السلام عليكم
الجهاز يعاني من مشكلة البطء الشديد جداً في كل شيء حتى في الانتقال من نافذة إلى أخرى
وعند الانتقال الى سطح المكتب تخرج الرموز واحد تلو الآخر ببطء
ويوجد خط طولي لونه أزرق في الشاشة و أحياناً يصبح لونه أحمر
كما أنه أحياناً عند بدء تشغيل الجهاز تظهر الشاشة السوداء التي تطلب الضغط على ( ستارت وندوز نورملي )
علماً بأن الجهاز تمت فرمته قبل أسبوعين تقريباً ولم يتغير شيء بعد الفورمات
قمت باستخدام أداة عمل التقارير
عملت تقرير بالهايجاك
هذا هو
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:27:31 م, on 29/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Documents and Settings\Administrator\سطح المكتب\Zyzoom.org_Tool_V_1.0.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zyaoom Tool\Hijack.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader 8.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [locks tick title proc] C:\Documents and Settings\All Users\Application Data\bags readme locks tick\gram style.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Anteidol] C:\DOCUME~1\ADMINI~1\APPLIC~1\THATTO~1\For Link Download.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E001C731-5E37-4538-A5CB-8168736A2360} (ActiveQscan Control) -
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5640 bytes
______________________________________
وهذا تقرير بواسطة أداة بت ديفيدندر
BitDefender QuickScan Beta v0.9.5.3
-----------------------------------
Scan date: Wed Jul 29 20:49:53 2009
Machine ID: 6CCD9481
Processes
---------
<unsigned> AutoPlay Application 3068 C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\autorun.exe
<unsigned> AutoPlay Application 2796 C:\Documents and Settings\Administrator\Local Settings\Temp\zyaoom Tool\bitdefender_q.exe
<unsigned> Zyzoom.org_Tool_V_1.0.exe 3064 C:\Documents and Settings\Administrator\سطح المكتب\Zyzoom.org_Tool_V_1.0.exe
<unsigned> Apple Mobile Device Service 1380 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
<verified> Machine Debug Manager 1736 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
<verified> RealNetworks Scheduler 196 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
<verified> Internet Explorer 596 C:\Program Files\Internet Explorer\iexplore.exe
<verified> Internet Explorer 876 C:\Program Files\Internet Explorer\iexplore.exe
<verified> Kaspersky Anti-Virus 216 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Kaspersky Anti-Virus 1404 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Kaspersky Anti-Virus 4044 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Agere Soft Modem Call Progress Service 1368 C:\Program Files\LSI SoftModem\agrsmsvc.exe
<verified> Firefox 2948 C:\Program Files\Mozilla Firefox\firefox.exe
<verified> Windows Live Messenger 236 C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
<verified> Windows Explorer 364 C:\WINDOWS\Explorer.EXE
<verified> Application Layer Gateway Service 2388 C:\WINDOWS\System32\alg.exe
<verified> Client Server Runtime Process 1048 C:\WINDOWS\system32\csrss.exe
<verified> CTF Loader 308 C:\WINDOWS\system32\ctfmon.exe
<verified> hkcmd Module 2004 C:\WINDOWS\system32\hkcmd.exe
<verified> persistence Module 2036 C:\WINDOWS\system32\igfxpers.exe
<verified> igfxsrvc Module 592 C:\WINDOWS\system32\igfxsrvc.exe
<verified> LSA Shell (Export Version) 1136 C:\WINDOWS\system32\lsass.exe
<verified> Services and Controller app 1124 C:\WINDOWS\system32\services.exe
<verified> Windows NT Session Manager 928 C:\WINDOWS\System32\smss.exe
<verified> Spooler SubSystem App 400 C:\WINDOWS\system32\spoolsv.exe
<verified> Generic Host Process for Win32 Services 1452 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1584 C:\WINDOWS\System32\svchost.exe
<verified> Generic Host Process for Win32 Services 1756 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1828 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1316 C:\WINDOWS\system32\svchost.exe
