أعذب من الحلم

زيزوومي جديد
إنضم
4 سبتمبر 2007
المشاركات
39
مستوى التفاعل
1
النقاط
40
غير متصل
السلام عليكم

دورت البرنامج فى البرقرم فايل ما حصلته

دورته فى اضافه وازاله ماحصلته

دورته فى قائمه البرامج ما لقيته عقدنى

كل ما اشغل الجاهز بوجهى ابى احذفهم ارجوكم او اداه عطونى

zyzoom-d4ddf64bb7.jpg



انتظركم ع عجل
 

ابدأ
تشغيل
أكتب الأمر
msconfig
بعدها تخرج لك نافذة
اختر
بدء التشغيل
ابحث عن اسم البرنامج​

ثم إلغ علامة الصح​

ثم موافق​

أعد التشغيل​


وشوف ماراح يشغل البرنامج مع بدء التشغيل​

هل البرنامج بروتبال ؟؟​
 
توقيع : KinXG BlacK
وع فكره عندى مستخدمين ع الجهاز


ما يطلع الا بمستخدم واحد


والكاسبر عندى 100%
 
ابدأ

تشغيل
أكتب الأمر
msconfig
بعدها تخرج لك نافذة
اختر
بدء التشغيل
ابحث عن اسم البرنامج​

ثم إلغ علامة الصح​

ثم موافق​

أعد التشغيل​


وشوف ماراح يشغل البرنامج مع بدء التشغيل​


هل البرنامج بروتبال ؟؟​


جزاك الله الف خير


اعرف ها الطريقه

بس ابي احذفه وين احصله وشلون
 
وياليت
تقرير هايجاك
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات .. ويظهر لك تقرير ==> انسخه والصقه بردك القادم


 
توقيع : KinXG BlacK
Trend Micro End User License Agreement
Software: HijackThis
Version: English/Multi-country
Date: April 2007

