هذا تقرير جهازي

[أبو عماااد]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:44:36 ص, on 12/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\سطح المكتب\Zyzoom_HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: REALTEK RTL8187 Wireless LAN Utility.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: الدليل - {46012075-ED62-464b-9554-AD0BEC35D1EC} -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

(file missing)
O9 - Extra button: (no name) - {46012076-ED62-464b-9554-AD0BEC35D1EC} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACCBBD25-2B6F-447F-BFFD-08879FA7A5EB}: NameServer = 212.93.192.17 212.93.192.10
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
--
End of file - 5934 bytes

 

[Al jNtEeL]

حذفت القيم وشغلت الاداة السابقة واعاد التشغيل لكن ما هوراضي يشتغل معلق على ايقاف التشغيل

هل اضغط زر التشغيل واطفيه والا انتظر شوي الين يعيد من لوحده؟؟؟

احسن انتظر الله لايهينك

 

[أبو عماااد]

[FONT='Arial','sans-serif']تمام اعاد التشغيل لكن الصوت موجود ومعلق غير طفيته ودخلت عن طريق الوضع الامن لكن نفس المشكلة عندما اضغط على اداة الكومبو[/font]

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وعلى فكرة الكاسبر المفتاح حقه منتهي من قبل فترة يعني موجود من غير فايدة له شهر

 

[أبو عماااد]

up

 

[Al jNtEeL]

[FONT='Arial','sans-serif']تمام اعاد التشغيل لكن الصوت موجود ومعلق غير طفيته ودخلت عن طريق الوضع الامن لكن نفس المشكلة عندما اضغط على اداة الكومبو[/font]

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وعلى فكرة الكاسبر المفتاح حقه منتهي من قبل فترة يعني موجود من غير فايدة له شهر

هذا بأخليك تغيره لأنه قديم مرة

طيب أخوي لاهنت اعمل تقرير هايجاك جديد

 

[Demo-dashDemo-dash is verified member.]

ههههههههههههههههههههههههههههه

جنتل هذي القيم حقت المودم و نفس المودم الي انا شغال عليه

O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon

O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe

لاهنت رجعها ترا مابيشتغل النت , ههههههههههههههه

شغل الهاي جاك View list of back ups ورجع هالقيمييتن

اضن انها ماانحذفت اصلا عشان البروسسر شغال الان

تقريرك سليم حبيب قلبي بس ايش المشكله الحين بالظبط

 

[Demo-dashDemo-dash is verified member.]

معليش اخوان انا مضطر اطلع الان حصل طارئ , اسف جدا
نشوفكم على خير

 

[Al jNtEeL]

ههههههههههههههههههههههههههههه

جنتل هذي القيم حقت المودم و نفس المودم الي انا شغال عليه

O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon

O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe

لاهنت رجعها ترا مابيشتغل النت , ههههههههههههههه

شغل الهاي جاك View list of back ups ورجع هالقيمييتن

اضن انها ماانحذفت اصلا عشان البروسسر شغال الان

تقريرك سليم حبيب قلبي بس ايش المشكله الحين بالظبط

لا عآآدي لو تحذف مايضر

بس أي سليم الجهآآز مصآآب بفايروس amvo.exe الخطير جدآآ :hh::hh:

 

[Al jNtEeL]

معليش اخوان انا مضطر اطلع الان حصل طارئ , اسف جدا
نشوفكم على خير

مع ألف سلامة ونشوفك على خير يآآرب

 

[Demo-dashDemo-dash is verified member.]

amvo.exe
^^^
الله يفكنا من شره بس
:hh:

ابو عماد انا مضطر اطلع حصل طارئ , اسف اخوي
جنتل لااوصيك , انت قدها وقود
​

 

[أبو عماااد]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:34:39 ص, on 12/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\s\سطح المكتب\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [Privacy Suite] "C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\s\Application Data\CyberScrub\Privacy Suite"
O4 - HKCU\..\RunOnce: [ClearPageFileAtShutDown] "C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" -XP
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: REALTEK RTL8187 Wireless LAN Utility.lnk = ?
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: الدليل السريع - C:\WINDOWS\ww80.html
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll (file missing)
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
--
End of file - 6083 bytes

