السلام عليكم ورحمة الله وبركاته
اخواني نفس المشكلة عندي وهذا التقرير
logfile of trend micro hijackthis v2.0.2
scan saved at 11:27:28 م, on 30/10/2009
platform: Windows xp sp3 (winnt 5.01.2600)
msie: Internet explorer v8.00 (8.00.6001.18702)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\winsersec.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\windows\explorer.exe
c:\program files\microsoft office\office12\groovemonitor.exe
c:\program files\farstone\virtualdrive\vhd\rdtask.exe
c:\windows\sdaemon.exe
c:\windows\winwd.exe
c:\program files\java\jre6\bin\jusched.exe
c:\windows\system32\rundll32.exe
c:\windows\rthdcpl.exe
c:\program files\common files\installshield\updateservice\issch.exe
c:\windows\system32\ctfmon.exe
c:\program files\rocketdock\rocketdock.exe
c:\program files\google\googletoolbarnotifier\1.2.1128.5462\googletoolbarnotifier.exe
c:\program files\internet download manager\idman.exe
c:\program files\dvb\dvbplayer\tvromote.exe
c:\program files\bonjour\mdnsresponder.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\techsmith\snagit 9\snagit32.exe
c:\windows\system32\pnkbstra.exe
c:\windows\system32\pnkbstrb.exe
c:\program files\techsmith\snagit 9\tschelp.exe
c:\program files\techsmith\snagit 9\snagpriv.exe
c:\windows\system32\wscntfy.exe
c:\program files\techsmith\snagit 9\snagiteditor.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r0 - hkcu\software\microsoft\internet explorer\main,start page =
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hklm\software\microsoft\internet explorer\main,start page =
f2 - reg:system.ini: Userinit=userinit.exe
o2 - bho: Idm helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\idmiecc.dll
o2 - bho: Snagit toolbar loader - {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 9\snagitbho.dll
o2 - bho: Acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: Realplayer download and record plugin for internet explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
o2 - bho: Ievkbdbho - {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\ievkbd.dll
o2 - bho: Groove gfs browser helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\gra8e1~1.dll
o2 - bho: Google toolbar helper - {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
o2 - bho: Java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: Link filter bho - {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
o2 - bho: Jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o3 - toolbar: &google - {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
o3 - toolbar: Snagit - {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 9\snagitieaddin.dll
o4 - hklm\..\run: [groovemonitor] "c:\program files\microsoft office\office12\groovemonitor.exe"
o4 - hklm\..\run: [ramdrive] "c:\program files\farstone\virtualdrive\vhd\rdtask.exe"
o4 - hklm\..\run: [sdaemon] c:\windows\sdaemon.exe
o4 - hklm\..\run: [swd] c:\windows\winwd.exe
o4 - hklm\..\run: [avp] "c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe"
o4 - hklm\..\run: [sunjavaupdatesched] "c:\program files\java\jre6\bin\jusched.exe"
o4 - hklm\..\run: [nvcpldaemon] rundll32.exe c:\windows\system32\nvcpl.dll,nvstartup
o4 - hklm\..\run: [nvmediacenter] rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit
o4 - hklm\..\run: [rthdcpl] rthdcpl.exe
o4 - hklm\..\run: [isuspm startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
o4 - hklm\..\run: [isusscheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [rocketdock] "c:\program files\rocketdock\rocketdock.exe"
o4 - hkcu\..\run: [swg] c:\program files\google\googletoolbarnotifier\1.2.1128.5462\googletoolbarnotifier.exe
o4 - hkcu\..\run: [idman] c:\program files\internet download manager\idman.exe /onboot
o4 - hkcu\..\run: [tvromote] c:\program files\dvb\dvbplayer\tvromote.exe
o4 - hkcu\..\run: [dvbrec] c:\program files\dvb\dvbplayer\ipreceiver.exe autoload
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: Snagit 9.lnk = c:\program files\techsmith\snagit 9\snagit32.exe
o6 - hklm\software\policies\microsoft\internet explorer\control panel present
o8 - extra context menu item: Idm بواسطة flv تحميل محتوى فيديو - c:\program files\internet download manager\iegetvl.htm
o8 - extra context menu item: Idm تحميل بواسطة - c:\program files\internet download manager\ieext.htm
o8 - extra context menu item: Idm تحميل جميع الروابط بواسطة - c:\program files\internet download manager\iegetall.htm
o9 - extra button: إرسال إلى onenote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - c:\progra~1\micros~2\office12\onbttnie.dll
o9 - extra 'tools' menuitem: إر&سال إلى onenote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - c:\progra~1\micros~2\office12\onbttnie.dll
o9 - extra button: &virtual keyboard - {4248fe82-7fcb-46ac-b270-339f08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
o9 - extra button: Research - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office12\refiebar.dll
o9 - extra button: Urls c&heck - {ccf151d8-d089-449f-a5a4-d9909053f20f} - c:\program files\kaspersky lab\kaspersky anti-virus 2010\klwtbbho.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o17 - hklm\system\ccs\services\tcpip\..\{cf0aafb5-ca99-456f-86e6-d244d2ea29e0}: Nameserver = 192.168.10.10 208.67.222.222
o18 - protocol: Groovelocalgws - {88fed34c-f0ca-4636-a375-3cb6248b04cd} - c:\progra~1\micros~2\office12\gr99d3~1.dll
o18 - protocol: Skype4com - {ffc8b962-9b40-4dff-9458-1830c7dd7f5d} - c:\progra~1\common~1\skype\skype4~1.dll
o20 - appinit_dlls: C:\progra~1\kasper~1\kasper~1\mzvkbd3.dll
o23 - service: Kaspersky anti-virus (avp) - kaspersky lab - c:\program files\kaspersky lab\kaspersky anti-virus 2010\avp.exe
o23 - service: Bonjour service - apple inc. - c:\program files\bonjour\mdnsresponder.exe
o23 - service: Flexnet licensing service - macrovision europe ltd. - c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe
o23 - service: Google updater service (gusvc) - google - c:\program files\google\common\google updater\googleupdaterservice.exe
o23 - service: Installdriver table manager (idrivert) - macrovision corporation - c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe
o23 - service: Ipod service - apple inc. - c:\program files\ipod\bin\ipodservice.exe
o23 - service: Java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: Nvidia display driver service (nvsvc) - nvidia corporation - c:\windows\system32\nvsvc32.exe
o23 - service: Pnkbstra - unknown owner - c:\windows\system32\pnkbstra.exe
o23 - service: Pnkbstrb - unknown owner - c:\windows\system32\pnkbstrb.exe
o23 - service: Winser - unknown owner - c:\windows\system32\winsersec.exe
--
end of file - 9027 bytes