IMPORTANT: YOU MUST CAREFULLY READ AND AGREE TO ALL TERMS AND
CONDITIONS OF THE FOLLOWING END USER LICENSE AGREEMENT BEFORE
INSTALLING OR USING THE SOFTWARE.
THIS AGREEMENT SETS FORTH THE TERMS AND CONDITIONS UNDER WHICH
TREND MICRO IS WILLING TO LICENSE THE "SOFTWARE" TO "YOU" AS AN
INDIVIDUAL USER OR AN AUTHORIZED REPRESENTATIVE OF AN ENTITY.
BY CLICKING THE "I ACCEPT" BUTTON BELOW, YOU ARE EXPRESSING YOUR
INTENT TO ENTER INTO, AND ARE ENTERING INTO, A BINDING LEGAL
CONTRACT ("AGREEMENT") BETWEEN YOU AND TREND MICRO
INCORPORATED OR ONE OF ITS AFFILIATES ("TREND MICRO"). THE TERMS
AND CONDITIONS OF THE AGREEMENT THEN APPLY TO YOUR USE OF THE
SOFTWARE. WE ENCOURAGE YOU TO PRINT A COPY OF THE AGREEMENT FOR
YOUR RECORDS
YOU MUST ACCEPT THIS AGREEMENT BEFORE YOU INSTALL OR USE THE
SOFTWARE. IF YOU ARE ACQUIRING THE SOFTWARE ON BEHALF OF AN ENTITY, THEN YOU
MUST BE PROPERLY AUTHORIZED TO REPRESENT THAT ENTITY AND TO
ACCEPT THIS AGREEMENT ON ITS BEHALF.
YOU ACCEPT THIS END USER LICENSE BY CLICKING THE "I ACCEPT" BUTTON
BELOW. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, SELECT
"I DO NOT ACCEPT". YOU WILL THEN NOT BE PERMITTED TO INSTALL OR USE
THE SOFTWARE.
1. LICENSE. Upon Your acceptance of the terms and conditions of this Agreement,
Trend Micro hereby grants You a nonexclusive, nontransferable, non-sublicensable,
royalty-free, worldwide license, to download, install the Software, for Your own use only.
Trend Micro reserves the right to enhance, modify, or discontinue the Software or to
impose new or different conditions on its use at any time without notice.
2. USE RESTRICTIONS AND OWNERSHIP. The Software is licensed not sold. Trend
Micro owns the title and intellectual property rights to the Software, and reserves all rights
not expressly granted to You in this Agreement. You agree that you will not rent, loan,
lease or sublicense the Software. You agree not to attempt to reverse engineer,
decompile, modify, translate, disassemble, discover the source code of, or create
derivative works from, any part of the Software or authorize others to undertake any of
these acts.
3. BACKUP. For as long as You use the Software, You agree to regularly back-up Your
computer programs and files ("Data") on a separate media. You acknowledge that the
failure to do so may cause You to lose Data in the event that any error in the Software
causes computer problems, and that Trend Micro is not responsible for any such Data
loss.
4. TERMINATION. Trend Micro may terminate the license at any time for any reason.
Upon such termination, You agree to delete or destroy all copies of the Software. You
may terminate this Agreement at any point by destroying or deleting all copies of the
Software.
5. REPORTS AND PRIVACY. At any time during the term of this Agreement, You may
choose to send to Trend Micro a report of log files that may include personal information
that the Software scanned on Your computer. By accepting this Agreement, You hereby
give Your consent to Trend Micro to process log file data provided by You ("Information")
in connection with this Agreement; processing may include collection, registration,
storage, modification or disclosure of such Information to third parties. As a condition to
using the Software and by accepting this Agreement, You ensure, represent and warrant
that You are legally permitted to provide Trend Micro with access to the Information and
You also give Your consent to Trend Micro to transfer or store the Information in one or
more of its group companies, located in and/or outside the country where You are
located, and/or in jurisdictions which may have a lower level of protection of Information
than is applicable in the country where You are located or where pr
ivacy laws may not be as stringent as those in Your own country.
6. CAUTION AND ACKNOWLEDGEMENT. The Software is designed to identify different
types of files, operating system changes, registry or browser settings, which, in Trend
Micro's judgment, may compromise computer security or productivity. You agree that
Trend Micro shall not be responsible for any removal or disabling of files or settings or the
results of such removal or disabling. You are solely responsible for selecting which files or
settings to remove from Your computer.
7. NO WARRANTY. THE SOFTWARE IS PROVIDED "AS IS," WITHOUT
WARRANTIES OF ANY KIND. TREND MICRO DOES NOT WARRANT THAT YOUR
USE OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR FREE. TO THE
FULLEST EXTENT PERMITTED BY APPLICABLE LAW, TREND MICRO DISCLAIMS
AND EXCLUDES ALL REPRESENTATIONS AND WARRANTIES WITH RESPECT TO
THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO IMPLIED WARRANTIES OF NONINFRINGEMENT OF THIRD PARTY RIGHTS,