 

[Al jNtEeL]

amvo.exe
^^^
الله يفكنا من شره بس
:hh:

ابو عماد انا مضطر اطلع حصل طارئ , اسف اخوي
جنتل لااوصيك , انت قدها وقود
​

ولا يهمك بس اطلع وانت مطمأن :king:

مانيب فآآك الرجآآل إلا لما يطلع جهآآزه زي الفل :hh::hh::hh:

 

[Al jNtEeL]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:34:39 ص, on 12/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Safe mode
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\s\سطح المكتب\Zyzoom_HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\Conexant\Adsl\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Conexant\Adsl\dslagent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [Privacy Suite] "C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" "/R:C:\Documents and Settings\s\Application Data\CyberScrub\Privacy Suite"
O4 - HKCU\..\RunOnce: [ClearPageFileAtShutDown] "C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" -XP
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: REALTEK RTL8187 Wireless LAN Utility.lnk = ?
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: الدليل السريع - C:\WINDOWS\ww80.html
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll (file missing)
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
--
End of file - 6083 bytes

تقريرك كذا تمام ...

احذف بس هذي

O8 - Extra context menu item: الدليل السريع - C:\WINDOWS\ww80.html


شلنا الفايروس من بدء التشغيل وباقي نحذفه من الجهاز تماما

أخوي حمل أداة الكومبو مرة ثانية من النت وشغلها ويآآرب تشتغل ولاتنسى ترفق التقرير معها بتاع الكومبو :d:

 

[أبو عماااد]

ابشرك اشتغلت الاداة دقائق واعطيك التقرير

 

[Al jNtEeL]

ابشرك اشتغلت الاداة دقائق واعطيك التقرير

الحمد لله يآآرب الله يبشرك بالجنة

كنت متوقع أنه خطأ في تحميل الأداة

بنتظآآرك أخوي

 

[أبو عماااد]