<verified> Windows User Mode Driver Manager 1896 C:\WINDOWS\system32\wdfmgr.exe
<verified> Windows NT Logon Application 1076 C:\WINDOWS\system32\winlogon.exe
<verified> Windows Security Center Notification App 2072 C:\WINDOWS\system32\wscntfy.exe
Network activity
----------------
Process avp.exe (1404) connected on port 80 (HTTP) - 80.239.144.75
Process avp.exe (1404) listens on ports: 1110, 19780
Process svchost.exe (1452) listens on ports: 135 (RPC)
Autoruns and critical files
---------------------------
<unsigned> Omsoff be cithe test atcot geroro bewo c:\Documents and Settings\Administrator\Application Data\That Tool\Compthisdeaf.exe
<unsigned> Npa up utodw fafo embing est tbise C:\Documents and Settings\Administrator\Application Data\That Tool\For Link Download.exe
<unsigned> Ftic peri up codwic lilde wireless C:\Documents and Settings\All Users\Application Data\bags readme locks tick\gram style.exe
<verified> Apple Software Update C:\Program Files\Apple Software Update\SoftwareUpdate.exe
<verified> RealNetworks Scheduler C:\Program Files\Common Files\Real\Update_OB\realsched.exe
<verified> Kaspersky Anti-Virus C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Windows Live Messenger C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
<verified> Crypto API32 C:\WINDOWS\system32\crypt32.dll
<verified> Crypto Network Related API C:\WINDOWS\system32\cryptnet.dll
<verified> Offline Network Agent C:\WINDOWS\system32\cscdll.dll
<verified> CTF Loader C:\WINDOWS\system32\ctfmon.exe
<verified> hkcmd Module C:\WINDOWS\system32\hkcmd.exe
<verified> igfxdev Module C:\WINDOWS\system32\igfxdev.dll
<verified> persistence Module C:\WINDOWS\system32\igfxpers.exe
<verified> igfxTray Module C:\WINDOWS\system32\igfxtray.exe
<verified> إعداد إشعارات "مزايا برامج Windows الأصلية" C:\WINDOWS\system32\KB905474\wgasetup.exe
<verified> Logon Visualizer C:\WINDOWS\system32\klogon.dll
<verified> Windows Logon UI C:\WINDOWS\system32\logonui.exe
<verified> Microsoft Windows Sockets 2.0 Service Provider C:\WINDOWS\system32\mswsock.dll
<verified> Microsoft Windows Rsvp 1.0 Service Provider C:\WINDOWS\system32\rsvpsp.dll
<verified> Secondary Logon Service Notification DLL C:\WINDOWS\system32\sclgntfy.dll
<verified> Userinit Logon Application c:\windows\system32\userinit.exe
<verified> LDAP RnR Provider DLL C:\WINDOWS\system32\winrnr.dll
<verified> Common DLL to receive Winlogon notifications C:\WINDOWS\system32\wlnotify.dll
Browser plugins
---------------
<unsigned> DivX® Content Upload Plugin C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
<unsigned> npdivxplayerplugin C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll
<unsigned> DivX® Web Player C:\Program Files\DivX\DivX Web Player\npdivx32.dll
<unsigned> RealJukebox Netscape Plugin C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
<unsigned> 6.0.12.46 C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
<verified> Adobe Acrobat IE Helper Version 7.0 for ActiveX c:\program files\adobe\reader 8.0\activex\acroiehelper.dll
<verified> Windows Messenger C:\Program Files\Messenger\msmsgs.exe
<verified> Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
<verified> RealPlayer(tm) LiveConnect-Enabled Plug-In C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
<verified> RealPlayer Download and Record Plugin for Internet c:\program files\real\realplayer\rpbrowserrecordplugin.dll
<verified> BitDefender QuickScan Client ActiveX C:\WINDOWS\Downloaded Program Files\ActiveQscan.ocx
<verified> Internet Explorer C:\WINDOWS\system32\ieframe.dll
________________________________
صورة للخط الأزرق الطولي
((( عفوا قمت بحذف الصورة .. لأني شاهدت الموضوع من جهاز آخر ولكن لم أشاهد الخط في الصورة !! ))
لكن ما تفسير وجوده على هذا الجهاز ؟؟