SATISFACTORY QUALITY, MERCHANTABILITY, AND FITNESS FOR A
PARTICULAR PURPOSE.
8. NO LIABILITY FOR CONSEQUENTIAL DAMAGES.
(A) TREND MICRO DOES NOT SEEK TO LIMIT OR EXCLUDE ITS LIABILITY IN THE
EVENT OF DEATH OR PERSONAL INJURY CAUSED BY ITS NEGLIGENCE OR FOR
FRAUD OR FOR ANY OTHER LIABILITY FOR WHICH IT IS NOT PERMITTED BY
LAW TO EXCLUDE.
(B) TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, TREND MICRO
DISCLAIMS ALL LIABILITY FOR CONSEQUENTIAL, SPECIAL, INCIDENTAL OR
INDIRECT DAMAGES OF ANY KIND OR FOR LOST OR CORRUPTED DATA OR
MEMORY, SYSTEM CRASH, DISK/SYSTEM DAMAGE, LOST PROFITS OR
SAVINGS, OR LOSS OF BUSINESS, ARISING OUT OF OR RELATED TO THIS
AGREEMENT. YOU ALSO UNDERSTAND AND AGREE THAT YOU DOWNLOAD,
INSTALL AND/OR USE THE SOFTWARE AT YOUR OWN DISCRETION AND RISK
AND THAT YOU WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR
COMPUTER SYSTEM OR LOSS OF DATA THAT RESULTS FROM THE USE OF THE
SOFTWARE.
9. CONSUMER PROTECTION AND PRIVACY. SOME COUNTRIES, STATES AND
PROVINCES, INCLUDING MEMBER STATES OF THE EUROPEAN ECONOMIC
AREA, DO NOT ALLOW CERTAIN EXCLUSIONS OR LIMITATIONS OF LIABILITY, SO
THE ABOVE DISCLAIMER OF WARRANTY AND EXCLUSION OR LIMITATION OF
LIABILITIES (SECTIONS 7 AND 8) MAY NOT FULLY APPLY TO YOU. YOU MAY
HAVE ADDITIONAL RIGHTS AND REMEDIES. SUCH POSSIBLE RIGHTS OR
REMEDIES, IF ANY, SHALL NOT BE AFFECTED BY THIS AGREEMENT. THERE
MAY BE MANDATORY REGULATIONS OR LEGAL PROVISIONS THAT ARE
APPLICABLE TO YOU AS A CONSUMER.
10. COMPLIANCE WITH ALL LAWS, EXPORT CONTROL. The Software is subject to
export controls under the U.S. Export Administration Regulations. The Software may not
be exported or re-exported to entities within, or residents or citizens of, embargoed
countries or countries subject to applicable trade sanctions, nor to prohibited or denied
persons or entities without proper government licenses. Information about such
restrictions can be found at the following websites:
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
and
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي
. You are responsible
for any violation of the US export control laws related to Your copy of the Software. By
accepting this Agreement, You confirm that You are not a resident or citizen of any
country currently embargoed by the U.S. and that You are not otherwise prohibited from
receiving the Software.
11. U.S. GOVERNMENT RESTRICTED RIGHTS. If the entity on whose behalf You are
acquiring the Software is any unit or agency of the United States Government, then that
Government entity acknowledges that the Software, (i) was developed at private
expense, (ii) is commercial in nature, (iii) is not in the public domain, and (iv) is "Restricted
Computer Software" as that term is defined in Clause 52.227 19 of the Federal
Acquisition Regulations (FAR) and is "Commercial Computer Software" as that term is
defined in Subpart 227.471 of the Department of Defense Federal Acquisition Regulation
Supplement (DFARS). The Government agrees that (i) if the Software is supplied to the
Department of Defense (DoD), the Software is classified as "Commercial Computer
Software" and the Government is acquiring only "restricted rights" in the Software and its
documentation as that term is defined in Clause 252.227 7013(c)(1) of the DFARS, and
(ii) if the Software is supplied to any unit or agency of the United States Government ot
her than DoD, the Government's rights in the Software and its documentation will be as
defined in Clause 52.227 19(c)(2) of the FAR.
12. GOVERNING LAW. Unless otherwise required by the specific jurisdiction’s laws,
this Agreement will be governed by the laws of the State of California, USA, without
regard to the provisions of the United Nations Convention on Contracts for the
International Sale of Goods and the conflict of laws provisions of Your state or country of
residence.
13. GENERAL PROVISIONS. This is the entire agreement between You and Trend
Micro with respect to the subject matter hereof and supersedes and replaces all prior or
contemporaneous understandings or agreements regarding such subject matter. Any
waiver of any provision of this Agreement will be effective only if in writing and signed by
Trend Micro. In the event that any provision or portion of this Agreement is found to be
invalid, that finding will not affect the validity of the remaining parts of this Agreement.
Trend Micro may assign or subcontract some or all of its obligations under this Agreement
to qualified third parties or its affiliates and/or subsidiaries, provided that no such
assignment or subcontract shall relieve Trend Micro of its obligations under this
Agreement.
14. QUESTIONS. Address all questions about this Agreement to:
legalnotice@trendmicro.com.