هذا التقرير
ComboFix 08-07-12.2 - s 07/12/2008 9:48:28.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.363 [GMT 3:00]
Running from: C:\Documents and Settings\s\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\Documents and Settings\s\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\net32gdilib.dll
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-12 06:00 --------- d-----w C:\Documents and Settings\s\Application Data\cleaner
2008-07-12 05:20 --------- d-----w C:\Documents and Settings\s\Application Data\CyberScrub
2008-07-12 04:49 --------- d-----w C:\Documents and Settings\Administrator\Application Data\CyberScrub
2008-07-12 04:49 --------- d-----w C:\Documents and Settings\Administrator\Application Data\cleaner
2008-07-11 23:49 27,280 --sh--r C:\WINDOWS\system32\avpo0.dll
2008-07-11 09:56 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-07-11 09:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-11 09:56 --------- d-----w C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility
2008-07-11 00:45 --------- d-----w C:\Program Files\Paltalk Messenger
2008-07-09 02:18 --------- d-----w C:\Program Files\iVocalize Web Conference 4
2008-07-08 20:04 --------- d-----w C:\Documents and Settings\s\Application Data\ACD Systems
2008-06-25 13:38 --------- d-----w C:\Program Files\Google
2008-06-23 18:45 --------- d-----w C:\Documents and Settings\s\Application Data\COWON
2008-06-23 17:49 --------- d-----w C:\Documents and Settings\s\Application Data\Paltalk
2008-06-23 07:45 --------- d-----w C:\Program Files\CONEXANT
2008-06-23 06:45 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-06-23 06:44 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-23 06:44 172,032 ------w C:\WINDOWS\Setup1.exe
2008-06-23 06:41 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-23 06:38 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-23 06:38 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-23 06:38 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-23 06:38 --------- d-----w C:\Program Files\Common Files\Real
2008-06-23 06:37 --------- d-----w C:\Program Files\Real
2008-06-23 06:32 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-23 06:29 --------- d-----w C:\Program Files\VideoLAN
2008-06-23 06:28 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-06-23 06:28 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-06-23 06:28 47,104 ------w C:\WINDOWS\AKDeInstall.exe
2008-06-23 06:28 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-06-23 06:28 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-06-23 06:28 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-06-23 06:28 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-06-23 06:28 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-06-23 06:28 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-06-23 06:28 --------- d-----w C:\Program Files\Real_SC
2008-06-23 06:28 --------- d-----w C:\Program Files\mpegable
2008-06-23 06:27 --------- d-----w C:\Program Files\ss99names
2008-06-22 21:05 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-22 21:04 --------- d-----w C:\Program Files\Java
2008-06-22 21:04 --------- d-----w C:\Program Files\Common Files\Java
2008-06-22 21:02 --------- d-----w C:\Program Files\MSN Messenger
2008-06-22 21:00 --------- d-----w C:\Program Files\mqreeb
2008-06-22 20:58 209,920 ----a-w C:\WINDOWS\iun3401.exe
2008-06-22 20:58 --------- d-----w C:\Program Files\seah
2008-06-22 20:58 --------- d-----w C:\Program Files\Salheen
2008-06-22 20:58 --------- d-----w C:\Program Files\quran
2008-06-22 20:45 --------- d-----w C:\Program Files\Noble Quran with Tafsser v 2.0
2008-06-22 20:44 --------- d-----w C:\Program Files\Nokia
2008-06-22 20:44 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-22 20:44 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-22 20:43 --------- d-----w C:\Program Files\PhotoBuilder
2008-06-22 20:43 --------- d-----w C:\Program Files\JetAudio
2008-06-22 20:40 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-22 20:39 --------- d-----w C:\Documents and Settings\s\Application Data\Ahead
2008-06-22 20:38 --------- d-----w C:\Program Files\Nero
2008-06-22 20:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-06-22 20:30 --------- d-----w C:\Program Files\CyberLink
2008-06-22 20:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-06-22 20:29 10,368 ----a-w C:\WINDOWS\system32\drivers\pfc.sys
2008-06-22 20:29 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-06-22 20:29 --------- d-----w C:\Program Files\ACD Systems
2008-06-22 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-06-22 20:27 --------- d-----w C:\Program Files\PicaView32
2008-06-22 20:26 --------- d-----w C:\Program Files\Ulead iPhoto Express
2008-06-22 20:14 413,760 ----a-w C:\WINDOWS\system32\mpg4c32.dll
2008-06-22 20:14 --------- d-----w C:\Program Files\DIC T
2008-06-22 20:13 --------- d-----w C:\Program Files\Specialized Dictionary
2008-06-22 20:12 --------- d-----w C:\Program Files\J River
2008-06-22 20:12 --------- d-----w C:\Documents and Settings\s\Application Data\J River
2008-06-22 20:09 64,502 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-06-22 20:09 6,098 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-06-22 20:09 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-06-22 20:00 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-22 19:57 --------- d-----w C:\Program Files\Microsoft Works
2008-06-22 19:49 --------- d-----w C:\Program Files\WIDCOMM
2008-06-22 19:42 --------- d-----w C:\Program Files\Intel
2008-06-22 19:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 271,616 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-07 05:14 1,285,632 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-09-22 17:44 86,997 --sh--r C:\WINDOWS\system32\avpo.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [12/23/2006 06:05 PM 143360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [06/25/2008 04:10 PM 171448]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Privacy Suite"="C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" [11/20/2007 02:19 PM 872080]
"ClearPageFileAtShutDown"="C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" [11/20/2007 02:19 PM 872080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [02/08/2005 05:36 AM 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [02/08/2005 05:32 AM 126976]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 08:24 PM 32768]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 03:40 PM 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [06/23/2008 12:04 AM 32881]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/23/2008 09:38 AM 185896]
"DSLSTATEXE"="C:\Program Files\Conexant\Adsl\dslstat.exe" [08/25/2005 12:59 PM 344064]
"DSLAGENTEXE"="C:\Program Files\Conexant\Adsl\dslagent.exe" [08/25/2005 12:47 PM 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 01:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
C:\Documents and Settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-05-25 15:38:42 565309]
PalTalk.lnk - C:\Program Files\Paltalk Messenger\paltalk.exe [2008-05-09 01:17:29 10452992]
REALTEK RTL8187 Wireless LAN Utility.lnk - C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe [2008-07-11 12:56:46 737280]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [01/11/2007 01:20 PM]
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [10/02/2002 09:57 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\ntde1ect.com
\Shell\explore\Command - C:\ntde1ect.com
\Shell\open\Command - C:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\ntde1ect.com
\Shell\explore\Command - D:\ntde1ect.com
\Shell\open\Command - D:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\ntde1ect.com
\Shell\explore\Command - E:\ntde1ect.com
\Shell\open\Command - E:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc5a61ef-414b-11dd-88e5-00c09fbfd8f4}]
\Shell\AutoRun\command - G:\d6fagcs8.cmd
\Shell\explore\Command - G:\d6fagcs8.cmd
\Shell\open\Command - G:\d6fagcs8.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d83a9684-4d5a-11dd-8909-00c09fbfd8f4}]
\Shell\AutoRun\command - G:\ntde1ect.com
\Shell\explore\Command - G:\ntde1ect.com
\Shell\open\Command - G:\ntde1ect.com
*Newly Created Service* - CATCHME
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Device Detector - DevDetect.exe

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-07-12 09:50:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 07/12/2008 9:51:48
ComboFix-quarantined-files.txt 2008-07-12 06:51:42
Pre-Run: 13,638,864,896 bytes free
Post-Run: 13,627,260,928 bytes free
206 --- E O F --- 2008-07-08 12:17:22

 

[Al jNtEeL]

هذا التقرير
ComboFix 08-07-12.2 - s 07/12/2008 9:48:28.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1025.18.363 [GMT 3:00]
Running from: C:\Documents and Settings\s\سطح المكتب\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
C:\Documents and Settings\s\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
C:\WINDOWS\system32\kakle.dll
C:\WINDOWS\system32\net32gdilib.dll
D:\Autorun.inf
E:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-12 06:00 --------- d-----w C:\Documents and Settings\s\Application Data\cleaner
2008-07-12 05:20 --------- d-----w C:\Documents and Settings\s\Application Data\CyberScrub
2008-07-12 04:49 --------- d-----w C:\Documents and Settings\Administrator\Application Data\CyberScrub
2008-07-12 04:49 --------- d-----w C:\Documents and Settings\Administrator\Application Data\cleaner
2008-07-11 23:49 27,280 --sh--r C:\WINDOWS\system32\avpo0.dll
2008-07-11 09:56 21,035 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-07-11 09:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-11 09:56 --------- d-----w C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility
2008-07-11 00:45 --------- d-----w C:\Program Files\Paltalk Messenger
2008-07-09 02:18 --------- d-----w C:\Program Files\iVocalize Web Conference 4
2008-07-08 20:04 --------- d-----w C:\Documents and Settings\s\Application Data\ACD Systems
2008-06-25 13:38 --------- d-----w C:\Program Files\Google
2008-06-23 18:45 --------- d-----w C:\Documents and Settings\s\Application Data\COWON
2008-06-23 17:49 --------- d-----w C:\Documents and Settings\s\Application Data\Paltalk
2008-06-23 07:45 --------- d-----w C:\Program Files\CONEXANT
2008-06-23 06:45 --------- d-----w C:\Program Files\Golden Al-Wafi Translator
2008-06-23 06:44 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-06-23 06:44 172,032 ------w C:\WINDOWS\Setup1.exe
2008-06-23 06:41 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-23 06:38 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-23 06:38 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-23 06:38 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-23 06:38 --------- d-----w C:\Program Files\Common Files\Real
2008-06-23 06:37 --------- d-----w C:\Program Files\Real
2008-06-23 06:32 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-23 06:29 --------- d-----w C:\Program Files\VideoLAN
2008-06-23 06:28 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll
2008-06-23 06:28 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll
2008-06-23 06:28 47,104 ------w C:\WINDOWS\AKDeInstall.exe
2008-06-23 06:28 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll
2008-06-23 06:28 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll
2008-06-23 06:28 196,608 ----a-w C:\WINDOWS\system32\maag.dll
2008-06-23 06:28 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll
2008-06-23 06:28 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll
2008-06-23 06:28 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll
2008-06-23 06:28 --------- d-----w C:\Program Files\Real_SC
2008-06-23 06:28 --------- d-----w C:\Program Files\mpegable
2008-06-23 06:27 --------- d-----w C:\Program Files\ss99names
2008-06-22 21:05 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-22 21:04 --------- d-----w C:\Program Files\Java
2008-06-22 21:04 --------- d-----w C:\Program Files\Common Files\Java
2008-06-22 21:02 --------- d-----w C:\Program Files\MSN Messenger
2008-06-22 21:00 --------- d-----w C:\Program Files\mqreeb
2008-06-22 20:58 209,920 ----a-w C:\WINDOWS\iun3401.exe
2008-06-22 20:58 --------- d-----w C:\Program Files\seah
2008-06-22 20:58 --------- d-----w C:\Program Files\Salheen
2008-06-22 20:58 --------- d-----w C:\Program Files\quran
2008-06-22 20:45 --------- d-----w C:\Program Files\Noble Quran with Tafsser v 2.0
2008-06-22 20:44 --------- d-----w C:\Program Files\Nokia
2008-06-22 20:44 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-22 20:44 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-22 20:43 --------- d-----w C:\Program Files\PhotoBuilder
2008-06-22 20:43 --------- d-----w C:\Program Files\JetAudio
2008-06-22 20:40 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-22 20:39 --------- d-----w C:\Documents and Settings\s\Application Data\Ahead
2008-06-22 20:38 --------- d-----w C:\Program Files\Nero
2008-06-22 20:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-06-22 20:30 --------- d-----w C:\Program Files\CyberLink
