الفوتو مش بيفتح

بنوته مسلمه مصريه · 30 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

كيفك زمردة الغالية

من فترة مش باينة

عندى مشكلة في الفوتو

انا عندى النسخة المحمولة من الملتقى الصيفي اللي فات وشغاله كويس

المشكلة ان اخي سطب نسخة امبارح لان القديمة كانت وحشة وانت عارفه مشاكلها

والنسخة اللى سطبها كانت برضوا عندنا من فترة وكان شغال عليها كل البرامج

دلوقتى جيت اشغل الفوتو مش رضى يفتح معايا ويبعتلى رسالة انه مش هيفتح

وانا مش عارفه المشكلة فين

ملاذ الفرح · 30 مايو, 2011

جربي تمسحيها وترجعي تنصبيها، أو تمسحيها وترجعي تنزليها لأن احتمال بعض الملفات انمسحت مع التسطيب

:)

بنوته مسلمه مصريه · 30 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

عملت كده قبل كده وبرضوا مش بيفتح

ودلوقتى كمان الصور مش بتفتح معايا

جهازى غلبني خالص والله يا فروحه

*زمـــردة* · 30 مايو, 2011

وعليكــم السلام ورحمـة الله وبركاتــه ،،

حبيبتى بعتذر منكِ

طيب ياغالية ممكن تقرير هايجاك

ايضاً هل هذه نفس نسخة الويندوز التى كنا نضبطها الفترة السابقة؟

بإنتظارك بإذن الله

: )

بنوته مسلمه مصريه · 30 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

كيفك حبيبتى

معلش انا عارفه انى تعبتك واكيد زهقتى منى

لا حبيبتى دى نسخة تانية كانت قديمة عندنا وسطبناها لما الجديدة كانت مشاكلها كتير

وممكن اسالك سؤال هو فيه نسخ على النت ممكن انزلها

التقرير

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:13:53 م, on 29/05/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\DOCUME~1\H\LOCALS~1\Temp\winkxnw.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 3440 bytes

*زمـــردة* · 30 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،
كيفك حبيبتى

معلش انا عارفه انى تعبتك واكيد زهقتى منى

لا حبيبتى دى نسخة تانية كانت قديمة عندنا وسطبناها لما الجديدة كانت مشاكلها كتير

وممكن اسالك سؤال هو فيه نسخ على النت ممكن انزلها

وعليكــم السلام ورحمـة الله وبركاتــه ،،

الحمد لله ياحبيبة بخير تسلمى لى

لا ياحبيبة لاتقولى ذلك والله أنا المُقصرة هذه الأيام لكن غصب عنى

طيب حبيبتى للأسف عندك فيرس وهو السبب

شغلي البرنامج مرة أخرى واعملى سكان

وبعد مايظهر لكِ التقرير الذى فى البرنامج نفسه وليس ملف التيكست اتبعى التالى

علمى صح أمام هذه القيم وانتبهى بارك الله فيكِ حتى لانفسد شىء

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

بعد وضع علامة صح ثم اختارى fix وتابعى مثل الصور

ثم

تفضلى حملى هذا البرنامج

http://download938.mediafire.com/4f85tbwbu.../MBAM_1.5.1.exe

دبل كليك على ايقونة البرنامج

ستفتح لنا واجهة البرنامج

أول شىء أعملى له Updat

بعد الانتهاء من التحديث نبدأ عمل Scan

نضغط كما بالصورة لبدء الفحص

نحدد الأقراص المراد فحصها

جارى عملية الفحص

بدء البرنامج يكتشف الإصابات

انتهى الفحص

نضغط في المكان المشار اليه لرؤيــة النتائج

هذه هي الملفات الخبيثة التي اكتشفها

نقوم بحذفها سيظهر لكِ ملف تيكست فضلاً الصقيه بردك القادم

يطلب منا اعادة تشغيل الجهاز

بإنتظارك بإذن الله مع تقرير هايجاك + تقرير المالوير

: )

حنين مسلمة · 30 مايو, 2011

السلام عليكم ورحمة الله وبركاته،،

بعد إذن الحبيبة زمردة ...

بنوتة الحبيبة هل الرسالة التي تظهر لكِ عند محاولة فتح الفوتوشوب .. scratch disks are full??