The Software is protected by copyright, trade secret and U.S. PATENT laws, and
international treaty provisions. UNAUTHORIZED REPRODUCTION OR DISTRIBUTION
IS SUBJECT TO CIVIL AND CRIMINAL PENALTIES.
 
لايوجد اسم للبرنامج فى بدء التشغيل

ما الحل ؟
 
؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟
 

( 1 )

عطل جميع برامج الحماية ,,
وحمل هذه الاداة واحفظها على سطح المكتب
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes​

انتظر حتى الاداة تنتهي من فحص جهازك ,,, وبشكل تلقائي يعاد تشغيل جهازك ,,
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
انتظر حتى يظهر لك تقرير ,, انسخه والصقه بردك القادم

--------------------------------------------


( 2 )


واعمل تقرير للهايجاك
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي




اذا انتهى التحميل ==> شغل البرنامج ==> واضغط على Do a system scan and save log
لحظات ويظهر لك تقرير ,, انسخه والصقه بردك القادم
 
ComboFix 08-05-25.5 - user 05/26/2008 19:38:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.177 [GMT 3:00]
Running from: C:\Documents and Settings\user\سطح المكتب\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\قائمة ابدأ\Online Security Guide.url
C:\Documents and Settings\All Users\قائمة ابدأ\Security Troubleshooting.url
C:\Documents and Settings\user\Favorites\Online Security Test.url
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Uninst.exe
C:\Program Files\Video Add-on
C:\Program Files\Video Add-on\ot.ico
C:\Program Files\Video Add-on\Thumbs.db
C:\Program Files\Video Add-on\ts.ico
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
.
((((((((((((((((((((((((( Files Created from 2008-04-26 to 2008-05-26 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 16:46 36,789,792 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-26 16:46 1,256,992 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-26 13:09 495,332 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-05-26 13:09 263,768 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-05-26 13:09 --------- d-----w C:\Documents and Settings\NOURA\Application Data\Free Download Manager
2008-05-26 11:17 --------- d-----w C:\Documents and Settings\user\Application Data\Apple Computer
2008-05-25 10:39 --------- d-----w C:\Documents and Settings\NOURA\Application Data\Vso
2008-05-24 22:17 --------- d-----w C:\Program Files\LabelCommand
2008-05-24 22:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adsl Software Limited
2008-05-19 18:19 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-18 21:07 --------- d-----w C:\Documents and Settings\NOURA\Application Data\skypePM
2008-05-18 20:56 --------- d-----w C:\Documents and Settings\NOURA\Application Data\Skype
2008-04-21 20:27 --------- d-----w C:\Documents and Settings\NOURA\Application Data\Talkback
2008-04-21 20:26 --------- d-----w C:\Program Files\Common Files\xing shared
2008-04-21 20:26 --------- d-----w C:\Program Files\Common Files\Real
2008-04-21 20:25 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-04-21 20:25 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-04-21 06:49 --------- d-----w C:\Documents and Settings\NOURA\Application Data\Apple Computer
2008-04-18 17:30 --------- d-----w C:\Program Files\iTunes
2008-04-18 17:30 --------- d-----w C:\Program Files\iPod
2008-04-18 17:27 --------- d-----w C:\Program Files\QuickTime
2008-04-18 16:30 --------- d-----w C:\Program Files\Safari
2008-04-18 09:01 --------- d-----w C:\Program Files\Apple Software Update
2008-04-05 22:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-31 14:08 --------- d-----w C:\Documents and Settings\user\Application Data\Toshiba
2008-03-28 10:09 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-03-20 08:04 1,845,120 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-08 20:45 0 ----a-w C:\Program Files\MultiTransefind.ini
2008-02-25 23:16 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-07-28 16:31 56 --sh--r C:\WINDOWS\system32\1EB1EE6CCA.sys
2007-07-28 16:31 2,098 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{18CB1A7B-94CD-4582-8022-ADA16851E44B}]
03/27/2008 04:04 PM 247296 --a------ C:\Program Files\LabelCommand\LabelCommand.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM 15360]
"AFProg"="C:\Program Files\AnchorFree\bin\ctrl\AFController.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 03:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [10/07/2005 02:13 PM 176128]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [06/29/2006 12:13 PM 1032192]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [06/06/2006 05:09 PM 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [06/06/2006 05:06 PM 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [06/06/2006 05:10 PM 118784]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [10/18/2006 06:04 PM 802816]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [10/18/2006 05:58 PM 696320]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe" [03/08/2005 07:42 AM 176128]
"kav"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [03/03/2006 05:58 PM 135271]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/21/2008 11:25 PM 185896]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 03:56 AM 15360]
C:\Documents and Settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-07-30 17:27:17 113664]
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-09-15 21:45:30 1720320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^PalStart.lnk]
backup=C:\WINDOWS\pss\PalStart.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 07/09/2001 10:50 AM 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 03/28/2008 11:37 PM 413696 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 11/02/2004 08:24 PM 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 02/01/2008 05:22 PM 21898024 C:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 04/21/2008 11:25 PM 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 07/16/2007 03:17 PM 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
S3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system32\DRIVERS\tapvpn.sys [06/08/2007 09:52 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{650b924f-4517-11dc-8726-0010c6919f2d}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL rose.exe
*Newly Created Service* - CATCHME
.
s of the 'Scheduled Tasks' folder
"2008-05-02 14:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-04-18 16:10:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-26 16:24:31 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\BrOnZ Patch Pro\XoftSpySE\XoftSpy.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-05-26 19:46:23
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 05/26/2008 19:48:14
ComboFix-quarantined-files.txt 2008-05-26 16:48:06
Pre-Run: 20,685,410,304 bytes free
Post-Run: 21,159,784,448 bytes free
158
 