2008-06-22 20:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-06-22 20:29 10,368 ----a-w C:\WINDOWS\system32\drivers\pfc.sys
2008-06-22 20:29 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-06-22 20:29 --------- d-----w C:\Program Files\ACD Systems
2008-06-22 20:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\ACD Systems
2008-06-22 20:27 --------- d-----w C:\Program Files\PicaView32
2008-06-22 20:26 --------- d-----w C:\Program Files\Ulead iPhoto Express
2008-06-22 20:14 413,760 ----a-w C:\WINDOWS\system32\mpg4c32.dll
2008-06-22 20:14 --------- d-----w C:\Program Files\DIC T
2008-06-22 20:13 --------- d-----w C:\Program Files\Specialized Dictionary
2008-06-22 20:12 --------- d-----w C:\Program Files\J River
2008-06-22 20:12 --------- d-----w C:\Documents and Settings\s\Application Data\J River
2008-06-22 20:09 64,502 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-06-22 20:09 6,098 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-06-22 20:09 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-06-22 20:00 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-22 19:57 --------- d-----w C:\Program Files\Microsoft Works
2008-06-22 19:49 --------- d-----w C:\Program Files\WIDCOMM
2008-06-22 19:42 --------- d-----w C:\Program Files\Intel
2008-06-22 19:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-20 17:39 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 17:59 271,616 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-07 05:14 1,285,632 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-09-22 17:44 86,997 --sh--r C:\WINDOWS\system32\avpo.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [12/23/2006 06:05 PM 143360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [06/25/2008 04:10 PM 171448]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:55 PM 5674352]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Privacy Suite"="C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" [11/20/2007 02:19 PM 872080]
"ClearPageFileAtShutDown"="C:\Documents and Settings\s\Application Data\cleaner\CSPSeraser.exe" [11/20/2007 02:19 PM 872080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [02/08/2005 05:36 AM 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [02/08/2005 05:32 AM 126976]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [11/02/2004 08:24 PM 32768]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 03:40 PM 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [06/23/2008 12:04 AM 32881]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/23/2008 09:38 AM 185896]
"DSLSTATEXE"="C:\Program Files\Conexant\Adsl\dslstat.exe" [08/25/2005 12:59 PM 344064]
"DSLAGENTEXE"="C:\Program Files\Conexant\Adsl\dslagent.exe" [08/25/2005 12:47 PM 65536]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM 39792]
"BluetoothAuthenticationAgent"="bthprops.cpl" [08/04/2004 01:56 AM 110592 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 01:56 AM 15360]
C:\Documents and Settings\All Users\çں‍ê، ں §ڑ\ںé ©ںê¤\ §ک ں颬نïé\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-05-25 15:38:42 565309]
PalTalk.lnk - C:\Program Files\Paltalk Messenger\paltalk.exe [2008-05-09 01:17:29 10452992]
REALTEK RTL8187 Wireless LAN Utility.lnk - C:\Program Files\REALTEK RTL8187 Wireless LAN Driver and Utility\RtWLan.exe [2008-07-11 12:56:46 737280]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^قائمة ابدأ^البرامج^بدء التشغيل^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\قائمة ابدأ\البرامج\بدء التشغيل\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:55 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [01/11/2007 01:20 PM]
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [10/02/2002 09:57 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - C:\ntde1ect.com
\Shell\explore\Command - C:\ntde1ect.com
\Shell\open\Command - C:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\ntde1ect.com
\Shell\explore\Command - D:\ntde1ect.com
\Shell\open\Command - D:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\ntde1ect.com
\Shell\explore\Command - E:\ntde1ect.com
\Shell\open\Command - E:\ntde1ect.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc5a61ef-414b-11dd-88e5-00c09fbfd8f4}]
\Shell\AutoRun\command - G:\d6fagcs8.cmd
\Shell\explore\Command - G:\d6fagcs8.cmd
\Shell\open\Command - G:\d6fagcs8.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d83a9684-4d5a-11dd-8909-00c09fbfd8f4}]
\Shell\AutoRun\command - G:\ntde1ect.com
\Shell\explore\Command - G:\ntde1ect.com
\Shell\open\Command - G:\ntde1ect.com
*Newly Created Service* - CATCHME
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-Device Detector - DevDetect.exe

