[تم حل المشكلة]مشكلتي كل مالها تزود [فيس حزين] الشاشه تجمد ولاعاد تسوي شي

[عشقي عيونه]

سلام عليكم :er:

بدخل على طول :f:
والله انا من متابعين منتداكم
ويوم طلعت ذي المشكله لي ماجا في بالي غيركم :er:

مشلكتي انو اشغل الجهاز عادي بس فجأه توقف الشاشه تثبت مدري تجمد :er:
وقسم تقهر :er:
مايشتغل الا اداره المهام اطلعها بكترل + شفت +ديليت
بعدها اسكر كل شي بها واسوي ايقاف تشغيل
بعدها يطلع لي يقول حدث مشكله الاكسبلورو اا اخترت انهاء سوف تفقد معلومات واو ارجع لتصحيح المشكله او انهاء الان انا احط انهاء الان لان لو رجعت مايرجعني معلقه :er::f:
بعدين ارجع افتحه ويشتغل بس اوقات ترجع المشكله على طول واوقات لا تجلس ساعه او نص ساعه :er:
والله تقهر :er:





بليز اللي يعرف لايبخل علي :er:
انتظظظظظظظركم وترا المشكله كل مالها تزود :er:

 

[البارون]

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم
​

 

[عشقي عيونه]

هذا هو


ComboFix 09-07-14.08 - User 07/18/2009 0:28.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1025.18.2038.1614 [GMT 3:00]
Running from: c:\documents and settings\User\سطح المكتب\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090717-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Application Data\ShoppingReport
c:\documents and settings\User\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\User\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\User\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\User\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\User\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\User\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\User\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
c:\documents and settings\User\patch.exe
c:\program files\ShoppingReport
c:\windows\system32\kakle.dll

.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.

2009-07-17 16:45 . 2009-07-17 16:45 -------- d-----w- c:\documents and settings\User\Application Data\Sereniti
2009-07-15 22:50 . 2009-07-15 22:50 -------- d-----w- c:\windows\system32\wbem\Repository
2009-07-14 14:36 . 2009-07-14 14:36 -------- d-----w- c:\program files\VS Revo Group
2009-07-14 14:36 . 2009-07-14 14:36 -------- d-----w- c:\documents and settings\LocalService\قائمة ابدأ
2009-07-14 14:35 . 2009-07-14 14:36 -------- d-----w- c:\program files\Opera 10 Beta
2009-07-14 04:09 . 2009-07-14 14:35 -------- d-----w- c:\program files\Invisible Browsing
2009-07-13 21:24 . 2009-02-17 10:32 2937720 ----a-w- c:\documents and settings\User\Application Data\Simply Super Software\Trojan Remover\ifq4.exe
2009-07-13 17:38 . 2009-03-24 13:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-13 15:36 . 2009-07-13 15:36 -------- d-----w- c:\program files\Opera
2009-07-13 15:35 . 2009-07-13 15:35 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Opera
2009-07-12 21:20 . 2009-07-14 14:35 -------- d-----w- c:\program files\Hide IP NG
2009-07-11 17:48 . 2009-07-14 14:36 -------- d-----w- c:\program files\SpyRemover
2009-07-08 15:02 . 2009-07-14 14:35 -------- d-----w- c:\program files\Hide Your IP Address
2009-07-08 01:34 . 2009-02-17 10:32 2937720 ----a-w- c:\documents and settings\User\Application Data\Simply Super Software\Trojan Remover\gnoF.exe
2009-07-01 14:33 . 2009-07-01 14:33 -------- d-----w- c:\program files\Common Files\xing shared
2009-06-29 15:31 . 2009-07-12 21:20 -------- d-----w- c:\documents and settings\User\Application Data\Hide IP NG
2009-06-26 19:46 . 2009-06-26 19:46 -------- d--h--w- c:\windows\PIF
2009-06-23 15:35 . 2009-07-13 21:25 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-23 15:35 . 2005-08-25 21:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2009-06-23 15:35 . 2006-06-19 09:01 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2009-06-23 15:35 . 2006-05-25 11:52 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2009-06-23 15:35 . 2003-02-02 16:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2009-06-23 15:35 . 2002-03-05 21:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2009-06-23 15:34 . 2009-06-23 15:35 -------- d-----w- c:\program files\Trojan Remover
2009-06-23 15:34 . 2009-06-23 15:34 -------- d-----w- c:\documents and settings\User\Application Data\Simply Super Software
2009-06-23 15:34 . 2009-06-23 15:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-06-21 22:49 . 2009-06-21 22:49 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Identities
2009-06-19 16:08 . 2009-07-17 01:34 -------- d-----w- c:\program files\Gabest

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 21:27 . 2009-06-05 00:52 -------- d-----w- c:\documents and settings\User\Application Data\DMCache
2009-07-17 20:59 . 2001-09-19 12:00 63512 ----a-w- c:\windows\system32\perfc001.dat
2009-07-17 20:59 . 2001-09-19 12:00 340394 ----a-w- c:\windows\system32\perfh001.dat
2009-07-17 19:44 . 2009-05-25 18:29 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-07-17 19:27 . 2009-06-05 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-07-17 19:06 . 2009-06-03 16:43 -------- d-----w- c:\documents and settings\User\Application Data\Comodo
2009-07-17 19:06 . 2009-06-03 16:42 -------- d-----w- c:\program files\COMODO
2009-07-17 01:51 . 2009-05-25 17:57 -------- d-----w- c:\documents and settings\User\Application Data\uTorrent
2009-07-14 14:36 . 2009-05-25 17:58 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-12 15:37 . 2009-06-05 00:52 -------- d-----w- c:\documents and settings\User\Application Data\IDM
2009-07-04 00:43 . 2009-05-25 17:58 -------- d-----w- c:\program files\uTorrent
2009-07-01 14:33 . 2009-05-25 17:56 -------- d-----w- c:\program files\Common Files\Real
2009-06-26 23:53 . 2009-05-25 17:56 173176 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 01:15 . 2009-05-27 15:44 -------- d-----w- c:\program files\Google
2009-06-21 23:31 . 2009-05-27 22:41 -------- d-----w- c:\program files\Hotspot Shield
2009-06-21 23:27 . 2009-05-27 22:49 -------- d-----w- c:\program files\Conduit
2009-06-21 23:27 . 2009-05-27 22:49 -------- d-----w- c:\program files\Hotspot_Shield
2009-06-16 14:53 . 2004-08-03 21:55 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:53 . 2001-09-19 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-08 19:37 . 2009-06-08 19:37 -------- d-----w- c:\program files\SuperBladePro
2009-06-08 16:30 . 2009-06-08 16:30 -------- d-----w- c:\program files\Lokas
2009-06-08 16:30 . 2009-06-02 15:35 44544 ------w- c:\windows\AWuninstall.exe
2009-06-05 11:59 . 2009-06-04 23:02 -------- d-----w- c:\program files\Anti Trojan Elite
2009-06-05 00:52 . 2009-06-05 00:52 165296 ----a-w- c:\documents and settings\User\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
2009-06-05 00:51 . 2009-06-05 00:51 -------- d-----w- c:\program files\Internet Download Manager
2009-06-03 19:25 . 2004-08-03 21:55 1288704 ----a-w- c:\windows\system32\quartz.dll
2009-06-03 18:05 . 2009-06-03 15:18 -------- d-----w- c:\program files\MessengerDiscovery
2009-06-03 16:57 . 2009-06-03 16:57 -------- d-----w- c:\program files\AskSBar
2009-06-03 15:39 . 2009-06-03 15:39 -------- d-----w- c:\program files\Alwil Software
2009-06-03 01:44 . 2009-06-03 01:44 0 ----a-w- c:\windows\system32\cd.dat
2009-06-02 00:59 . 2009-06-02 15:32 24520 ----a-w- c:\windows\Fonts\CaptainPodd.ttf
2009-05-31 16:57 . 2009-05-31 16:57 -------- d-----w- c:\documents and settings\User\Application Data\CyberLink
2009-05-31 15:06 . 2009-05-31 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\DFX
2009-05-30 18:46 . 2009-05-27 19:47 5 ----a-w- c:\windows\system32\SySMP3CutJoin.dat
2009-05-29 22:49 . 2009-05-29 22:49 127 ----a-w- c:\documents and settings\User\Local Settings\Application Data\fusioncache.dat
2009-05-29 22:49 . 2009-05-29 22:49 2678 ----a-w- c:\windows\java\Packages\Data\GSXJDBRV.DAT
