الجهاز فية فيروسات كتير

[أروتى]

السلام عليكم و رحمة الله
الجهاز مرة واحدة اتقلب حالة الكاسبر كل شوية يطلع لي رسالة فية فيروس و مسحت لغاية دلوقتي فوق 130 فيروس و لسة كل شوية رسالة و جربت اعمل سكان بالباندا اللي طلع مفيش حاجة و عملت سكان ب سبايوير دكتور و اميرجنسي سباي و جيكز و hijack this و نفذت كل اللي قالوة و كل اللي شايفة ملفات dll بتتحذف و بدأ ملفات exe اللي كل الجهاز تضرب اعمل اية و كان في اخ بيشتكي من نفس الفيروس تقريبا و المدير طلب منة سكان ببرنامج معين و ادي اللوج فايل بتاعة
ComboFix 08-07-29.1 - smart 07/30/2008 9:32:41.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.457 [GMT 3:00]
Running from: C:\Documents and Settings\smart\My Documents\Downloads\Programs\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Messenger\msgmr.dll
C:\WINDOWS\system32\fackwir.dll
C:\WINDOWS\Update.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-30 06:34 60,116 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-30 06:34 58,144 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-30 06:34 3,942,432 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-30 06:34 16,964 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-30 05:56 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-07-30 05:56 --------- d-----w C:\Documents and Settings\smart\Application Data\Malwarebytes
2008-07-30 05:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-29 18:20 24,576 ----a-w C:\WINDOWS\system32\tiplict.dll
2008-07-29 18:20 24,576 ----a-w C:\WINDOWS\system32\manleu.dll
2008-07-29 18:04 --------- d-----w C:\Program Files\Common Files\PC Tools
2008-07-29 18:04 --------- d-----w C:\Documents and Settings\smart\Application Data\PC Tools
2008-07-29 18:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Tools
2008-07-28 02:12 --------- d-----w C:\Program Files\Motorola
2008-07-23 22:32 286,720 ------w C:\WINDOWS\Setup1.exe
2008-07-23 17:09 38,472 ----a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-23 17:09 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-07-17 21:05 --------- d-----w C:\Documents and Settings\smart\Application Data\NCH Swift Sound
2008-07-16 09:51 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-07-14 21:44 44 ----a-w C:\ain.dll
2008-07-11 17:08 --------- d-----w C:\Program Files\Microsoft.NET
2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll
2008-07-05 20:58 704 ----a-w C:\Dionakra.DAT
2008-07-03 20:01 --------- d-----w C:\Program Files\Internet Download Manager
2008-07-03 20:01 --------- d-----w C:\Documents and Settings\smart\Application Data\IDM
2008-07-03 20:01 --------- d-----w C:\Documents and Settings\smart\Application Data\DMCache
2008-06-29 20:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\NFS Underground
2008-06-29 20:37 --------- d-----w C:\Program Files\Common Files\DirectX
2008-06-27 22:19 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-27 22:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-06-26 20:48 --------- d-----w C:\Program Files\Harf
2008-06-26 20:38 --------- d-----w C:\Program Files\CCleaner
2008-06-26 20:37 --------- d-----w C:\Program Files\RightClickGoogleSearchOpenSelectedURL
2008-06-26 20:37 --------- d-----w C:\Program Files\Extension Changer
2008-06-26 11:49 720,896 ----a-w C:\WINDOWS\iun6002ev.exe
2008-06-26 11:21 --------- d-----w C:\Program Files\NextSecurity.NET
2008-06-25 19:50 --------- d-----w C:\Documents and Settings\smart\Application Data\InstallShield
2008-06-25 19:47 --------- d-----w C:\Program Files\VIA
2008-06-10 18:22 81,288 ----a-w C:\WINDOWS\system32\drivers\IKSYSSEC.SYS
2008-06-02 12:19 66,952 ----a-w C:\WINDOWS\system32\drivers\IKSYSFLT.SYS
2008-06-02 12:19 42,376 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-06-02 12:19 29,576 ----a-w C:\WINDOWS\system32\drivers\KCOM.SYS
2008-06-02 12:19 159,880 ----a-w C:\WINDOWS\system32\drivers\pctfw2.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/28/2008 01:17 AM 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [01/01/2004 12:00 AM 15360]
"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [04/13/2007 08:26 PM 598920]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [07/15/2008 08:39 AM 931248]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [10/04/2007 11:14 AM 8491008]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [10/04/2007 11:14 AM 81920]
"kis"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [03/24/2006 07:09 PM 139367]
"nwiz"="nwiz.exe" [10/04/2007 11:14 AM 1626112 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [01/01/2004 12:00 AM 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"VIDC.X264"= x264vfw.dll
"vidc.DIV3"= DIVXc32.dll
"vidc.DIV4"= DIVXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=C:\WINDOWS\pss\Utility Tray.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^smart^Start Menu^Programs^Startup^Reboot.exe]
path=C:\Documents and Settings\smart\Start Menu\Programs\Startup\Reboot.exe
backup=C:\WINDOWS\pss\Reboot.exeStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 01/01/2004 12:00 AM 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 12:54 PM 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSRaid]
--------- 01/23/2006 02:52 PM 872448 C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\Sraid.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 06/20/2006 04:02 PM 4538368 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower]
-ra------ 06/28/2006 09:05 PM 49152 C:\WINDOWS\system32\SiSPower.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-r------- 06/20/2006 11:42 PM 577536 C:\WINDOWS\soundman.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [06/02/2008 03:19 PM]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\WINDOWS\system32\drivers\viahduaa.sys [12/12/2007 09:35 AM]
S1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys []
S2 cdralw;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\system32\DRIVERS\nvmini.sys []
S3 eth8023;eth8023;C:\WINDOWS\system32\drivers\eth8023.sys []
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [07/23/2008 08:09 PM]
S3 NSPacket;NextSecurity Packet Driver;C:\WINDOWS\system32\drivers\nspacket.sys [12/06/2004 08:08 PM]
.
- - - - ORPHANS REMOVED - - - -
ShellExecuteHooks-{006CA8A1-61BC-4774-A54C-F49034270BAD} - (no file)
ShellExecuteHooks-{53D44DB6-E22B-4B17-97D3-572C96CCA6E1} - (no file)
SSODL-msnmsg-{DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - C:\Program Files\Messenger\msgmr.dll
Notify-NavLogon - (no file)
MSConfigStartUp-ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-DownloadAccelerator - C:\Program Files\DAP\DAP.EXE
MSConfigStartUp-Skype - C:\Program Files\Skype\Phone\Skype.exe

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie
O8 -: &تصدير إلى Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 -: Download Video -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 -: Open Selected URL - C:\Program Files\RightClickGoogleSearchOpenSelectedURL\openselectedurl.htm
O8 -: Search &Google - C:\Program Files\RightClickGoogleSearchOpenSelectedURL\google.htm
O8 -: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 -: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 -: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O17 -: HKLM\CCS\Interface\{5A46F3E3-7341-4067-A1C0-4DF408B5BED8}: NameServer = 217.52.47.130,217.52.47.140

**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2008-07-30 09:36:11
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\WINDOWS\SYSTEM32\NVSVC32.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 07/30/2008 9:36:52 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-30 06:36:48
Pre-Run: 8,757,346,304 bytes free
Post-Run: 8,787,607,552 bytes free
184

و دا ص

ورة فيروس كل لما افتح الجهاز بييجي

ودا واحد غيرة

و مستني المساعدة

 

[Al jNtEeL]

حمل أداة الهايجاك

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

بعد ان تشغل البرنامج اعمل الاتي :

ستظهر لك هذه النافذه .. اتبع الشرح :​

ثم ستظهر لك هذه النافذه ::​

انسخ التقرير كاملا وارفقه في ردك القادم لتحليله​

 

[AbOdy]

سبقني الغالي

 

[أروتى]

مشكورين علي سرعة الرد و ادي التقرير

Logfile of HijackThis v1.99.1
Scan saved at 08:57:23 ص, on 30/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\برامج\نص برامج مفيدة\برامج الحماية\malwarebytes-anti-malware_malwarebytes_anti-malware_1.12_francais_215092.exe
C:\DOCUME~1\smart\LOCALS~1\Temp\is-MML23.tmp\malwarebytes-anti-malware_malwarebytes_anti-malware_1.12_francais_215092.tmp
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
G:\برامج\نص برامج مفيدة\برامج الحماية\برامج المضادة للفيروسات\HijackThis.exe
O1 - Hosts: 202.165.102.205 972.aksjd11.com
O1 - Hosts: 202.165.102.205 w3og.cn
O1 - Hosts: 203.208.35.100 qazc.fourtw.cn
O1 - Hosts: 203.208.35.100

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 203.208.35.101

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 203.208.35.101

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 72.14.235.99 222.1212l112.net
O1 - Hosts: 72.14.235.99 444.1212l112.netn
O1 - Hosts: 72.14.235.99 555.1212l112.net
O1 - Hosts: 72.14.235.99 111.1212l112.net
O1 - Hosts: 65.55.21.250 111.3243l24.com
O1 - Hosts: 65.55.21.250 222.3243l24.com
O1 - Hosts: 65.55.21.250 333.3243l24.com
O1 - Hosts: 125.64.8.112 kao2.gmwo03.com
O1 - Hosts: 125.64.8.112 kao.gmwo06.com
O1 - Hosts: 125.64.8.112 444.gmwo07.com
O1 - Hosts: 116.252.185.15 ru.update365.us
O1 - Hosts: 116.252.185.15 ad.update365.us
O1 - Hosts: 207.46.232.182 popmails.net
O1 - Hosts: 203.208.37.99 3.goodhh.com
O1 - Hosts: 220.181.37.55 down.rwixr.com
O1 - Hosts: 160.79.42.52

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 63.175.76.152

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 219.133.40.91 qq.ljsll.com
O1 - Hosts: 203.208.35.102

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 209.132.177.50 973.aksjd11.com
O1 - Hosts: 209.132.177.50 974.aksjd11.com
O1 - Hosts: 209.132.177.50 971.aksjd11.com
O1 - Hosts: 209.132.177.50 975.aksjd11.com
O1 - Hosts: 72.14.235.104 user1.12-39.net
O1 - Hosts: 72.14.235.147

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O1 - Hosts: 192.150.18.101 ata1.sysions.net
O1 - Hosts: 192.150.18.101 ata2.sysions.net
O1 - Hosts: 192.150.18.101 ata3.sysions.net
O1 - Hosts: 192.150.18.101 ata4.sysions.net
O1 - Hosts: 193.120.42.226 8nnnnn99.cn
O1 - Hosts: 24.39.54.34

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\RunServicesOnce: [washindex] C:\Program Files\Washer\washidx.exe "smart"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Add to Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O8 - Extra context menu item: Download Video -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O8 - Extra context menu item: Open Selected URL - C:\Program Files\RightClickGoogleSearchOpenSelectedURL\openselectedurl.htm
O8 - Extra context menu item: Search &Google - C:\Program Files\RightClickGoogleSearchOpenSelectedURL\google.htm
O8 - Extra context menu item: ShaPlus Google Translator - res://C:\Program Files\ShaPlus Google Translator\GoogleTranslator.dll/ie.htm
O8 - Extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: تحميل بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\pc tools\lsp\pctlsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A46F3E3-7341-4067-A1C0-4DF408B5BED8}: NameServer = 217.52.47.130,217.52.47.140
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll mssetd.dll tiplict.dll businesn.dll wcnonpe.dll esceps.dll googleons.dll welyri.dll offecao.dll fackwir.dll wdhotem.dll xboxdo.dll manleu.dll jsnoer.dll therbrek.dll jolin0.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 - SSODL: msnmsg - {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} - C:\Program Files\Messenger\msgmr.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

 

[Al jNtEeL]

أخي العزيز التقرير ليس كآملا ... أرفع ملف التقرير لو سمحت

 

[الكااااااااسر]

ياكثر ملفات الهوست عندك وهي اللي مسويه مشكله لك


ننتظر التقرير الكامل اخوي

لكي نقدر نساعدك

 

[Demo-dashDemo-dash is verified member.]

عزيزي حمل الاداة التالية ثم شغلها بدبل كلك
بعدها اعد تشغيل جهازك وارفع تقرير ثاني للمتابع

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

​