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-07-12 09:50:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 07/12/2008 9:51:48
ComboFix-quarantined-files.txt 2008-07-12 06:51:42
Pre-Run: 13,638,864,896 bytes free
Post-Run: 13,627,260,928 bytes free
206 --- E O F --- 2008-07-08 12:17:22

الحمد لله يآرب حذف جميع الفايروسات الي مسببه لك المشاكل ذي كلها

والآن باقي شيء وآآحد والأخير ونتأكد أن جهازك مية مية

--------------------------------------------------------------

حمل هذه الاداة ,,
واتبع الشرح التالي ,, لتنظيف جهازك من الفيروسات
و عمل تقرير بالعمليه حتى ترفقه بردك القادم ,,


رابط الاداة

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

شرح الاستخدام ,,,,,,

ولحفظ التقرير اعمل التالي ,,

بعدهاا ارفع التقرير على هذا الموقع ,, وارفق الرابط بردك القادم

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

قم بفحص الجهآآز كاملا يآآ عزيزي

بنتظآآر التقرير بعد الفحص الكآآمل
​

 

[أبو عماااد]

ياخوي الجهاز يطول لما يطفي وش المشكلة

 

[Al jNtEeL]

ياخوي الجهاز يطول لما يطفي وش المشكلة

أبشر يآآ استاذي الغآآلي ...

اضغط على زر ابدء اختر تشغيل .. واكتب الآتي : msconfig ثم موافق

تسظهر لك نافذه اختر من الأعلى بدء التشغيل بعد ذلك قم بتصوير لي ماظهر وأنا اخبرك بما تفعل

 

[أبو عماااد]

الفحص جاري دقايق واعطيك التقرير يالحبيب

 

[Al jNtEeL]

الفحص جاري دقايق واعطيك التقرير يالحبيب

بنتظآآرك عزيزي k:

ولاتنسى أن تصور لي ماقلته لك :d:

----------------------------------

وللتخفيف على جهازك اعمل الآتي وان كنت عملتها سابقا فعملها أيضا مرة أخرى لحذف بقايا ومخلفات الفايروسات

نزل هذه الاداة واتبع الشرح التالي

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

التوافق : ويندوز اكسبي فقط

شرح الاستخدام ,,,,,,
عند تشغيل ملف الاداة تظهر لك هذه الشاشه ,, انتظر ( وتابع مع الصور )

وعند ظهور هذه الشاشه ,, اضغط على Close ليتم اعادة تشغيل جهازك (( لتكملة عملية التنظيف ))