هذا تقرير جهازى هل هوا سليم ارجوكم الرد

[amr_king]

BitDefender QuickScan Beta 0.9.4.4 - Jun 7 2009, 21:53:54
----------------------------------------------------------------
Scan date/time: Mon Jun 08 01:27:18 2009
Machine ID: B4002BED

No infection found.
-------------------

Processes
---------
<unsigned> Internet Explorer 612 C:\Program Files\Internet Explorer\iexplore.exe
<unsigned> TopDesk 1.4.1 1700 C:\Program Files\TopDesk\topdesk.exe
<unsigned> Windows Explorer 1528 C:\WINDOWS\Explorer.EXE
<unsigned> ObjectDock 1868 C:\WINDOWS\system32\Effects\ObjectDock.exe
<unsigned> TrueTransparency.exe 1876 C:\WINDOWS\system32\Effects\TrueTransparency.exe
<unsigned> ViStart.exe 1948 C:\WINDOWS\system32\Effects\ViStart.exe
<unsigned> Attach drop shadow to windows. 1964 C:\WINDOWS\system32\Effects\YzShadow.exe
<unsigned> Visual Task Tips 1836 C:\Windows\system32\VisualTask\VisualTask.exe
<unsigned> Automatic Updates 1444 C:\WINDOWS\system32\wuauclt.exe
<verified> WMI 1684

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

<verified> Realtek HD Audio Control Panel 1760 C:\WINDOWS\RTHDCPL.EXE
<verified> Application Layer Gateway Service 1508 C:\WINDOWS\System32\alg.exe
<verified> Client Server Runtime Process 664 C:\WINDOWS\system32\csrss.exe
<verified> CTF Loader 1828 C:\WINDOWS\system32\ctfmon.exe
<verified> hkcmd Module 1724 C:\WINDOWS\system32\hkcmd.exe
<verified> persistence Module 1736 C:\WINDOWS\system32\igfxpers.exe
<verified> igfxTray Module 1716 C:\WINDOWS\system32\igfxtray.exe
<verified> LSA Shell (Export Version) 744 C:\WINDOWS\system32\lsass.exe
<verified> Services and Controller app 732 C:\WINDOWS\system32\services.exe
<verified> Windows NT Session Manager 592 C:\WINDOWS\System32\smss.exe
<verified> Spooler SubSystem App 1592 C:\WINDOWS\system32\spoolsv.exe
<verified> Generic Host Process for Win32 Services 900 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 976 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1072 C:\WINDOWS\System32\svchost.exe
<verified> Generic Host Process for Win32 Services 1116 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1204 C:\WINDOWS\system32\svchost.exe
<verified> Windows NT Logon Application 688 C:\WINDOWS\system32\winlogon.exe

Autoruns and critical files
---------------------------
c:\program files\topdesk\topdesk.exe
c:\windows\alcmtr.exe
c:\windows\rthdcpl.exe
c:\windows\skytel.exe
c:\windows\system32\crypt32.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\ctfmon.exe
c:\windows\system32\effects\objectdock.exe
c:\windows\system32\effects\truetransparency.exe
c:\windows\system32\effects\vistart.exe
c:\windows\system32\effects\yzshadow.exe
c:\windows\system32\hkcmd.exe
c:\windows\system32\igfxdev.dll
c:\windows\system32\igfxpers.exe
c:\windows\system32\igfxtray.exe
c:\windows\system32\logonui.exe
c:\windows\system32\mswsock.dll
c:\windows\system32\rsvpsp.dll
c:\windows\system32\sclgntfy.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\wlnotify.dll

Browser plugins
---------------
c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
c:\program files\yahoo!\companion\installs\cpn\ycomp5_6_0_1.dll
c:\windows\downloaded program files\activeqscan.ocx
c:\windows\system32\shdocvw.dll
Restored * association - HKCR\*\shell\open\command
Missing files
-------------
File not found: Windows\\system32\\VisualTask\\VisualTask.exe
referenced in: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\"VisualTask"

Scan
----
The following file(s) must be uploaded for server-side scanning:
C:\WINDOWS\system32\Effects\ViStart.exe
Upload started - 1 file(s)
Upload: C:\WINDOWS\system32\Effects\ViStart.exe - 376832 bytes, hash: e28522a0ca75d7c3961da21995e0e346
Upload speed - 4 KB/s
Upload finished - 1 uploaded, 0 failed
The uploaded file(s) were found clean.

 

[algnral]

كل شوي منزل موضوع تابع مواضيعك طيب

 

[amr_king]

انا معتش عاوز المواضيع التانية ارجو لو سمحت الرد على هذا الموضوع

 

[amr_king]

هذا تقرير ثانى ارجو رد يا جماعة جهازى سليم ولا ايه

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:51:52 صباحاً, on 08/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Windows\system32\VisualTask\VisualTask.exe
C:\WINDOWS\system32\Effects\ObjectDock.exe
C:\WINDOWS\system32\Effects\ViStart.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MEDO 2009\Desktop\Zyzoom.org_Tool_V_1.0.exe
C:\DOCUME~1\MEDO20~1\LOCALS~1\Temp\zyaoom Tool\Hijack.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ( MISHO )
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [VisualTask] Windows\\system32\\VisualTask\\VisualTask.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [VisualTask] Windows\\system32\\VisualTask\\VisualTask.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ViStart.lnk = C:\WINDOWS\system32\Effects\ViStart.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O16 - DPF: {E001C731-5E37-4538-A5CB-8168736A2360} (ActiveQscan Control) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

--
End of file - 2823 bytes

 

[amr_king]

ارجوكم ردم يا جماعة انا عاوز انام

 

[amr_king]

حسبى الله ونعم الوكيل