شاكه ان جهازي مخترق ....

قطرات الندى · 27 يونيو 2009

السلام عليكم ورحمة الله وبركاته ..

صديقتي تم سرقه بريدها ودخلت وحصلت شخص

توقعت انها صديقتي بس عرفت يوم تكلمت معه انه مو هي

وانه هكر وانه سرق البريد بسرعه حظرة البريد وحذفته

ولا ستقبلت منه اي شئ بس اللي خوفني اني يوم فحص الجهاز

بهيجاك طلع سليم بس برنامج هذا Symantec Security Check

حصلت نوافذ مفتوحه ونصدمت بقوووة

الله يخليكم ساعدوني ...؟؟

هذا تقرير بس ماذكر اي من البرامج الفحص اللي عملتها

BitDefender QuickScan Beta v0.9.4.6
-----------------------------------
Scan date: Sat Jun 27 00:22:12 2009
Machine ID: ECFA002F

Scan failed! Couldn't access QuickScan server.
-----------------------------------------------

Processes
---------
<verified> WLLoginProxy.exe 1988 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
<verified> RealNetworks Scheduler 928 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
<verified> GoogleToolbarNotifier 124 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
<verified> Internet Explorer 1008 C:\Program Files\Internet Explorer\iexplore.exe
<verified> RealPlayer 3760 C:\Program Files\Real\RealPlayer\RealPlay.exe
<verified> Windows Explorer 1664 C:\WINDOWS\Explorer.EXE
<verified> Application Layer Gateway Service 2848 C:\WINDOWS\System32\alg.exe
<verified> Client Server Runtime Process 1160 C:\WINDOWS\system32\csrss.exe
<verified> CTF Loader 1004 C:\WINDOWS\system32\ctfmon.exe
<verified> LSA Shell (Export Version) 1240 C:\WINDOWS\system32\lsass.exe
<verified> ‎‎Services and Controller app 1228 C:\WINDOWS\system32\services.exe
<verified> Windows NT Session Manager 1056 C:\WINDOWS\System32\smss.exe
<verified> Spooler SubSystem App 372 C:\WINDOWS\system32\spoolsv.exe
<verified> Generic Host Process for Win32 Services 524 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1072 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1132 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1400 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1488 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1684 C:\WINDOWS\System32\svchost.exe
<verified> Generic Host Process for Win32 Services 1820 C:\WINDOWS\system32\svchost.exe
<verified> Windows NT Logon Application 1184 C:\WINDOWS\system32\winlogon.exe
<verified> Windows Update Automatic Updates 2092 C:\WINDOWS\system32\wuauclt.exe

Autoruns and critical files
---------------------------
<verified> RealNetworks Scheduler C:\Program Files\Common Files\Real\Update_OB\realsched.exe
<verified> GoogleToolbarNotifier C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
<verified> kldialhk C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll
<verified> Kaspersky Anti-Virus C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
<verified> Kaspersky OE plugin loader C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\kloehk.dll
<verified> Mozilla 3 Virtual Keyboard C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll
<verified> Mozilla 2 Virtual Keyboard C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll
<verified> Crypto API32 C:\WINDOWS\system32\CRYPT32.dll
<verified> Crypto Network Related API C:\WINDOWS\system32\cryptnet.dll
<verified> Offline Network Agent C:\WINDOWS\System32\CSCDLL.dll
<verified> CTF Loader C:\WINDOWS\system32\ctfmon.exe
<verified> igfxdev Module C:\WINDOWS\system32\igfxdev.dll
<verified> Logon Visualizer C:\WINDOWS\system32\klogon.dll
<verified> ‎‎Windows Logon UI C:\WINDOWS\system32\logonui.exe
<verified> Microsoft Windows Sockets 2.0 Service Provider C:\WINDOWS\System32\mswsock.dll
<verified> OGAVerify.exe C:\WINDOWS\system32\OGAVerify.exe
<verified> Microsoft Windows Rsvp 1.0 Service Provider C:\WINDOWS\system32\rsvpsp.dll
<verified> Secondary Logon Service Notification DLL C:\WINDOWS\system32\sclgntfy.dll
<verified> LDAP RnR Provider DLL C:\WINDOWS\System32\winrnr.dll
<verified> Common DLL to receive Winlogon notifications C:\WINDOWS\system32\WlNotify.dll
<verified> Windows Sockets Helper DLL C:\WINDOWS\system32\wshbth.dll

Browser plugins
---------------
<unsigned> RealJukebox Netscape Plugin C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
<unsigned> 6.0.12.69 C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
<unsigned> ipsupd.dll C:\WINDOWS\Downloaded Program Files\ipsupd.dll
<unsigned> BitDefender Online Scanner C:\WINDOWS\Downloaded Program Files\oscan82.ocx
<verified> WindowsLiveLogin.dll C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
<verified> Fast Search C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
<verified> Google Toolbar C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
<verified> GoogleToolbarNotifier C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
<verified> IE Virtual Keyboard C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
<verified> Windows Messenger C:\Program Files\Messenger\msmsgs.exe
<verified> Panda ActiveScan 2.0 Plugin for Firefox C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll
<verified> RealPlayer(tm) LiveConnect-Enabled Plug-In C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
<verified> RealPlayer Download and Record Plugin C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
<verified> bdoscandel.exe C:\WINDOWS\bdoscandel.exe
<verified> BitDefender QuickScan Client ActiveX C:\WINDOWS\Downloaded Program Files\ActiveQscan.ocx
<verified> Panda ActiveScan 2.0 Stub Library C:\WINDOWS\Downloaded Program Files\as2stubie.dll
<verified> Adobe® Flash® Player ActiveX Installer C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
<verified> Shell Doc Object and Control Library C:\WINDOWS\system32\SHDOCVW.dll

Missing files
-------------
File not found: C:\Program Files\Yahoo!\Common\npyaxmpb.dll
referenced in: HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1\"Path"
File not found: WgaLogon.dll
referenced in: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\"DllName"

Scan
----

Corporation · 27 يونيو 2009

أنتي سوي تقرير هايجـآك اشوفة انا

حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شغل البرنامج ==> واضغط على
Do a system scan and save log
لحظات .. ويظهر لك تقرير داخل المفكرة==> انسخه والصقه بردك القادم

قطرات الندى · 27 يونيو 2009

شكرا على الرد السريع أخوي

هذا التقرير

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:09:47 ص, on 27/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) -