هل من حــل يااخوان الانترنت جننتني

[achour]

السلام عليكم ورحمة الله
​

حذفت الأنتي فيروس

اغلقت الحماية

قمت بإصلاح الوقت

ولكن الماسنجر لا يفتح


والانترنت لا تعمل الا mode pusch يعني التصفح فقط

هل من حــل يااخوان الانترنت جننتني​

 

[FireFox]

اخوي اضغط على الخيار الي مأشر عليه انت وخله ينتهي من العمليه وارفع صوره


​

 

[achour]

اليك اخي الصور

انظر الصورة الثانية انا دخلت كل اللنكات لكن دون فائدة
اعدت تنصيب الماسنجر نفس المشكلة
اردت دخول الايميل ياهو لكن البعث لرسالة مستحيل
تحميل صورة على موقع مستحيل
كتابة موضوع او رد في منتدى مستحيل

هل من مساعدة يا احبابي ؟؟؟​

 

[FireFox]

طيب اخوي يعني النت بس يتصفح ؟

حمل هذا البرنامج

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغطي على Do a system scan and save log
لحظات .. ويظهر لك تقرير ==> انسخه والصقه بردك القادم




​

 

[achour]

تفضل اخي واسف عن التأخير


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:28:33, on 30/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT User Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
O4 - Global Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
--
End of file - 5530 bytes
​

 

[ahmed fathy 13]

احذف هذه القيم أخي

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

 

[achour]

مشكور اخي احمد على المساعدة والتفاعل
لكن صراحة لا اعرف كيف تقع عملية الحذف

نورني الله ينورها عليك دنيا واخرة


k:k:k:k:k:​

 

[LINEZERO]

بالاضافه الى كلام الاحبه

قم بعمل التالي


( 1 )

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes

انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم

--------------------------------------------

( 2 )

واعمل تقرير للهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم​

 

[ahmed fathy 13]

مشكور اخي احمد على المساعدة والتفاعل

لكن صراحة لا اعرف كيف تقع عملية الحذف​

نورني الله ينورها عليك دنيا واخرة​

k:k:k:k:k:​

العفو أخي الحبيب

وهذه طريقة الحذف يالغالي

بالتوفيق ......

 

[المانسي]

اهلا بك اخي العزيز​

اولا ادخل على الرابط التالي وتأكد من حالة الخدمة لديك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ثانيا تأكد من تاريخ ووقت جهازك وذلك بضبطه دبل كلك على الساعة وشوف
تاريخ ووقت الجهاز واضبطها حسب دولتك​

ثالثا :​

ادخل إبدأ ثم تشغيل ​

أنسخ والصق هذا الامر ثم موافق OK​

regsvr32 Dssenh.dll Gpkcsp.dll Slbcsp.dll Sccbase.dll ​

ستظهر لك هذه الرسالة توافق عليها 3 مرات​

بالتوفيق أن شاء الله​

 

[achour]

اهلا بك اخي العزيز


اولا ادخل على الرابط التالي وتأكد من حالة الخدمة لديك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

ثانيا تأكد من تاريخ ووقت جهازك وذلك بضبطه دبل كلك على الساعة وشوف
تاريخ ووقت الجهاز واضبطها حسب دولتك

ثالثا :

ادخل إبدأ ثم تشغيل


أنسخ والصق هذا الامر ثم موافق OK


regsvr32 Dssenh.dll Gpkcsp.dll Slbcsp.dll Sccbase.dll



ستظهر لك هذه الرسالة توافق عليها 3 مرات





بالتوفيق أن شاء الله
​

اخي انا اشكرك لمرورك ومساعدتك بس انا عملت كل هذا قبل وضع الموضوع والمشكلة على المنتدى ​

تسلم اخي وجزاك الله خيرا

 

[achour]

العفو أخي الحبيب

وهذه طريقة الحذف يالغالي

بالتوفيق ......