2009-05-29 22:49 . 2009-05-29 22:49 2678 ----a-w- c:\windows\java\Packages\Data\YWTNNRD3.DAT
2009-05-29 22:49 . 2009-05-29 22:49 2678 ----a-w- c:\windows\java\Packages\Data\LV9Z93FJ.DAT
2009-05-29 22:49 . 2009-05-29 22:49 2678 ----a-w- c:\windows\java\Packages\Data\CTN5JVFJ.DAT
2009-05-29 22:49 . 2009-05-29 22:49 2678 ----a-w- c:\windows\java\Packages\Data\8IVTBHBD.DAT
2009-05-28 00:01 . 2009-05-28 00:01 -------- d-----w- c:\program files\MSXML 4.0
2009-05-27 22:28 . 2003-03-18 17:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-05-27 19:39 . 2009-05-27 19:39 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2009-05-27 19:39 . 2009-05-27 19:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-27 18:20 . 2009-05-27 18:20 -------- d-----w- c:\program files\SWiSHmax
2009-05-27 18:13 . 2009-05-27 18:13 -------- d-----w- c:\program files\Common Files\SWiSHzone.com
2009-05-27 17:15 . 2009-05-27 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-05-27 17:15 . 2009-05-27 15:46 -------- d-----w- c:\program files\NOS
2009-05-27 15:47 . 2009-05-27 15:47 75376 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\sgc15.exe
2009-05-27 14:52 . 2009-05-27 14:51 -------- d-----w- c:\documents and settings\User\Application Data\Media Player Classic
2009-05-27 13:47 . 2009-05-27 12:47 -------- d-----w- c:\program files\Common Files\BitDefender
2009-05-27 13:46 . 2009-05-26 13:44 -------- d-----w- c:\program files\BitDefender
2009-05-27 13:27 . 2009-05-27 13:27 192512 ----a-w- c:\windows\system32\txmlutil.dll
2009-05-26 18:19 . 2009-05-25 16:48 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-26 14:12 . 2009-05-25 17:58 -------- d-----w- c:\program files\Circle Developement
2009-05-26 12:03 . 2009-05-26 12:03 -------- d-----w- c:\documents and settings\User\Application Data\GRETECH
2009-05-25 23:02 . 2009-05-25 23:02 -------- d-----w- c:\documents and settings\User\Application Data\ACD Systems
2009-05-25 20:06 . 2009-05-25 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-25 19:29 . 2009-05-25 19:29 -------- d-----w- c:\documents and settings\All Users\Application Data\TOSHIBA
2009-05-25 19:25 . 2009-05-25 17:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-25 19:24 . 2009-05-25 19:20 -------- d-----w- c:\program files\Toshiba
2009-05-25 19:18 . 2009-05-25 19:18 -------- d-----w- c:\program files\CONEXANT
2009-05-25 18:29 . 2009-05-25 18:29 -------- d-----w- c:\program files\AVG
2009-05-25 18:20 . 2009-05-25 18:18 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-25 18:17 . 2009-05-25 17:54 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-25 18:09 . 2009-05-25 18:09 -------- d-----w- c:\program files\Common Files\L&H
2009-05-25 18:09 . 2009-05-25 18:09 -------- d-----w- c:\program files\Microsoft.NET
2009-05-25 18:09 . 2009-05-25 18:09 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-05-25 18:09 . 2009-05-25 18:09 -------- d-----w- c:\program files\Microsoft Works
2009-05-25 18:02 . 2009-05-25 18:02 2232 ----a-w- c:\windows\java\Packages\Data\PB71B3N9.DAT
2009-05-25 18:02 . 2009-05-25 18:02 155995 ----a-w- c:\windows\java\Packages\WN7LF31N.ZIP
2009-05-25 18:00 . 2009-05-25 18:00 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-05-25 18:00 . 2009-05-25 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems
2009-05-25 18:00 . 2009-05-25 18:00 -------- d-----w- c:\program files\ACD Systems
2009-05-25 17:58 . 2009-05-25 17:58 -------- d-----w- c:\program files\Nero
2009-05-25 17:58 . 2009-05-25 17:58 -------- d-----w- c:\program files\Windows Live
2009-05-25 17:57 . 2009-05-25 17:57 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-05-25 17:57 . 2009-05-25 17:56 -------- d-----w- c:\program files\Real
2009-05-25 17:56 . 2009-05-25 17:56 90112 ----a-w- c:\windows\system32\agsaami.dll
2009-05-25 17:56 . 2009-05-25 17:56 610304 ----a-w- c:\windows\system32\agsaamg.dll
2009-05-25 17:56 . 2009-05-25 17:56 2535424 ----a-w- c:\windows\system32\agsaamj.dll
2009-05-25 17:56 . 2009-05-25 17:56 1986560 ----a-w- c:\windows\system32\akll.dll
2009-05-25 17:56 . 2009-05-25 17:56 1245184 ----a-w- c:\windows\system32\bkll.dll
2009-05-25 17:56 . 2009-05-25 17:56 1212416 ----a-w- c:\windows\system32\ckll.dll
2009-05-25 17:56 . 2009-05-25 17:56 372736 ----a-w- c:\windows\system32\agsaamc.dll
2009-05-25 17:56 . 2009-05-25 17:56 -------- d-----w- c:\program files\Real_SC
2009-05-25 17:56 . 2009-05-25 17:56 -------- d-----w- c:\program files\Nokia
2009-05-25 17:56 . 2009-05-25 17:56 -------- d-----w- c:\program files\Common Files\Nokia
2009-05-25 17:55 . 2009-05-25 17:55 -------- d-----w- c:\program files\mpegable
2009-05-25 17:55 . 2009-05-25 17:55 47104 ------w- c:\windows\AKDeInstall.exe
2009-05-25 17:55 . 2009-05-25 17:55 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-05-25 17:54 . 2009-05-25 17:54 -------- d-----w- c:\program files\CyberLink
2009-05-25 17:54 . 2009-05-25 17:54 -------- d-----w- c:\program files\GRETECH
2009-05-25 16:48 . 2009-05-25 16:48 -------- d-----w- c:\program files\microsoft frontpage
2009-05-25 16:45 . 2009-05-25 16:45 22144 ----a-w- c:\windows\system32\emptyregdb.dat
2009-05-07 15:42 . 2004-08-03 21:55 344064 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:51 . 2004-08-03 21:55 657920 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:51 . 2009-05-29 22:47 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 20:08 . 2004-08-03 21:46 1846528 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2009-06-03 16:57 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-08-16 5728112]
"IDMan"="c:\documents and settings\User\سطح المكتب\IDMan.exe" [2008-09-15 2606512]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-25 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-09-18 29696]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-09-29 49152]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2008-12-19 83336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\çں‍ê، ں*§ڑ\ںé*©ںê¤\*§ک ں颬نïé\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-12-18 2360648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\COMODO\Css\cssdll32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [03/06/2009 06:40 م 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03/06/2009 06:40 م 20560]
S2 gupdate1c9df1a4fbfabf8;خدمة تحديث Google (gupdate1c9df1a4fbfabf8);c:\program files\Google\Update\GoogleUpdate.exe [28/05/2009 01:27 ص 133104]
S3 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-07-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 22:27]

2009-07-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 22:27]

2009-07-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1547161642-725345543-1003Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-25 01:22]

2009-07-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1547161642-725345543-1003UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-25 01:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
IE: Download all links with IDM - c:\documents and settings\User\سطح المكتب\IEGetAll.htm
IE: Download FLV video content with IDM - c:\documents and settings\User\سطح المكتب\IEGetVL.htm
IE: Download with IDM - c:\documents and settings\User\سطح المكتب\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} -
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-07-18 00:30
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\TEMP\Perflib_Perfdata_b60.dat 16384 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3e501d97-8d0f-4ef7-9554-f73ad80d7949}]
@Denied: (Full) (Everyone)
"Model"=dword:000000b8
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,d0,7b,bf,de,1a,d8,54,ad,46,8f,3c,f2,5c,68,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):44,f8,d0,c8,35,85,20,c9,ad,bd,65,a9,27,6c,bc,96,f0,54,32,11,86,
c8,2b,f4,78,08,a0,e1,03,91,4e,78,23,2d,95,5b,a2,24,7a,04,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(608)
c:\progra~1\Comodo\Css\cssdll32.dll

- - - - - - - > 'lsass.exe'(668)
c:\progra~1\Comodo\Css\cssdll32.dll
.
Completion time: 2009-07-17 0:31
ComboFix-quarantined-files.txt 2009-07-17 21:31

Pre-Run: 59,928,227,840 bytes free
Post-Run: 59,984,805,888 bytes free

253 --- E O F --- 2009-07-17 20:14

 

[البارون]

تقرير هايجاك جديد

 

[عشقي عيونه]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:55 ص, on 18/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\My Documents\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\User\سطح المكتب\IDMan.exe /onboot
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\User\سطح المكتب\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: خدمة تحديث Google (gupdate1c9df1a4fbfabf8) (gupdate1c9df1a4fbfabf8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O24 - Desktop Component 0: الصفحة الرئيسية الحالية - About:Home

--
End of file - 6858 bytes

 

[البارون]

قفل استعادة النظام

ثم

تحميل برنامج المكافي
فحص جميع ملفات الجهاز عن الفيروسات بجميع أنواعها

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

تقرير الاداة حيكون في مجلد السي باسم noor




قم بضغط الملف >>>

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وارفعه على موقع الرفع التالي وارفقه بمشاركتك القادمة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[عشقي عيونه]

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

تاخرت عشان التحميل والفحص :f::cr:

 

[البارون]

مضبوط تم حذف اصابتين من السي

تقرير هايجاك جديد
​

 

[عشقي عيونه]

صدق :?:




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:29:29 ص, on 18/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Adobe\Photoshop CS\Photoshop.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\User\My Documents\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\User\سطح المكتب\IDMan.exe /onboot
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\User\سطح المكتب\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: خدمة تحديث Google (gupdate1c9df1a4fbfabf8) (gupdate1c9df1a4fbfabf8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O24 - Desktop Component 0: الصفحة الرئيسية الحالية - About:Home

--
End of file - 6909 bytes

 

[البارون]

هذي الاصابات اللي تم حذفها بالبرنامج

:\Program Files\Hide Your IP Address\hide.your.ip.address.1.0-patch.exe ... Found the Generic.dx trojan !!!
The file or process has been deleted.
C:\Program Files\Real_SC\opt.exe ... Found the W32/Sdbot.worm virus !!!
The file or process has been deleted.

 

[AbOdy]

يعطيك العافية يا الغالي البارون

موجود لوقت الضروره ولاهنت حبيبي

 

[عشقي عيونه]

تسلم تسلم

يعني اللحين خلاص
طيب ايش اركب من الحمايه

 

[البارون]

R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL



O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\Shdocvw.dll



طريقة الحذف

=====================================

استخدم هذه الاداة للتنظيف

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وبعدين تقرير هايجاك جديد

 

[البارون]

حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ثبته على الجهاز ،، ثم شغله واعمل كما الشرح التالي لفحص الجهاز وعمل تقرير

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وبعد انتهاء الفحص اعمل التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

انسخ ما بداخل التقرير والصقه بمشاركتك القادمة​

 

[عشقي عيونه]

تقرير البرنامح

Malwarebytes' Anti-Malware 1.39
نسخة قاعدة البيانات: 2421
Windows 5.1.2600 Service Pack 2

18/07/2009 04:02:46 ص
mbam-log-2009-07-18 (04-02-46).txt

نوع البحث: بحث شامل (C:\|D:\|)
تم فحص: 146277
الوقت المنقضى: 27 minute(s), 4 second(s)

عمليات الذاكرة المصابة: 0
وحدات الذاكرة المصابة: 0
مفاتيح التسجيل المصابة: 3
قيم التسجيل المصابة: 1
بيانات التسجيل المصابة: 0
مجلدات مصابة: 0
ملفات مصابة: 2

عمليات الذاكرة المصابة:
(لم يتم الكشف عن أية عناصر ضارة)

وحدات الذاكرة المصابة:
(لم يتم الكشف عن أية عناصر ضارة)

مفاتيح التسجيل المصابة:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

قيم التسجيل المصابة:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

بيانات التسجيل المصابة:
(لم يتم الكشف عن أية عناصر ضارة)

مجلدات مصابة:
(لم يتم الكشف عن أية عناصر ضارة)

ملفات مصابة:
c:\documents and settings\User\favorites\FREE PORN TV.url (Rogue.Link) -> Quarantined and deleted successfully.
c:\documents and settings\User\سطح المكتب\SpyRemover.lnk (Rogue.SpyRemover) -> Quarantined and deleted successfully.








والهايجاك

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:31:33 ص, on 18/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\User\سطح المكتب\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\My Documents\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\User\سطح المكتب\IDMan.exe /onboot
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\User\سطح المكتب\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: خدمة تحديث Google (gupdate1c9df1a4fbfabf8) (gupdate1c9df1a4fbfabf8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O24 - Desktop Component 0: الصفحة الرئيسية الحالية - About:Home

--
End of file - 7033 bytes

 

[AbOdy]

لأكمال الموضوع

ضعي القيم في مستند ثم اغلقي المتصفح

ثم حددي القيم واحذفيها

R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\ swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O24 - Desktop Component 0: الصفحة الرئيسية الحالية - About:Home


طريقه الحذف

​

​

بعدها اذهب الى اضافة وازالة البرامج واحذف التولبار الموجود عندك (toolbar)>> ممكن ما يكون موجود​

ثم نزل هذه الاداة واتبع الشرح التالي​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط ​

شرح الاستخدام ,,,,,,
دبل كلك على الاداة واصبر حتى تنتهي جميع النوافذ وتقف عند هذه النافذة​

​

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))


وبس تخلصي من عمل المطلوب اعملي التالي

حمل هذه الاداة ,,
واتبع الشرح التالي ,, لتنظيف جهازك من هذه الدعايات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,

رابط تحميل آخر تحديث للاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

​

 

[فارس الملاك]

لأكمال الموضوع

ضعي القيم في مستند ثم اغلقي المتصفح

ثم حددي القيم واحذفيها

R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\ swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O24 - Desktop Component 0: الصفحة الرئيسية الحالية - About:Home


طريقه الحذف

​

​

بعدها اذهب الى اضافة وازالة البرامج واحذف التولبار الموجود عندك (toolbar)>> ممكن ما يكون موجود​

ثم نزل هذه الاداة واتبع الشرح التالي​

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط ​

شرح الاستخدام ,,,,,,
دبل كلك على الاداة واصبر حتى تنتهي جميع النوافذ وتقف عند هذه النافذة​

​

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))​

وبس تخلصي من عمل المطلوب اعملي التالي​

حمل هذه الاداة ,,
واتبع الشرح التالي ,, لتنظيف جهازك من هذه الدعايات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,​

رابط تحميل آخر تحديث للاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​

شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور​

يعطيك الف عافية ياغااالي

اخي صاحب الموضوع ياليت تحذف جميع التولبيرات من اضافة وازلة قبل الحذف من الهايجاك :d:

 

[عشقي عيونه]

هذا هو




SmitFraudFix v2.423

Scan done at 16:43:52.01, Sat 07/18/2009
Run from C:\Documents and Settings\User\My Documents\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5006X Wireless Network Adapter - منفذ مصغر لجدولة الحزم
DNS Server Search Order: 192.168.1.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DA5928FA-81A9-4378-AB98-B90D6DDED34B}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DA5928FA-81A9-4378-AB98-B90D6DDED34B}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DA5928FA-81A9-4378-AB98-B90D6DDED34B}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

[فارس الملاك]

عزيزي في انتظار باقي التقارير الي وضعها اخي عبودي​

 

[عشقي عيونه]

طيب :u::d:
ننتظر عبود :u:




هذا تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:04:53, on 18/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\User\سطح المكتب\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\User\My Documents\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Documents and Settings\User\سطح المكتب\IDMan.exe /onboot
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Download all links with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Documents and Settings\User\سطح المكتب\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Documents and Settings\User\سطح المكتب\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: خدمة تحديث Google (gupdate1c9df1a4fbfabf8) (gupdate1c9df1a4fbfabf8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--
End of file - 4678 bytes

 

[البارون]

انتهت المشاكل ولا للان فيه تعليق في الجهاز

التقرير مضبوط​