الانترنت مايشتغل عندي .. مرفق تقرير

[ابو عمارالرحيلي]

الانترنت مايشتغل عندي

وبعد تنزيل برنامج Hotspot Shield يشتغل

وهذا تقرير الهايجك

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:06:51 ص, on 09/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\ClocX\ClocX.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hotspot Shield\bin\openvpntray.exe
C:\Program Files\Hotspot Shield\bin\openvpn.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: أضافة إلى مانع الأعلانات - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 5842 bytes

​

 

[ابـــو عــبــد الــلــه]

سلام عليكم

​

عطل برامج الحماية وشغل الأداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes



اثناء الفحص ممكن يعاد تشغيل الجهاز



وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ،، وبذلك يكون الفحص انتهى​

 

[ابو عمارالرحيلي]

سويت ما ذكرت ( قبل طرح الموضوع ) الا ان المشكلة ظلت مستمرة

 

[ابـــو عــبــد الــلــه]

جاري تحليل التقرير​

 

[ابـــو عــبــد الــلــه]

استخدم هذه الاداه :

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اختار Fix ثم اعد التشغيل و شوف النتيجة​

 

[ugugx]

شغالين نقل من بعض انا وانت يا ابوريما : :hh:

 

[ابو عمارالرحيلي]

ComboFix

ComboFix 09-09-08.02 - JMC 09/09/2009 2:24.11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1256.966.1025.18.1023.560 [GMT -12:00]
Running from: c:\documents and settings\JMC\سطح المكتب\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-08-09 to 2009-09-09 )))))))))))))))))))))))))))))))
.

2009-09-08 14:22 . 2009-09-08 14:22 -------- d-----w- c:\documents and settings\JMC\Application Data\YCanPDF
2009-09-08 14:22 . 2009-09-08 14:22 -------- d-----w- C:\tmp
2009-09-07 17:35 . 2009-09-07 17:35 -------- d-----w- c:\program files\My Company Name
2009-09-07 17:29 . 2009-09-07 17:29 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-09-07 17:29 . 2009-09-08 14:28 -------- d-----w- c:\program files\مصحف المدينة النبوية
2009-09-07 17:27 . 2009-09-07 17:27 -------- d-----w- c:\documents and settings\JMC\Application Data\AlMAdinahMushaf
2009-09-05 18:58 . 2009-09-05 18:58 -------- d-----w- c:\documents and settings\LocalService\سطح المكتب
2009-09-05 18:45 . 2009-09-05 18:45 -------- d-----w- c:\documents and settings\JMC\Application Data\TuneUp Software
2009-09-05 18:44 . 2009-09-05 19:02 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-09-05 18:44 . 2009-09-05 18:44 -------- d-----w- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-09-05 18:44 . 2009-09-05 18:44 -------- d-sh--w- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-05 17:23 . 2009-09-05 17:23 -------- d-----w- c:\documents and settings\JMC\Application Data\Uniblue
2009-09-03 05:30 . 2009-09-03 05:30 -------- d-----w- c:\temp\HP_WebRelease
2009-09-02 11:58 . 2009-09-02 11:58 720896 ----a-w- c:\windows\iun6002.exe
2009-09-02 10:45 . 2009-09-02 10:45 -------- d-----w- c:\documents and settings\JMC\Application Data\shamela
2009-09-02 10:44 . 2009-01-03 23:59 32768 ----a-w- c:\windows\system32\sUpdate1.dll
2009-09-02 10:44 . 1999-09-29 09:42 1050896 ----a-w- c:\windows\system32\msjet35.dll
2009-09-02 10:44 . 1997-04-22 12:00 70400 ----a-w- c:\windows\system32\vba332me.dll
2009-08-29 05:53 . 2009-08-29 05:55 -------- d-----w- c:\program files\Internet Download Manager
2009-08-29 05:12 . 2009-08-29 05:12 -------- d-----w- c:\program files\CCleaner
2009-08-23 02:13 . 2009-08-23 02:13 -------- d-----w- c:\documents and settings\JMC\Application Data\HTML Executable
2009-08-22 03:08 . 2009-08-22 03:08 -------- d-----w- c:\program files\أحكام التجويد
2009-08-20 12:04 . 2009-08-20 12:04 -------- d-----w- c:\program files\Trend Micro
2009-08-18 00:36 . 2009-08-18 11:04 -------- d-----w- c:\documents and settings\JMC\Application Data\LimeWire
2009-08-13 00:28 . 2009-08-13 00:28 -------- d-----w- c:\program files\Real Alternative
2009-08-13 00:28 . 2009-08-13 00:28 -------- d-----w- c:\program files\Media Player Classic

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-09 14:00 . 2009-07-25 13:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-09-09 14:00 . 2009-06-12 05:13 -------- d-----w- c:\documents and settings\JMC\Application Data\DMCache
2009-09-08 14:26 . 2009-06-12 06:41 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-07 17:29 . 2009-06-12 00:03 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-07 17:29 . 2009-06-12 00:01 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-05 06:04 . 2009-06-12 05:13 -------- d-----w- c:\documents and settings\JMC\Application Data\IDM
2009-09-03 05:31 . 2009-08-05 13:38 103511 ----a-w- c:\windows\hpoins04.dat
2009-08-29 04:56 . 2009-06-17 01:45 -------- d-----w- c:\documents and settings\JMC\Application Data\cleaner
2009-08-17 04:40 . 2009-07-31 19:49 -------- d-----w- c:\program files\Unlocker
2009-08-12 02:12 . 2009-07-25 15:00 -------- d-----w- c:\program files\Hotspot Shield
2009-08-09 02:02 . 2009-08-08 19:40 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-08-08 19:41 . 2009-08-08 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-08 19:41 . 2009-08-08 19:41 -------- d-----w- c:\documents and settings\JMC\Application Data\SUPERAntiSpyware.com
2009-08-08 19:23 . 2009-06-12 05:19 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-06 15:47 . 2009-08-06 15:47 -------- d-----w- c:\program files\ClocX
2009-08-05 18:40 . 2009-08-05 18:23 -------- d-----w- c:\documents and settings\JMC\Application Data\Ashampoo
2009-08-05 18:39 . 2009-08-05 18:39 -------- d-----w- c:\program files\Ashampoo
2009-08-05 18:18 . 2009-08-05 18:18 -------- d-----w- c:\documents and settings\All Users\Application Data\ashampoo
2009-08-05 18:13 . 2009-08-05 18:13 -------- d-----w- c:\documents and settings\JMC\Application Data\Nero
2009-08-05 16:06 . 2009-08-05 15:56 -------- d-----w- c:\program files\FreeTime
2009-08-05 13:40 . 2009-08-05 13:40 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-08-05 13:39 . 2009-08-05 13:39 -------- d-----w- c:\program files\HP
2009-08-03 13:39 . 2009-08-03 13:39 -------- d-----w- c:\program files\Paltalk Messenger Interop
2009-08-02 13:27 . 2009-08-02 13:27 -------- d-----w- c:\documents and settings\JMC\Application Data\FastStone
2009-08-02 13:27 . 2009-08-02 13:27 -------- d-----w- c:\program files\FastStone Capture
2009-08-02 12:30 . 2009-08-02 12:30 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-08-02 12:30 . 2009-08-02 12:30 -------- d-----w- c:\documents and settings\JMC\Application Data\skypePM
2009-08-02 12:26 . 2009-08-02 12:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-07-31 19:49 . 2009-07-31 19:49 -------- d-----w- c:\documents and settings\JMC\Application Data\Desktopicon
2009-07-31 15:06 . 2009-06-12 05:16 -------- d-----w- c:\program files\Media Convert Master
2009-07-31 13:30 . 2009-07-31 13:28 -------- d-----w- c:\documents and settings\JMC\Application Data\Paltalk
2009-07-31 13:29 . 2009-07-31 13:28 -------- d-----w- c:\program files\Paltalk Messenger
2009-07-31 10:28 . 2009-06-12 05:11 -------- d-----w- c:\program files\Common Files\Real
2009-07-28 12:12 . 2009-07-09 01:25 -------- d-----w- c:\program files\Word Password Recovery Master
2009-07-27 12:28 . 2009-07-27 11:13 -------- d-----w- c:\program files\Intelore
2009-07-27 12:27 . 2009-07-27 11:08 -------- d-----w- c:\documents and settings\JMC\Application Data\Intelore
2009-07-27 10:12 . 2009-06-17 01:45 -------- d-----w- c:\documents and settings\JMC\Application Data\CyberScrub
2009-07-27 09:52 . 2009-06-12 04:41 314424 ----a-w- c:\documents and settings\JMC\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-27 09:52 . 2009-06-12 05:16 47360 ----a-w- c:\documents and settings\JMC\Application Data\pcouffin.sys
2009-07-25 13:19 . 2009-07-25 13:19 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-07-25 13:19 . 2009-07-25 13:19 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-07-25 13:19 . 2009-07-25 13:19 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-07-25 13:18 . 2009-07-25 13:18 -------- d-----w- c:\program files\Kaspersky Lab
2009-07-23 09:00 . 2009-07-23 08:57 -------- d-----w- c:\documents and settings\JMC\Application Data\Passware
2009-07-22 19:13 . 2009-07-15 00:01 28592 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-07-20 06:51 . 2009-06-12 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-07-18 05:08 . 2009-07-18 05:08 -------- d-----w- c:\documents and settings\JMC\Application Data\Malwarebytes
2009-07-18 05:08 . 2009-07-18 05:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-17 08:17 . 2009-07-17 04:20 0 ----a-w- C:\osy3.sys
2009-07-17 04:02 . 2009-06-20 02:39 -------- d-----w- c:\program files\General Removal
2009-07-14 10:52 . 2009-07-14 10:52 -------- d-----w- c:\documents and settings\JMC\Application Data\ACD Systems
2009-07-04 03:48 . 2009-07-04 03:48 219664 ----a-w- c:\windows\system32\klogon.dll
2009-07-04 03:45 . 2009-07-04 03:45 27507 ----a-w- c:\windows\system32\drivers\klopp.dat
2009-07-02 02:34 . 2009-07-02 02:34 33840 ----a-w- c:\windows\system32\drivers\HssDrv.sys
2009-06-24 07:44 . 2009-06-24 07:44 0 ----a-w- c:\windows\system32\cd.dat
2009-06-16 02:01 . 2009-06-16 02:01 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-06-13 10:02 . 2009-06-13 10:02 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-12 23:06 . 2009-06-12 23:06 0 ----a-w- c:\windows\nsreg.dat
2009-06-12 05:41 . 2009-06-12 05:22 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-12 05:18 . 2009-06-12 05:18 835584 ----a-w- c:\windows\system32\maae.dll
2009-06-12 05:18 . 2009-06-12 05:18 729088 ----a-w- c:\windows\system32\maad.dll
2009-06-12 05:18 . 2009-06-12 05:18 450560 ----a-w- c:\windows\system32\maai.dll
2009-06-12 05:18 . 2009-06-12 05:18 335872 ----a-w- c:\windows\system32\maac.dll
2009-06-12 05:18 . 2009-06-12 05:18 315392 ----a-w- c:\windows\system32\maab.dll
2009-06-12 05:18 . 2009-06-12 05:18 311296 ----a-w- c:\windows\system32\maaf.dll
2009-06-12 05:18 . 2009-06-12 05:18 237568 ----a-w- c:\windows\system32\lame_enc.dll
2009-06-12 05:18 . 2009-06-12 05:18 196608 ----a-w- c:\windows\system32\maag.dll
2009-06-12 05:18 . 2009-06-12 05:18 1843200 ----a-w- c:\windows\system32\maaa.dll
2009-06-12 05:18 . 2009-06-12 05:18 1040384 ----a-w- c:\windows\system32\maah.dll
2009-06-12 05:16 . 2009-06-12 05:16 81920 ----a-w- c:\documents and settings\JMC\Application Data\ezpinst.exe
2009-06-12 05:16 . 2009-06-12 05:16 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-06-12 05:11 . 2009-06-12 05:11 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-06-12 05:11 . 2009-06-12 05:11 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-12 05:05 . 2009-06-12 05:05 172032 ------w- c:\windows\Setup1.exe
2009-06-12 05:05 . 2009-06-12 05:05 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-12 00:04 . 2009-06-12 00:04 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-12 00:01 . 2009-06-12 00:01 15600 ----a-w- c:\windows\gdrv.sys
2009-06-11 23:51 . 2004-08-04 09:00 39982 ----a-w- c:\windows\system32\perfc001.dat
2009-06-11 23:51 . 2004-08-04 09:00 251478 ----a-w- c:\windows\system32\perfh001.dat
2009-06-11 23:42 . 2009-06-11 23:42 22144 ----a-w- c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((( SnapShot_2009-08-14_01.52.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-08-27 18:11 . 1998-12-24 11:23 40960 c:\windows\system32\Vbame.dll
- 1999-11-25 06:40 . 1999-11-25 06:40 40960 c:\windows\system32\VBAME.DLL
+ 2009-09-03 05:31 . 2009-09-03 05:31 84992 c:\windows\Installer\55cc4.msi
+ 2009-09-07 17:29 . 2002-07-26 13:13 24576 c:\windows\Downloaded Program Files\dwusplay.dll
+ 2009-08-10 09:33 . 2009-03-26 15:35 210352 c:\windows\system32\idmmbc.dll
+ 2009-09-07 17:29 . 2005-02-17 13:15 401408 c:\windows\Downloaded Program Files\isusweb.dll
+ 2009-09-07 17:29 . 2002-07-26 13:13 196608 c:\windows\Downloaded Program Files\dwusplay.exe
+ 2009-06-11 11:35 . 2009-09-08 03:13 1311360 c:\windows\system32\FNTCACHE.DAT
+ 2009-09-07 17:29 . 2005-08-08 07:53 2487827 c:\windows\Fonts\Build Fonts XML.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-07-27 09:56 218160 ----a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-08-29 3114416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"ClocX"="c:\program files\ClocX\ClocX.exe" [2007-07-26 270336]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-04 303376]

c:\documents and settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2009-6-29 11536384]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 08:41 م 33808]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [11/06/2009 11:58 ص 13696]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [06/08/2009 06:58 ص 331824]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 05:46 م 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 08:59 م 19472]
R3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [14/07/2009 12:01 م 28592]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [10/08/2009 11:19 ص 57640]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.arabic2.com
IE: &تصدير إلى Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
IE: تحميل محتوى FLV بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetVL.htm
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\JMC\Application Data\Mozilla\Firefox\Profiles\zf05o20c.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.sa/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - component: c:\documents and settings\JMC\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\JMC\Application Data\Mozilla\Firefox\Profiles\zf05o20c.default\extensions\firedownload@mozilla.org\components\firedownload.dll
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-09-09 02:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1c9c5a8b-200f-4929-aeb9-f898c6e1b2b5}]
@Denied: (Full) (Everyone)
"Model"=dword:000000ed
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,49,8c,bf,1a,9d,fe,41,71,cb,3f,46,a4,7c,ab,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3d393626-1d65-4987-95e6-4452eee3ae57}]
@Denied: (Full) (Everyone)
"Model"=dword:000000e1
"Therad"=dword:00000009
"MData"=hex(0):cb,9b,ad,ef,27,7d,29,69,f5,02,f0,76,aa,4a,f1,7c,d3,d9,67,7f,6a,
4b,7b,ad,04,7a,b1,b5,76,9b,27,47,31,d6,06,d2,57,04,03,fe,be,35,5f,67,da,87,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):e1,9e,1a,ad,a4,f6,4f,26,8e,ca,c9,e8,ba,e1,5f,a1,60,6e,09,60,ff,
1c,3f,c3,73,46,11,95,af,62,89,b6,58,40,b4,53,3f,f0,81,68,00,00,00,00,00,00,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):b6,ba,eb,b0,1a,4c,e5,76,2d,17,a9,d4,7f,ab,b2,8e,b9,ac,2d,d0,c2,
93,d5,4e,98,be,84,ff,9c,b3,79,32,5c,8e,42,41,34,58,b5,4b,00,00,00,00,00,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1144)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1264)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-09 2:28
ComboFix-quarantined-files.txt 2009-09-09 14:28
ComboFix2.txt 2009-09-09 12:20
ComboFix3.txt 2009-08-29 04:53
ComboFix4.txt 2009-08-24 06:22
ComboFix5.txt 2009-09-09 14:24

Pre-Run: 23,679,373,312 bytes free
Post-Run: 23,648,980,992 bytes free

229

 

[ابـــو عــبــد الــلــه]

شغالين نقل من بعض انا وانت يا ابوريما : :hh:

:q:... : ...:hh:​

 

[ابو عمارالرحيلي]

شغالين نقل من بعض انا وانت يا ابوريما : :hh:

ونعم فيكم

 

[ابـــو عــبــد الــلــه]

استخدم هذه الاداه :

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اختار Fix ثم اعد التشغيل و شوف النتيجة​

:u:​

 

[ابو عمارالرحيلي]

الوضع كما كان

وهذا تقرير بـ SmitFraudFix v2.422

Scan done at 2:38:15.54, Wed 09/09/2009
Run from C:\Documents and Settings\JMC\سطح المكتب\البرامج\تنظيف\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost



»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: محول VIA Compatable Fast Ethernet
DNS Server Search Order: 192.168.1.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4015264D-77A0-46D3-982D-738F83E14E68}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4015264D-77A0-46D3-982D-738F83E14E68}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4015264D-77A0-46D3-982D-738F83E14E68}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

[ugugx]

اخى قم بفحص الجهاز بهذا البرنامج :

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وهل جربت الاداه الاولى

 

[ابو عمارالرحيلي]

وهل جربت الاداه الاولى

نعم

 

[ابـــو عــبــد الــلــه]

هل استخدمت الاداة الموجودة في الرد السابق​

 

[ابـــو عــبــد الــلــه]

ماهو اتصالك​

 

[صمت السكوت]

من صفحة الانترنت ادوات - خيارات انترنت - الاتصالات - اعدادات lan ازل اي علامة صح ان وجدت بالخيارات

 

[xfirefox]

المشكلة بسيطة وهي انا برنامج Hotspot Shield قام بتعديل اعدادات البروكسي :y:

الحل : k:

افتح الاكسبلورر وتابع الشرح :-

v
v

v
v

v
v

,,
​

 

[ابو عمارالرحيلي]

هل استخدمت الاداة الموجودة في الرد السابق

نعم

تم افحص بـ Malwarebytes' Anti-Malware

ماهو اتصالك

dsl

من صفحة الانترنت ادوات - خيارات انترنت - الاتصالات - اعدادات lan ازل اي علامة صح ان وجدت بالخيارات

متصفحي Firefox

المشكلة بسيطة وهي انا برنامج Hotspot Shield قام بتعديل اعدادات البروكسي :y:

الحل : k:

افتح الاكسبلورر وتابع الشرح :-

v
v

v
v

v
v

متصفحي Firefox


في النهاية الوضع كما كان

الانترنت مايشتغل الا بـ Hotspot Shield​

 

[xfirefox]

​

متصفحي Firefox


في النهاية الوضع كما كان

الانترنت مايشتغل الا بـ Hotspot Shield

​

ما في مشكلة ليش زعلان :hh:

(نفس الشي قام البرنامج بتعديل خيار البروكس في المتصفح) :bleh:

افتح الفايرفوكس وتابع الشرح :-

ثم

بعد ذلك

,,
​

 

[ابو عمارالرحيلي]

ما تفضلت فيه مطبق من قبل

فعندما اتبعت ما ذكرت وجدت انها كما طلبت

ومع ذلك أعدت المحاولة لتأكد

في النهاية
الوضع كما كان
​