التقرير الثاني


Logfile of HijackThis v1.99.1
Scan saved at 07:52:13 م, on 26/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\user\LOCALS~1\Temp\Rar$EX00.546\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=212.93.193.74:8080
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: LabelCommand module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Program Files\LabelCommand\LabelCommand.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: مساعد تسجيل الدخول إلى Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIEsBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: (no name) - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - (no file)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AFProg] C:\Program Files\AnchorFree\bin\ctrl\AFController.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Update Page - C:\Program Files\Ict\AcceleNet\page.htm
O8 - Extra context menu item: View All Originals On Page - C:\Program Files\Ict\AcceleNet\getoriginal.htm
O8 - Extra context menu item: View Original Image - C:\Program Files\Ict\AcceleNet\getoriginal.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
 
في الاداة الاولى لم يعد تشغيل الجهاز

ظهر التقرير مباشره

ارجو سرعة التجاوب

وشكرا
 
؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟


boob77 ؟؟؟؟؟؟؟
 
بالاضافة لكلاام الاحبه


شوف ياغالي ,,, عطل برامج الحماية
وحمل هذه الاداة ,,
واتبع الشرح التالي ,, لتنظيف جهازك من هذه الدعايات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,

رابط تحميل آخر تحديث للاداة
يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي



شرح الاستخدام ,,,,,,
قم بتشغيل الملف SmitfraudFix.exe ,, وتابع الشرح كماا بهذه الصور

000.png





001.png





002.png





003.png





004.png





005.png
 
حدد هالقيم واحذفهاا

O2 - BHO: LabelCommand module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Program Files\LabelCommand\LabelCommand.dll

O3 - Toolbar: (no name) - {8113B5DE-F7EB-4154-A311-497FB80D8BD0} - (no file)

طريقة الحذف

wh_31752766.png


ثم نزل هالاداة لتنظيف الجهاز

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي


wh_15149054.png


اذا ماتعرف هالبرنامج احذفه

Ict\AcceleNet\

بعدهاا اعد التشغيل ونزل هالبرنامج واعمل فحص

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 
هذا التقرير

SmitFraudFix v2.323
Scan done at 12:39:04.56, Tue 05/27/2008
Run from C:\Documents and Settings\user\«ل¥ ںéêè¢ \SmitfraudFix\Policies.exe\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Intel(R) PRO/Wireless 2200BG Network Connection - منفذ مصغر لجدولة الحزم
DNS Server Search Order: 212.93.192.17
DNS Server Search Order: 212.93.192.10
HKLM\SYSTEM\CCS\Services\Tcpip\..\{A90E1CE6-2420-4FDE-9A93-81347EECCD1F}: DhcpNameServer=212.93.192.17 212.93.192.10
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A90E1CE6-2420-4FDE-9A93-81347EECCD1F}: DhcpNameServer=212.93.192.17 212.93.192.10
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A90E1CE6-2420-4FDE-9A93-81347EECCD1F}: DhcpNameServer=212.93.192.16 212.93.192.10
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.93.192.17 212.93.192.10
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.93.192.17 212.93.192.10
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.93.192.16 212.93.192.10

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End
 
طيب شو الحين الجهاز؟
 
عودة
أعلى