الجهاز يعاني من مشكلة البطء الشديد جداً في كل شيء حتى في الانتقال من نافذة إلى أخرى
وعند الانتقال الى سطح المكتب تخرج الرموز واحد تلو الآخر ببطء
ويوجد خط طولي لونه أزرق في الشاشة و أحياناً يصبح لونه أحمر
كما أنه أحياناً عند بدء تشغيل الجهاز تظهر الشاشة السوداء التي تطلب الضغط على ( ستارت وندوز نورملي )
علماً بأن الجهاز تمت فرمته قبل أسبوعين تقريباً ولم يتغير شيء بعد الفورمات
قمت باستخدام أداة عمل التقارير
عملت تقرير بالهايجاك
هذا هو
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:27:31 م, on 29/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Documents and Settings\Administrator\سطح المكتب\Zyzoom.org_Tool_V_1.0.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zyaoom Tool\Hijack.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader 8.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [locks tick title proc] C:\Documents and Settings\All Users\Application Data\bags readme locks tick\gram style.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Anteidol] C:\DOCUME~1\ADMINI~1\APPLIC~1\THATTO~1\For Link Download.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E001C731-5E37-4538-A5CB-8168736A2360} (ActiveQscan Control) -
يجب عليك
تسجيل الدخول
او
تسجيل لمشاهدة الرابط المخفي
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5640 bytes
______________________________________
وهذا تقرير بواسطة أداة بت ديفيدندر
BitDefender QuickScan Beta v0.9.5.3
-----------------------------------
Scan date: Wed Jul 29 20:49:53 2009
Machine ID: 6CCD9481
Processes
---------
<unsigned> AutoPlay Application 3068 C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\autorun.exe
<unsigned> AutoPlay Application 2796 C:\Documents and Settings\Administrator\Local Settings\Temp\zyaoom Tool\bitdefender_q.exe
<unsigned> Zyzoom.org_Tool_V_1.0.exe 3064 C:\Documents and Settings\Administrator\سطح المكتب\Zyzoom.org_Tool_V_1.0.exe
<unsigned> Apple Mobile Device Service 1380 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
<verified> Machine Debug Manager 1736 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
<verified> RealNetworks Scheduler 196 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
<verified> Internet Explorer 596 C:\Program Files\Internet Explorer\iexplore.exe
<verified> Internet Explorer 876 C:\Program Files\Internet Explorer\iexplore.exe
<verified> Kaspersky Anti-Virus 216 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Kaspersky Anti-Virus 1404 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Kaspersky Anti-Virus 4044 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Agere Soft Modem Call Progress Service 1368 C:\Program Files\LSI SoftModem\agrsmsvc.exe
<verified> Firefox 2948 C:\Program Files\Mozilla Firefox\firefox.exe
<verified> Windows Live Messenger 236 C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
<verified> Windows Explorer 364 C:\WINDOWS\Explorer.EXE
<verified> Application Layer Gateway Service 2388 C:\WINDOWS\System32\alg.exe
<verified> Client Server Runtime Process 1048 C:\WINDOWS\system32\csrss.exe
<verified> CTF Loader 308 C:\WINDOWS\system32\ctfmon.exe
<verified> hkcmd Module 2004 C:\WINDOWS\system32\hkcmd.exe
<verified> persistence Module 2036 C:\WINDOWS\system32\igfxpers.exe
<verified> igfxsrvc Module 592 C:\WINDOWS\system32\igfxsrvc.exe
<verified> LSA Shell (Export Version) 1136 C:\WINDOWS\system32\lsass.exe
<verified> Services and Controller app 1124 C:\WINDOWS\system32\services.exe
<verified> Windows NT Session Manager 928 C:\WINDOWS\System32\smss.exe
<verified> Spooler SubSystem App 400 C:\WINDOWS\system32\spoolsv.exe
<verified> Generic Host Process for Win32 Services 1452 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1584 C:\WINDOWS\System32\svchost.exe
<verified> Generic Host Process for Win32 Services 1756 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1828 C:\WINDOWS\system32\svchost.exe
<verified> Generic Host Process for Win32 Services 1316 C:\WINDOWS\system32\svchost.exe
<verified> Windows User Mode Driver Manager 1896 C:\WINDOWS\system32\wdfmgr.exe
<verified> Windows NT Logon Application 1076 C:\WINDOWS\system32\winlogon.exe
<verified> Windows Security Center Notification App 2072 C:\WINDOWS\system32\wscntfy.exe
Network activity
----------------
Process avp.exe (1404) connected on port 80 (HTTP) - 80.239.144.75
Process avp.exe (1404) listens on ports: 1110, 19780
Process svchost.exe (1452) listens on ports: 135 (RPC)
Autoruns and critical files
---------------------------
<unsigned> Omsoff be cithe test atcot geroro bewo c:\Documents and Settings\Administrator\Application Data\That Tool\Compthisdeaf.exe
<unsigned> Npa up utodw fafo embing est tbise C:\Documents and Settings\Administrator\Application Data\That Tool\For Link Download.exe
<unsigned> Ftic peri up codwic lilde wireless C:\Documents and Settings\All Users\Application Data\bags readme locks tick\gram style.exe
<verified> Apple Software Update C:\Program Files\Apple Software Update\SoftwareUpdate.exe
<verified> RealNetworks Scheduler C:\Program Files\Common Files\Real\Update_OB\realsched.exe
<verified> Kaspersky Anti-Virus C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
<verified> Windows Live Messenger C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
<verified> Crypto API32 C:\WINDOWS\system32\crypt32.dll
<verified> Crypto Network Related API C:\WINDOWS\system32\cryptnet.dll
<verified> Offline Network Agent C:\WINDOWS\system32\cscdll.dll
<verified> CTF Loader C:\WINDOWS\system32\ctfmon.exe
<verified> hkcmd Module C:\WINDOWS\system32\hkcmd.exe
<verified> igfxdev Module C:\WINDOWS\system32\igfxdev.dll
<verified> persistence Module C:\WINDOWS\system32\igfxpers.exe
<verified> igfxTray Module C:\WINDOWS\system32\igfxtray.exe
<verified> إعداد إشعارات "مزايا برامج Windows الأصلية" C:\WINDOWS\system32\KB905474\wgasetup.exe
<verified> Logon Visualizer C:\WINDOWS\system32\klogon.dll
<verified> Windows Logon UI C:\WINDOWS\system32\logonui.exe
<verified> Microsoft Windows Sockets 2.0 Service Provider C:\WINDOWS\system32\mswsock.dll
<verified> Microsoft Windows Rsvp 1.0 Service Provider C:\WINDOWS\system32\rsvpsp.dll
<verified> Secondary Logon Service Notification DLL C:\WINDOWS\system32\sclgntfy.dll
<verified> Userinit Logon Application c:\windows\system32\userinit.exe
<verified> LDAP RnR Provider DLL C:\WINDOWS\system32\winrnr.dll
<verified> Common DLL to receive Winlogon notifications C:\WINDOWS\system32\wlnotify.dll
Browser plugins
---------------
<unsigned> DivX® Content Upload Plugin C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
<unsigned> npdivxplayerplugin C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll
<unsigned> DivX® Web Player C:\Program Files\DivX\DivX Web Player\npdivx32.dll
<unsigned> RealJukebox Netscape Plugin C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
<unsigned> 6.0.12.46 C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
<verified> Adobe Acrobat IE Helper Version 7.0 for ActiveX c:\program files\adobe\reader 8.0\activex\acroiehelper.dll
<verified> Windows Messenger C:\Program Files\Messenger\msmsgs.exe
<verified> Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
<verified> RealPlayer(tm) LiveConnect-Enabled Plug-In C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
<verified> RealPlayer Download and Record Plugin for Internet c:\program files\real\realplayer\rpbrowserrecordplugin.dll
<verified> BitDefender QuickScan Client ActiveX C:\WINDOWS\Downloaded Program Files\ActiveQscan.ocx
<verified> Internet Explorer C:\WINDOWS\system32\ieframe.dll
________________________________
صورة للخط الأزرق الطولي
((( عفوا قمت بحذف الصورة .. لأني شاهدت الموضوع من جهاز آخر ولكن لم أشاهد الخط في الصورة !! ))
لكن ما تفسير وجوده على هذا الجهاز ؟؟