لأنها دائما تزعجني وسببها هو أن قرص السي عليه ملفات كثيرة ويحتاج أن يكون به مسافة خالية أكثر

أردت فقط المساعدة

بارك الله فيكن

بنوته مسلمه مصريه · 30 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

أنا حملت المالوير من قسم شروحات البرامج

وبعمل دلوقتى الاسكان

بس في الهايجاك مسحت القيم ورجعت عملت تانى تقرير لقيته مش راضى يمسح هذه القيمة خالص

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

بنوته مسلمه مصريه · 30 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

معلش زمردة انا ردديت قبل كده بس ملقتش الرد موجود

على العموم ربنا يعينك حبيبتى وسامحينى انا اللى دايما شغلاك معايا

حنين جزاك الله خيرا حبيبتى على المساعده

ليست هذه الرسالة التى تظهر لى الرسالة تقول انه لا يسمح لى بالفتح

على العموم عملت الاسكان والمالوير والمالوير معرفتش اسطبه من الرابط فرحت لساحة الشروحات وسطبته منه الحمد لله

تقرير المالوير

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5363

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

30/05/2011 12:16:38 ص

mbam-log-2011-05-30 (00-16-38).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|)

Objects scanned: 183921

Time elapsed: 21 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 6

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:27:04 ص, on 30/05/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\DOCUME~1\H\LOCALS~1\Temp\xghisx.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 3270 bytes

*زمـــردة* · 31 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،
معلش زمردة انا ردديت قبل كده بس ملقتش الرد موجود

على العموم ربنا يعينك حبيبتى وسامحينى انا اللى دايما شغلاك معايا

حنين جزاك الله خيرا حبيبتى على المساعده

ليست هذه الرسالة التى تظهر لى الرسالة تقول انه لا يسمح لى بالفتح

على العموم عملت الاسكان والمالوير والمالوير معرفتش اسطبه من الرابط فرحت لساحة الشروحات وسطبته منه الحمد لله

وعليكــم السلام ورحمـة الله وبركاتــه ،،

ولا يهمك حبيبتى

لا ياحبيبة لاتقولى ذلك بإذن الله خير ولاتقلقي

نريد أن نقوم بخطوة تعطيل إستعادة النظام

حملى هذه الاداة

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

نضع الأداة على سطح المكتب

ينصح بشدة قبل استخدام الاداة باغلاق كافة البرامج وتعطيل برامج الحماية وترك الاداة تكمل عملية الفحص مهما طالت

يتم تشغيها بدبل كلك بعد التشغيل تابعى الشرح

ثم انتظرى حتى تخرج هذه الرسالة وتابعى الشرح

وهذه بعض من مراحل الفحص وتاكدى من عدم تحريك الجهاز او مقاطعة الفحص

عند المرحلة التالية قد يعاد تشغيل الجهاز في حال وجود اصابة قوية

وبعد اعادة التشغيل يكمل الفحص بشكل تلقائي

وعند المرحلة التالية يكون عملية انها الفحص وانشاء تقرير الفحص على القرص C كما هو واضح

بعد ذلك فضلاً أرفعى لى نسخة من التقرر الخاص بهذه الأداة

وتقرير جديد للهايجاك

فى انتظارك

: )

بنوته مسلمه مصريه · 31 مايو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

حملت الاداة وعند الضغط عليها تأتى الشاشة الزرقاء علطول ومش بتجيلى الرسالة

بعد ثانية تظهرلى الـ document وتظهرلى رسالة اخرى واول ما اضغط اوكيه يخفى الايقونة خالص

بنوته مسلمه مصريه · 1 يونيو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

زمردة انا عملت تقرير مالوير تانى

بس بتيجى رسالة بعد ما يخلص بيقولى certian item couldnot be removed

هذا هو التقرير

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6705

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

31/05/2011 05:15:19 م

mbam-log-2011-05-31 (17-15-19).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|)

Objects scanned: 191443

Time elapsed: 19 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 3

Registry Keys Infected: 56

Registry Values Infected: 2

Registry Data Items Infected: 5

Folders Infected: 0

Files Infected: 30

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\Temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\system32\wmdrtc32.dll (Virus.Sality) -> Delete on reboot.

c:\program files\messenger\customsat.dll (Spyware.OnlineGames) -> Delete on reboot.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{AD26AC5F-8421-419C-8692-ED0FE1FE74D8} (Trojan.AntiAV) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngPS.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Syscheck2.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smwcore (Backdoor.Agent.PS) -> Value: smwcore -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\MSNServiceObj (Trojan.AntiAV) -> Value: MSNServiceObj -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\Temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\system32\wmdrtc32.dll (Virus.Sality) -> Delete on reboot.

c:\Documents and Settings\H\Local Settings\Temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\Temp\VRTB.tmp (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\program files\messenger\msmsgs.dll (Trojan.AntiAV) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\0009037emdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000d3587mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000d7a51mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000db381mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000ddf54mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000e0403mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000e2130mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000e3c2amdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000e5734mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000e721emdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000e8d57mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000ea7e4mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000ec2fdmdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000ede94mdd.temp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000ef8e2mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\000f2fe0mdd.temp (Spyware.Password) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\4D2FSTE7\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\GDMR8DYB\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP1\A0000717.EXE (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0000870.EXE (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\MSGSCR.TLB (Trojan.AntiAV) -> Quarantined and deleted successfully.

c:\program files\messenger\customsat.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\system32\wmdrtc32.dl_ (Virus.Sality) -> Quarantined and deleted successfully.

وده تقرير المالوير

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 05:17:38 م, on 31/05/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank