-05-25 09:43 . 2009-05-25 09:43 -------- d-----w- c:\windows\system32\IOSUBSYS
2009-05-25 09:42 . 2009-05-28 20:17 -------- d-----w- c:\program files\Google
2009-05-25 08:36 . 2009-05-26 07:27 165232 ---ha-w- c:\documents and settings\abujarad1900\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll
2009-05-25 08:35 . 2009-05-27 06:55 -------- d-----w- c:\windows\system32\URTTemp
2009-05-24 19:26 . 2009-05-24 19:26 47232 ----a-w- c:\documents and settings\abujarad1900\Application Data\IDM\DwnlData\abujarad1900\global_mapper10_setup_237\global_mapper10_setup.exe
2009-05-24 06:09 . 2009-05-24 06:10 -------- d-----w- c:\documents and settings\3A30~1\Local Settings\Application Data\Adobe
2009-05-22 20:40 . 2009-05-22 20:40 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\GRSoftware
2009-05-21 10:03 . 2009-05-21 10:03 59040 ----a-w- c:\documents and settings\abujarad1900\Application Data\IDM\DwnlData\abujarad1900\hipadr_setup_185\hipadr_setup.exe
2009-05-21 09:22 . 2009-05-21 13:07 -------- d-----w- c:\program files\Hide Your IP Address
2009-05-21 03:41 . 2009-05-21 09:38 -------- d--h--w- c:\windows\$hf_mig$
2009-05-20 18:05 . 2002-01-05 12:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-05-20 11:07 . 2009-05-27 06:45 67645 ----a-w- c:\windows\system32\drivers\pshook11.sys
2009-05-20 11:07 . 2009-05-20 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\INAC
2009-05-20 11:07 . 2009-05-20 11:07 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\INAC
2009-05-20 11:07 . 2009-05-20 11:07 -------- d-----w- c:\program files\INAC
2009-05-19 12:36 . 2009-05-19 12:36 -------- d-----w- c:\documents and settings\3A30~1\Local Settings\Application Data\Yahoo
2009-05-19 09:26 . 2009-05-19 09:26 -------- d-----w- c:\windows\Midosoft Phone View
2009-05-19 08:14 . 2009-05-19 08:15 20480 --sha-w- c:\windows\0F4DA.exe
2009-05-19 03:49 . 2009-05-19 03:49 -------- d-----w- c:\program files\TGTSoft
2009-05-18 22:39 . 2009-05-18 22:39 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-05-18 22:32 . 2009-05-18 22:32 -------- d-----w- c:\program files\Profiler3D
2009-05-18 14:33 . 2009-05-28 19:08 5 ----a-w- c:\windows\system32\SySRMAC.dat
2009-05-18 14:32 . 2009-05-18 14:32 -------- d-----w- c:\program files\HiFisoftware
2009-05-18 06:58 . 2009-05-18 06:59 79753 ----a-w- c:\documents and settings\abujarad1900\Application Data\IDM\DwnlData\abujarad1900\CrossFire_Setup_v1011_112\CrossFire_Setup_v1011.exe
2009-05-18 04:59 . 2009-05-18 04:59 -------- d-----w- c:\documents and settings\abujarad1900\Bluetooth Software
2009-05-18 04:29 . 2009-05-18 04:29 -------- d-----w- c:\program files\WIDCOMM
2009-05-15 06:19 . 2009-05-15 06:19 -------- d-sh--w- c:\documents and settings\AUJARA~1\IETldCache
2009-05-15 06:19 . 2009-05-15 06:19 -------- d-sh--w- c:\documents and settings\A?UJARA?
2009-05-14 11:41 . 2009-05-14 11:42 -------- d-----w- c:\windows\ShellNew
2009-05-14 10:09 . 2009-05-14 10:09 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-05-13 19:29 . 2009-05-14 09:35 -------- d-----w- c:\windows\SxsCaPendDel
2009-05-13 18:29 . 2006-05-31 10:03 303104 ------w- c:\windows\system32\fppmon2.dll
2009-05-13 18:29 . 2006-05-30 10:30 118784 ------w- c:\windows\system32\fppr232.dll
2009-05-13 10:34 . 2009-05-14 16:14 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-05-13 09:25 . 2008-07-10 10:56 107864 ----a-w- c:\windows\system32\tsccvid.dll
2009-05-13 09:25 . 2009-05-30 20:41 -------- d-----w- c:\windows\system32\QuickTime
2009-05-12 18:17 . 2009-05-12 18:17 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\GrabPro
2009-05-12 13:34 . 2009-05-12 13:34 198064 ----a-w- c:\documents and settings\abujarad1900\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
2009-05-12 13:33 . 2009-05-21 12:02 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\IDM
2009-05-12 13:33 . 2009-06-07 13:27 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\DMCache
2009-05-12 13:33 . 2009-05-21 12:42 -------- d-----w- c:\program files\Internet Download Manager
2009-05-12 08:45 . 2009-05-12 08:45 -------- d-----w- c:\documents and settings\3A30~1\Local Settings\Application Data\Mozilla
2009-05-12 07:37 . 2009-05-12 07:37 192 ----a-w- c:\windows\system32\tbhi.dat
2009-05-12 07:37 . 2003-10-24 13:57 104968 ----a-w- c:\windows\system32\drivers\RapDrv.sys
2009-05-12 07:37 . 2003-10-24 14:01 139353 ----a-w- c:\windows\system32\blackdll.dll
2009-05-12 07:37 . 2003-10-20 11:34 157716 ----a-w- c:\windows\system32\drivers\blackdrv.sys
2009-05-11 18:52 . 2009-05-11 18:52 -------- d-----w- c:\documents and settings\abujarad1900\Local Settings\Application Data\Help
2009-05-11 15:39 . 2004-03-29 12:23 90112 ----a-w- c:\windows\unvise32.exe
2009-05-11 15:38 . 2009-05-11 15:39 -------- d-----w- c:\program files\SWiSHmax
2009-05-11 11:21 . 2009-06-06 18:27 -------- d-----w- c:\program files\Hotspot Shield
2009-05-11 07:41 . 2009-05-11 07:41 -------- d-----w- c:\documents and settings\abujarad1900\Local Settings\Application Data\Mozilla
2009-05-10 11:37 . 2009-05-10 11:37 -------- d-----w- c:\documents and settings\3A30~1\Local Settings\Application Data\WMTools Downloaded Files
2009-05-08 18:25 . 1999-03-15 13:39 212992 ----a-w- c:\windows\ALCHUNIN.EXE
2009-05-08 18:25 . 2009-05-08 18:29 -------- d-----w- c:\program files\Alchemy Mindworks
2009-05-08 18:25 . 2009-05-08 18:29 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Alchemy Mindworks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-06 18:35 . 2009-04-18 09:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-06-05 22:13 . 2009-05-02 17:12 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-28 20:25 . 2009-04-19 14:43 -------- d-----w- c:\program files\Real Alternative
2009-05-28 20:14 . 2009-04-12 19:24 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-27 06:52 . 2009-04-09 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith
2009-05-26 14:25 . 2009-04-14 14:25 -------- d-----w- c:\program files\Common Files\Real
2009-05-26 06:16 . 2009-04-09 21:05 2048 --s-a-w- c:\windows\bootstet.dat
2009-05-25 08:10 . 2009-04-10 06:37 -------- d-----w- c:\program files\Nokia
2009-05-22 08:35 . 2009-04-09 22:04 218304 ----a-w- c:\documents and settings\abujarad1900\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-22 05:58 . 2009-04-09 21:21 131836 ---ha-w- c:\windows\system32\mlfcache.dat
2009-05-22 05:51 . 2009-05-07 05:07 218304 ----a-w- c:\documents and settings\3A30~1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 11:36 . 2009-04-13 19:12 -------- d-----w- c:\program files\GreenBrowser
2009-05-21 08:30 . 2009-05-02 12:48 -------- d--h--r- c:\program files\rnamfler
2009-05-20 07:52 . 2009-04-18 09:10 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\skypePM
2009-05-13 19:24 . 2009-04-22 16:21 -------- d-----w- c:\program files\OpenOffice.org 3
2009-05-13 19:07 . 2009-04-09 21:10 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-13 19:04 . 2009-04-10 08:00 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Orbit
2009-05-13 18:38 . 2009-04-26 20:10 1 ----a-w- c:\documents and settings\abujarad1900\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-05-13 09:22 . 2009-04-09 21:50 -------- d-----w- c:\program files\TechSmith
2009-05-12 07:37 . 2009-04-09 21:10 10 ----a-w- c:\windows\system32\drivers\tmbi.sys
2009-05-08 12:56 . 2009-05-08 12:56 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-08 11:56 . 2009-04-20 07:32 -------- d-----w- c:\program files\Muslim Bag
2009-05-07 11:32 . 2009-04-09 20:46 359040 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-05-07 06:36 . 2009-05-07 06:36 -------- d-----w- c:\program files\Web Publish
2009-05-07 06:27 . 2009-05-07 06:27 2678 ----a-w- c:\windows\java\Packages\Data\ZB1JVJBL.DAT
2009-05-07 06:27 . 2009-05-07 06:27 2678 ----a-w- c:\windows\java\Packages\Data\COLJBL3R.DAT
2009-05-07 06:27 . 2009-05-07 06:27 2678 ----a-w- c:\windows\java\Packages\Data\GSX7TBR5.DAT
2009-05-07 06:27 . 2009-05-07 06:27 2678 ----a-w- c:\windows\java\Packages\Data\6DNFB5JB.DAT
2009-05-07 05:40 . 2009-05-07 05:40 -------- d-----w- c:\program files\Hewlett-Packard
2009-05-06 20:09 . 2009-05-06 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-06 20:06 . 2009-05-06 20:05 -------- d-----w- c:\program files\Yahoo!
2009-05-06 17:49 . 2009-05-06 17:31 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\TeamViewer
2009-05-05 11:27 . 2009-05-05 11:26 -------- d-----w- c:\program files\Safari
2009-05-03 15:02 . 2009-05-03 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\FaceOnBody
2009-05-03 08:03 . 2009-05-03 08:03 -------- d-----w- c:\program files\Zeallsoft
2009-05-02 12:53 . 2009-05-02 12:53 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-02 12:53 . 2009-05-02 12:53 362240 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-02 12:53 . 2009-05-02 12:53 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\TuneUp Software
2009-05-02 12:53 . 2009-05-02 12:50 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-02 12:51 . 2009-05-02 12:51 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-05-02 12:49 . 2009-05-02 12:49 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-01 13:05 . 2009-05-01 13:05 -------- d-----w- c:\program files\L-Tech
2009-04-26 20:07 . 2009-04-26 20:07 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\OpenOffice.org
2009-04-24 10:10 . 2009-04-24 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP
2009-04-22 16:58 . 2009-04-22 16:57 -------- d-----w- c:\program files\UltraISO
2009-04-22 16:58 . 2009-04-22 16:58 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-04-21 14:31 . 2009-04-21 14:31 -------- d-----w- c:\program files\DIFX
2009-04-20 11:40 . 2009-04-09 21:01 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-19 21:56 . 2009-04-19 21:48 -------- d-----w- c:\program files\USB Disk Security
2009-04-19 14:45 . 2009-04-19 14:44 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Media Player Classic
2009-04-18 09:10 . 2009-04-18 09:10 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-04-16 22:35 . 2009-04-15 23:34 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Nokia
2009-04-16 16:32 . 2009-04-16 16:14 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\GetRightToGo
2009-04-15 23:35 . 2009-04-15 23:35 -------- d-----w- c:\program files\ProxyShell
2009-04-15 23:34 . 2009-04-15 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-04-14 14:25 . 2009-04-14 14:25 -------- d-----w- c:\program files\Real
2009-04-14 11:51 . 2009-04-14 11:51 -------- d-----w- c:\program files\CaptureText.com
2009-04-13 18:53 . 2009-04-09 21:19 -------- d-----w- c:\documents and settings\abujarad1900\Application Data\Apple Computer
2009-04-12 20:28 . 2009-04-12 20:28 -------- d-----w- c:\program files\ElcomSoft
2009-04-10 06:36 . 2009-04-10 06:36 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-04-10 06:36 . 2009-04-10 06:36 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe
2009-04-10 06:36 . 2009-04-10 06:36 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe
2009-04-10 06:36 . 2009-04-10 06:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-04-09 21:49 . 2009-04-09 21:49 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-04-09 21:13 . 2009-04-09 21:13 -------- d-----w- c:\program files\ESET
2009-04-09 21:13 . 2009-04-09 21:13 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-04-09 21:10 . 2009-04-09 21:10 -------- d-----w- c:\program files\ISS
2009-04-09 21:09 . 2009-04-09 21:09 -------- d-----w- c:\program files\Common Files\InstallShield
2009-04-09 21:02 . 2009-04-09 21:02 -------- d-----w- c:\program files\microsoft frontpage
2009-04-09 20:59 . 2009-04-09 20:59 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-26 15:35 . 2009-04-03 13:24 210352 ----a-w- c:\windows\system32\idmmbc.dll
2009-01-23 20:48 . 2009-06-07 09:29 84992 --sh--r- c:\windows\windowsxp.exe
2009-01-23 20:48 . 2009-06-07 09:29 84992 --sh--r- c:\windows\system\windows.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-05_16.40.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-07 07:24 . 2009-06-07 07:24 16384 c:\windows\temp\Perflib_Perfdata_1f4.dat
+ 2004-08-04 12:02 . 2004-08-04 12:02 82432 c:\windows\system32\msxml4r.dll
+ 2004-08-04 12:02 . 2004-08-04 12:02 44544 c:\windows\system32\msxml4a.dll
+ 2009-06-05 22:14 . 2009-06-05 22:13 148888 c:\windows\system32\javaws.exe
+ 2009-06-05 22:14 . 2009-06-05 22:13 144792 c:\windows\system32\javaw.exe
+ 2009-06-05 22:14 . 2009-06-05 22:13 144792 c:\windows\system32\java.exe
+ 2004-08-04 12:02 . 2004-08-04 12:02 1233920 c:\windows\system32\msxml4.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-05-12 2794928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TextCapture"="c:\program files\CaptureText.com\Capture Text\CaptureText.exe" [2009-02-16 356352]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-09-23 798720]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-02 198160]
"c:\windows\system\windows.exe"="c:\windows\system\windows.exe" [2009-01-23 84992]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlackICE Server Protection.lnk - c:\program files\ISS\BlackICE\blackice.exe [2009-5-12 774144]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-10-9 610365]
Snagit 9.lnk - c:\program files\TechSmith\Snagit 9\Snagit32.exe [2009-1-22 7225672]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /k:C /k /k:E /k:F *

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^41616.exe.exe]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\41616.exe.exe
backup=c:\windows\pss\41616.exe.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^79B45.exe.exe]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\79B45.exe.exe
backup=c:\windows\pss\79B45.exe.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^958B7.exe.exe]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\958B7.exe.exe
backup=c:\windows\pss\958B7.exe.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^D22AD.exe.exe]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\D22AD.exe.exe
backup=c:\windows\pss\D22AD.exe.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^Google Chrome.lnk]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\Google Chrome.lnk
backup=c:\windows\pss\Google Chrome.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^Nokia PC Suite.lnk]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\Nokia PC Suite.lnk
backup=c:\windows\pss\Nokia PC Suite.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^Plax Network Suite.lnk]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\Plax Network Suite.lnk
backup=c:\windows\pss\Plax Network Suite.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^Torpark.lnk]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\Torpark.lnk
backup=c:\windows\pss\Torpark.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^abujarad1900^Start Menu^Programs^Startup^u94.lnk]
path=c:\documents and settings\abujarad1900\Start Menu\Programs\Startup\u94.lnk
backup=c:\windows\pss\u94.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Skype.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Skype.lnk
backup=c:\windows\pss\Skype.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"f:\\HkR\\البرامج\\superscan4\\SuperScan4.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009

R0 DeepFrz;DeepFrz;c:\windows\system32\drivers\DeepFrz.sys [11/02/2009 12:36 م 151192]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06/02/2009 02:23 م 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [06/02/2009 02:24 م 93336]
R2 BlackICE;BlackICE;c:\program files\ISS\BlackICE\blackd.exe [12/05/2009 10:37 ص 1211049]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06/02/2009 02:23 م 727720]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [02/05/2009 03:53 م 603904]
S3 DrvFltIp;DrvFltIp;\??\c:\program files\Plax Network Suite\DrvFltIp.sys --> c:\program files\Plax Network Suite\DrvFltIp.sys [?]
S3 RapDrv;RapDrv;c:\windows\system32\drivers\RapDrv.sys [12/05/2009 10:37 ص 104968]
S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [10/04/2009 12:10 ص 36644]
S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [10/04/2009 12:10 ص 24344]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [25/01/2008 12:12 م 25088]

--- Other Services/Drivers In Memory ---

*Deregistered* - Black

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-i:\الطيبة.exe - i:\الطيبة.exe
HKLM-Run-c:\windows\system\csrss.exe - c:\windows\system\csrss.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.microsoft.com
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.microsoft.com
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
IE: {{4C65C30D-7AE1-40B2-A01D-002672CA4CCE} - c:\program files\Pop up Blocker Pro\pdie.exe
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\documents and settings\abujarad1900\Application Data\Mozilla\Firefox\Profiles\povwtdsz.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - component: c:\documents and settings\abujarad1900\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-06-07 16:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(792)
c:\windows\system32\idmmbc.dll
.
Completion time: 2009-06-07 16:38
ComboFix-quarantined-files.txt 2009-06-07 13:37
ComboFix2.txt 2009-06-05 16:47

Pre-Run: 14,804,398,080 bytes free
Post-Run: 14,799,667,200 bytes free

324 --- E O F --- 2009-05-21 03:44

 

[SUL6AN]

اوقف عملية استعادة النظام



تم حذف مجموعه من الفايروسات
ولكن لابد من فحص الجهاز بالكامل

اذا كان النود فعال ومحدث افحص جهازك بواسطته
او قم بتثبيت الكاسبار وافحص جهازك ومن ثم ارفع لي تقرير الهيجااك

بالتوفيق

 

[جارجور]

النود محدث لتاريخ اليوم

جهازي لن أدخل له الكاسبر مهما كان

مشكوور

 

[SUL6AN]

النود محدث لتاريخ اليوم

جهازي لن أدخل له الكاسبر مهما كان

مشكوور

:cr:

اتمنــى لك التوووفيق

 

[جارجور]

طبعا لم تحل مشكلتي

لكن كيف لي ان أحذف النود32 من جهازي ثم اثبت الكاسبر

و كيف لي ان أحمل أكثر من 15 ميغا كيف لي أن اصبر على سرعة تحميل 10 كيلو بايت / ثانية

هل من إجابة؟

 

[SUL6AN]

طبعا لم تحل مشكلتي

لكن كيف لي ان أحذف النود32 من جهازي ثم اثبت الكاسبر

و كيف لي ان أحمل أكثر من 15 ميغا كيف لي أن اصبر على سرعة تحميل 10 كيلو بايت / ثانية

هل من إجابة؟

الاجابات عده لكن انت اقفلت المجــأل :i:
الغآلي MAAX سهــل العمليه
وعطانا اداة الكاسبــآر

حمل اداة الكاسبر من الرابط التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

بعد التحميل ،، دبل كلك وسيتم استخراج ملف الاداة الى مجلد بسطح المكتب لحظات وتبدأ الاداة بالعمل

تابع الشرح لفحص الجهاز وتنظيفه وارفاق التقرير

ثم قم بضغط التقرير ورفعه هنا>>>>

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[جارجور]

يا أخوي أنا حكيتلك سرعة التحميل عندي بطيئة

عكل حال بارك الله فيك