تم الحذف اخي وهذه التقارير المطلوبة


ComboFix 08-04-20.2 - Administrator 2008-05-01 5:41:25.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.278 [GMT 1:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-04-01 to 2008-05-01 )))))))))))))))))))))))))))))))
.
2008-04-30 14:09 . 2008-04-30 14:09 <DIR> d--h----- C:\Program Files\Zero G Registry
2008-04-30 14:00 . 2008-04-30 14:36 <DIR> d-------- C:\Program Files\SAGEM
2008-04-24 05:04 . 2008-04-24 05:04 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-04-23 14:52 . 2008-04-23 14:52 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CyberScrub
2008-04-23 14:51 . 2008-04-30 14:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\cleaner
2008-04-23 14:05 . 2008-04-23 14:05 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-04-21 09:04 . 2008-04-21 15:40 113 --a------ C:\WINDOWS\system32\temp_0000_65-21.aok
2008-04-21 09:03 . 2008-04-23 18:52 93 --a------ C:\WINDOWS\system32\test.aok
2008-04-21 09:02 . 2008-04-21 09:02 2,368 --a------ C:\WINDOWS\system32\SVKP.sys
2008-04-21 08:28 . 2008-04-21 08:28 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\GeoVid
2008-04-21 08:15 . 2008-04-21 09:10 <DIR> d-------- C:\Program Files\Video GIF Converter
2008-04-21 08:04 . 2008-04-21 08:12 <DIR> d-------- C:\Program Files\Video Snapshots Genius
2008-04-21 08:04 . 2008-04-21 08:04 <DIR> d-------- C:\Program Files\UPHClean
2008-04-20 15:27 . 2004-08-03 23:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-04-20 15:27 . 2004-08-03 23:56 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll
2008-04-20 15:27 . 2004-08-03 21:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-04-20 15:27 . 2004-08-03 21:58 14,848 --a------ C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-04-20 15:25 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-20 15:25 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-04-19 23:22 . 2008-04-19 23:22 <DIR> d-------- C:\Program Files\DIFX
2008-04-19 23:21 . 2008-04-19 23:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-04-19 23:21 . 2003-06-18 15:12 114,688 --a------ C:\WINDOWS\system32\SonyPI.dll
2008-04-19 23:21 . 2003-06-18 15:12 114,688 --a------ C:\WINDOWS\system32\dllcache\sonypi.dll
2008-04-19 23:21 . 2003-06-18 15:12 71,961 --a------ C:\WINDOWS\system32\drivers\SonyPI.sys
2008-04-19 23:21 . 2003-06-18 15:12 71,961 --a------ C:\WINDOWS\system32\dllcache\sonypi.sys
2008-04-19 23:09 . 2004-03-03 11:25 1,057,568 --a------ C:\WINDOWS\system32\ati3d2ag.dll
2008-04-19 23:09 . 2004-03-03 11:23 870,592 --a------ C:\WINDOWS\system32\dllcache\ati3d1ag.dll
2008-04-19 23:09 . 2004-03-03 11:23 870,592 --a------ C:\WINDOWS\system32\ati3d1ag.dll
2008-04-19 22:24 . 2005-07-25 14:04 48,640 -ra------ C:\WINDOWS\system32\drivers\ser2pl.sys
2008-04-19 22:07 . 2008-04-19 22:07 <DIR> d-------- C:\Program Files\Apoint
2008-04-19 22:06 . 2003-09-29 12:31 94,601 --a------ C:\WINDOWS\system32\drivers\Apfiltr.sys
2008-04-19 22:06 . 2003-06-02 23:55 87,821 --a------ C:\WINDOWS\system32\Vxdif.dll
2008-04-19 22:03 . 2008-04-19 22:03 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-04-19 22:03 . 2008-04-19 22:03 <DIR> d-------- C:\WINDOWS\system32\restore
2008-04-19 22:03 . 2008-04-19 22:03 <DIR> d-------- C:\WINDOWS\srchasst
2008-04-19 22:03 . 2008-04-19 22:03 <DIR> d-------- C:\Program Files\microsoft frontpage
2008-04-19 20:43 . 2008-04-19 20:43 <DIR> d-------- C:\Program Files\PC Drivers HeadQuarters
2008-04-19 20:43 . 2008-04-19 20:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2008-04-19 18:57 . 2008-05-01 05:28 <DIR> d-------- C:\Documents and Settings\Administrator\Tracing
2008-04-19 18:48 . 2008-04-30 14:36 1,002 --a------ C:\WINDOWS\adiras.ini
2008-04-19 18:47 . 2008-04-19 18:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ESET
2008-04-19 18:46 . 2008-04-30 03:12 <DIR> d-------- C:\Program Files\ESET
2008-04-19 18:46 . 2008-04-19 18:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-04-19 18:34 . 2004-03-04 11:51 64,512 --a------ C:\WINDOWS\system32\drivers\tifmsony.sys
2008-04-19 18:34 . 2000-11-09 18:15 48,896 --a------ C:\WINDOWS\system32\drivers\SonyNC.sys
2008-04-19 18:32 . 2008-04-19 18:32 268 --ah----- C:\sqmdata05.sqm
2008-04-19 18:32 . 2008-04-19 18:32 244 --ah----- C:\sqmnoopt05.sqm
2008-04-19 18:30 . 2008-04-19 18:31 <DIR> d-------- C:\Program Files\Common Files\OII
2008-04-19 18:30 . 2003-03-14 09:12 279,680 --a------ C:\WINDOWS\system32\drivers\oivmvcom.sys
2008-04-19 18:30 . 2003-01-06 16:20 15,616 --a------ C:\WINDOWS\system32\drivers\oivmctrl.sys
2008-04-19 18:29 . 2005-10-20 11:11 991,232 --a------ C:\WINDOWS\system32\W22MLRES.DLL
2008-04-19 18:23 . 2008-04-19 18:23 268 --ah----- C:\sqmdata04.sqm
2008-04-19 18:23 . 2008-04-19 18:23 244 --ah----- C:\sqmnoopt04.sqm
2008-04-19 18:22 . 2008-04-19 18:22 <DIR> d-------- C:\Program Files\Intel
2008-04-19 18:19 . 2008-04-19 18:19 268 --ah----- C:\sqmdata03.sqm
2008-04-19 18:19 . 2008-04-19 18:19 244 --ah----- C:\sqmnoopt03.sqm
2008-04-19 18:16 . 2008-04-19 18:32 <DIR> d-------- C:\WINDOWS\ATK0100
2008-04-19 18:16 . 2006-06-14 10:17 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-19 18:16 . 2004-08-03 22:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2008-04-19 18:16 . 2006-06-14 09:50 6,272 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-04-19 18:16 . 2008-04-19 18:16 268 --ah----- C:\sqmdata02.sqm
2008-04-19 18:16 . 2008-04-19 18:16 244 --ah----- C:\sqmnoopt02.sqm
2008-04-19 18:14 . 2008-04-19 18:14 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2008-04-19 18:10 . 2008-04-19 18:10 268 --ah----- C:\sqmdata01.sqm
2008-04-19 18:10 . 2008-04-19 18:10 244 --ah----- C:\sqmnoopt01.sqm
2008-04-19 18:07 . 2008-04-23 18:06 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-04-19 18:07 . 2008-04-19 18:07 <DIR> d-------- C:\Program Files\ATI Technologies
2008-04-19 18:07 . 2008-04-19 18:07 268 --ah----- C:\sqmdata00.sqm
2008-04-19 18:07 . 2008-04-19 18:07 244 --ah----- C:\sqmnoopt00.sqm
2008-04-19 18:06 . 2008-04-19 18:06 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-04-19 18:04 . 2004-08-03 23:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-04-19 18:03 . 2008-04-19 18:03 <DIR> d-------- C:\Program Files\Windows Live
2008-04-19 18:03 . 2008-04-19 18:03 <DIR> d-------- C:\Program Files\SLD Codec Pack
2008-04-19 18:03 . 2008-04-22 08:35 <DIR> d-------- C:\Program Files\Internet Download Manager
2008-04-19 18:02 . 2008-04-19 18:02 <DIR> d-------- C:\Program Files\Real Alternative
2008-04-19 18:02 . 2008-04-19 18:02 <DIR> d-------- C:\Program Files\Media Player Classic
2008-04-19 18:02 . 2008-04-19 18:02 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-04-19 18:02 . 2008-04-19 18:02 <DIR> d-------- C:\Program Files\Foxit Software
2008-04-19 18:02 . 2008-04-19 18:02 <DIR> d-------- C:\Program Files\ADSoft
2008-04-19 18:02 . 2008-04-19 18:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ADSoft
2008-04-19 18:01 . 2008-04-19 18:02 <DIR> d-------- C:\Program Files\Java
2008-04-19 18:01 . 2008-04-19 18:01 <DIR> d-------- C:\Program Files\Common Files\Java
2008-04-19 18:00 . 2008-04-19 18:00 <DIR> d-------- C:\Program Files\Nero
2008-04-19 18:00 . 2008-04-19 18:00 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-04-19 18:00 . 2007-10-26 07:05 3,036,456 --a------ C:\WINDOWS\system32\BCGCBPRO860u80.dll
2008-04-19 18:00 . 2006-03-17 10:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll
2008-04-19 18:00 . 2006-03-17 10:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll
2008-04-19 18:00 . 2006-03-17 10:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll
2008-04-19 18:00 . 2006-03-17 13:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll
2008-04-19 18:00 . 2006-03-17 10:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll
2008-04-19 18:00 . 2007-10-26 07:05 33,576 --a------ C:\WINDOWS\system32\BCGPOleAcc.dll
2008-04-02 08:53 . 2008-04-02 08:53 642,560 --a------ C:\WINDOWS\system32\sysdm.cpl
2008-04-02 08:52 . 2008-04-02 08:52 2,276,352 --a------ C:\WINDOWS\system32\logonui.exe
2008-04-01 19:41 . 2008-04-01 19:41 218,624 --a------ C:\WINDOWS\system32\uxtheme.dll
2008-04-01 19:41 . 2008-04-01 19:41 140,288 --a------ C:\WINDOWS\system32\sfc_os.dll
2008-04-01 19:40 . 2008-04-01 19:40 1,050 --a------ C:\WINDOWS\system32\mmdriver.inf
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-01 04:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DMCache
2008-04-30 13:37 476 ----a-w C:\WINDOWS\system32\drivers\cmvep.txt
2008-04-30 13:37 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-04-19 18:59 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ma-config.com
2008-04-19 18:58 --------- d-----w C:\Program Files\ma-config.com
2008-04-19 18:21 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IDM
2008-04-19 16:59 --------- d-----w C:\Program Files\Opera
2008-04-19 16:59 --------- d-----w C:\Program Files\My Company Name
2008-04-19 16:59 --------- d-----w C:\Program Files\Driver-Soft
2008-04-19 16:54 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-04-19 16:49 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\Notepad++
2008-04-19 16:49 --------- d-----w C:\Program Files\STYLER
2008-04-19 16:49 --------- d-----w C:\Program Files\RocketDock
2008-04-19 16:49 --------- d-----w C:\Program Files\Notepad2
2008-04-19 16:49 --------- d-----w C:\Program Files\Notepad++
2008-04-19 16:49 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Notepad++
2008-04-19 16:48 --------- d-----w C:\Program Files\System
2008-04-19 16:42 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-04-01 18:40 984,576 ----a-w C:\WINDOWS\system32\syssetup.dll
2008-03-29 09:12 7,579,136 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-03-29 09:12 3,368,960 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-03-29 09:12 279,552 ----a-w C:\WINDOWS\system32\upnpui.dll
2008-03-29 09:12 2,237,952 ----a-w C:\WINDOWS\system32\netshell.dll
2008-03-29 09:12 166,912 ----a-w C:\WINDOWS\system32\sndvol32.exe
2008-03-29 09:12 1,514,496 ----a-w C:\WINDOWS\explorer.exe
2008-03-28 19:13 74,240 ----a-w C:\WINDOWS\system32\notepad.exe
2008-03-28 19:13 74,240 ----a-w C:\WINDOWS\NOTEPAD.EXE
2008-03-28 19:13 517,120 ----a-w C:\WINDOWS\system32\wiaacmgr.exe
2008-03-28 19:13 367,616 ----a-w C:\WINDOWS\system32\mspaint.exe
2008-03-28 19:13 315,864 ----a-w C:\WINDOWS\system32\wuauclt1.exe
2008-03-28 19:13 186,880 ----a-w C:\WINDOWS\system32\sysocmgr.exe
2008-03-28 19:13 121,344 ----a-w C:\WINDOWS\system32\calc.exe
2008-03-28 19:12 2,789,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-03-27 19:48 284,672 ----a-w C:\WINDOWS\regedit.exe
2008-03-27 19:02 824,320 ----a-w C:\WINDOWS\system32\wiashext.dll
2008-03-27 19:02 509,952 ----a-w C:\WINDOWS\system32\shimgvw.dll
2008-03-27 19:02 143,360 ----a-w C:\WINDOWS\system32\st.dll
2008-03-27 16:15 7,159,808 ----a-w C:\WINDOWS\system32\Logon.scr
2008-03-27 15:32 --------- d-----w C:\Program Files\TrueTransparency
2008-03-23 13:24 --------- d-----w C:\Program Files\Mummy Maze Deluxe
2008-03-23 13:24 --------- d-----w C:\Program Files\Luxor 2
2008-03-23 13:24 --------- d-----w C:\Program Files\Bricks of Egypt 2
2008-03-20 08:16 2,344,960 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-03-19 17:45 857,088 ----a-w C:\WINDOWS\system32\winbrand.dll
2007-08-07 22:49 100,247 ----a-w C:\WINDOWS\system32\config\systemprofile\xmlUpdater.exe
2007-08-07 22:49 100,247 ----a-w C:\Documents and Settings\Default User\xmlUpdater.exe
2007-08-07 22:49 100,247 ----a-w C:\Documents and Settings\Administrator\xmlUpdater.exe
.
------- Sigcheck -------
2008-04-02 10:07 2225792 2f37894aeb0f167b556e0a9a37ad491e C:\WINDOWS\system32\ntkrnlpa.exe
2008-03-20 09:16 2344960 497b9f0053becb485d0f6d57bc792156 C:\WINDOWS\system32\ntoskrnl.exe
2008-03-29 10:12 1514496 2fc27528fab09949d37cfba7a1fb85b0 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((( snapshot_2008-04-24_15.38.34,21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-01-28 13:42:30 1,531,904 ----a-w C:\WINDOWS\adiras.exe
+ 2003-01-30 05:48:24 143,360 ----a-w C:\WINDOWS\autoclk.exe
- 2008-04-24 13:33:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-01 04:27:34 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2005-10-20 19:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
- 2000-08-31 06:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 07:00:00 28,160 ----a-w C:\WINDOWS\Nircmd.exe
- 2000-08-31 06:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2000-08-31 07:00:00 161,792 ----a-w C:\WINDOWS\swreg.exe
+ 2001-02-08 08:05:30 46,892 ----a-w C:\WINDOWS\system32\adadix16.dll
+ 2001-02-09 07:43:10 4,981 ----a-w C:\WINDOWS\system32\adadix2k.dll
+ 2002-05-09 15:12:54 155,648 ----a-w C:\WINDOWS\system32\adadix32.dll
+ 2002-11-15 11:33:30 126,976 ----a-w C:\WINDOWS\system32\coclassfast.dll
+ 2004-03-02 08:26:58 50,007 ----a-w C:\WINDOWS\system32\drivers\adildr.sys
+ 2004-03-02 08:24:16 127,065 ----a-w C:\WINDOWS\system32\drivers\adiusbaw.sys
+ 2001-05-24 16:24:40 22,395 ----a-w C:\WINDOWS\system32\drivers\fpga.bin
+ 2001-07-27 13:25:20 127,456 ----a-w C:\WINDOWS\system32\ipdetect.exe
- 2008-04-19 17:36:39 58,930 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-30 11:22:59 58,930 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-19 17:36:39 392,630 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-30 11:22:59 392,630 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2004-06-28 10:59:46 114,688 ----a-w C:\WINDOWS\system32\unaddrv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360]
"MsnMsgr"="C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" [2007-11-07 14:34 3739672]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-02-06 23:03 935344]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaDrive"="C:\WINDOWS\VistaDrive\VistaDrive.exe" [2006-10-05 19:56 280779]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 03:25 144784]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 11:00 335872]
"Hcontrol"="C:\WINDOWS\ATK0100\Hcontrol.exe" [2005-10-20 11:11 61440]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 16:21 114688]
"Mouse Suite 98 Daemon"="ICO.EXE" []
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 15:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-03 23:56 143360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="regsvr32 /s /n /i:u shell32" []
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\
RocketDock.lnk - C:\Program Files\RocketDock\RocketDock.exe [2008-04-19 17:49:21 495616]
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
RocketDock.lnk - C:\Program Files\RocketDock\RocketDock.exe [2008-04-19 17:49:21 495616]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe [2008-04-30 14:36:27 962661]
TrueTransparency.lnk - C:\Program Files\TrueTransparency\TrueTransparency.exe [2008-04-19 17:49:30 133120]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"LockTaskbar"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"LockTaskbar"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll
"msacm.ac3acm"= ac3acm.acm
"msacm.lameacm"= lameACM.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2008-04-21 09:02]
R3 oibtvcom;Bluetooth Virtual COM Port;C:\WINDOWS\system32\Drivers\oivmvcom.sys [2003-03-14 09:12]
R3 oivmctrl;VCOMM Device Controller;C:\WINDOWS\system32\Drivers\oivmctrl.sys [2003-01-06 16:20]
R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\system32\DRIVERS\SonyPI.sys [2003-06-18 15:12]
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-05-01 05:42:29
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-05-01 5:44:25
ComboFix-quarantined-files.txt 2008-05-01 04:44:19
ComboFix2.txt 2008-04-24 13:38:47
ComboFix3.txt 2008-04-19 20:11:39
Pre-Run: 17,855,758,336 bytes free
Post-Run: 17,855,442,944 bytes free
274





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:49:28, on 01/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT User Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
O4 - Global Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5B1436-3825-4574-BD34-E9801A546E1C}: NameServer = 193.95.122.40 193.95.93.77
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
--
End of file - 5463 bytes




اكرر شكري لكم جميعا لتواصلكم معي


k:k:k:​

 

[المانسي]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:49:28, on 01/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT User Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
O4 - Global Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5B1436-3825-4574-BD34-E9801A546E1C}: NameServer = 193.95.122.40 193.95.93.77
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
--
End of file - 5463 bytes




اكرر شكري لكم جميعا لتواصلكم معي



k:k:k:

قم بتعطيل التالي

O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

طريقة الحذف

ثم نزل هذه الاداة واتبع الشرح التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط

شرح الاستخدام ,,,,,,
عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))

حمل هذه الاداة ,,
واتبع الشرح التالي ,, لتنظيف جهازك من هذه الدعايات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,

رابط تحميل آخر تحديث للاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

ثم اعمل تقرير اخر هايجيك

بالتوفيق​

 

[achour]

قم بتعطيل التالي

O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

طريقة الحذف

ثم نزل هذه الاداة واتبع الشرح التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبيفقط

شرح الاستخدام ,,,,,,
عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))

حمل هذه الاداة ,,
واتبع الشرح التالي ,, لتنظيف جهازك من هذه الدعايات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,

رابط تحميل آخر تحديث للاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

ثم اعمل تقرير اخر هايجيك


بالتوفيق

تفضل اخي ومشكورين على المتابعة


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:45, on 02/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT User Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
O4 - Global Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5B1436-3825-4574-BD34-E9801A546E1C}: NameServer = 193.95.122.40 193.95.93.77
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5161 bytes
​

 

[المانسي]

تفضل اخي ومشكورين على المتابعة​

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:45, on 02/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT User Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
O4 - Global Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5B1436-3825-4574-BD34-E9801A546E1C}: NameServer = 193.95.122.40 193.95.93.77
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 5161 bytes​

حياك الله

قم بتعطيل التالي ( ارجو التأكد من القيم قبل الحذف )

O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')

O17 - HKLM\System\CCS\Services\Tcpip\..\{3A5B1436-3825-4574-BD34-E9801A546E1C}: NameServer =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[achour]

السلام عليكم
تم عمل المطلوب اخي المانسي وحذفت القيم لكن للأسف المشكلة ذاتها وقائمةالى حدالان
والله لم اعداعرف ماذا افعل هل القي بالروتور الجديد ؟؟

:er::f::er::f::er::f:
​

 

[achour]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:28:57, on 06/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\VistaDrive\VistaDrive.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
C:\Program Files\TrueTransparency\TrueTransparency.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\Zyzoom_HijackThis.exe
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - .DEFAULT User Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 900-908\dslmon.exe
O4 - Global Startup: TrueTransparency.lnk = C:\Program Files\TrueTransparency\TrueTransparency.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
--
End of file - 4696 bytes

 

[المانسي]

التقرير جيد

شوف الرابط التالي لمشكلة الماسنجر لديك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وانصحك بتركيب برنامج كاسبر 7 وتحديثه وفحص جهازك بالكامل

بالتوفيق

 

[achour]

بسم الله الرحمن الرحيم

السلام عليكم ورحمة الله وبركاته


تم القضاء على المشكلة والحمد لله وذلك بفضل مساعدة اخي المانسي اكرمه الله وكذلك جهود المشرفين القائمين والساهرين على ادارة هذا المنتدى او بالأحرى الصرح العظيم والشامخ في سماء المنتديات العربية
اجدد شكري للجميع وسعيد بإنضمامي لأسرتكم
يومكم سعيد​

 

[زيزوووم]

الحمد لله يوم زبطت امور جهازك
وسعداء بانضمامك معنا


ويجب عليك استخدام هذه الاداة ... لأن عندك حضر قي بعض خصائص النظام

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي