الفوتو مش بيفتح

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

زمردة الفيرس رجع تانى لما قفلت وفتحت الجهاز ورجع ميفتحش الصور تانى والفوتو بيوقف

خلاص حبيبتى اكيد ده عيب النسخة نفسها

بس لي سؤال هل لو عملت الخطوات السابقة كل ما افتح الجهاز عادى لحد ما اجيب نسخة كويسة ولا ده هيأثر على الجهاز

[أحلام وردية 7]

السلام عليكــم ورحمـة الله وبركاتــة ،،

 

جزاكِ الله خيرًا زمردة

الأول : أعمل زي ما قلتِ لبنوتة ؟ نفس الخطوات يعني ؟ بدل ما أتعبك تاني :)

 

أداة التاسك مانجر متفعلة :)

 

ودا التقرير

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:08:46 AM, on 6/2/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

D:\Program Files\Alwil Software\Avast4\ashServ.exe

D:\WINDOWS\system32\spoolsv.exe

D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

D:\Program Files\Alwil Software\Avast4\ashWebSv.exe

D:\WINDOWS\system32\rundll32.exe

D:\WINDOWS\system32\VTTimer.exe

D:\WINDOWS\system32\S3trayp.exe

D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

D:\WINDOWS\system32\wscntfy.exe

D:\WINDOWS\system32\wuauclt.exe

D:\Program Files\Mozilla Firefox\plugin-container.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?ref=hp

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe

O4 - HKLM\..\Run: [HDAudDeck] D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Trickler] "d:\documents and settings\administrator\local settings\temp\~vis0000\fsg_4104.exe"

O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe

 

--

End of file - 4351 bytes

 

 

منتظراكِ :)

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

زمردة الفيرس رجع تانى لما قفلت وفتحت الجهاز ورجع ميفتحش الصور تانى والفوتو بيوقف

خلاص حبيبتى اكيد ده عيب النسخة نفسها

بس لي سؤال هل لو عملت الخطوات السابقة كل ما افتح الجهاز عادى لحد ما اجيب نسخة كويسة ولا ده هيأثر على الجهاز

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

لا حبيبتى ليس عيب بالنسخة ولتتأكدى تفضلى معلومات عن الفيرس

ينتقل الفيروس عن طريق الأنترنت و نقل الملفات المصابة و البريد الألكتروني , كما له خواص إنتشار واسعة جداً من خلال الفلاشات الUSB ,

حيث يصنع من نفسه ملفات Autorun تساعد على الدخول لجهاز الضحية .

 

فالفيروس يقوم بنسخ نفسه بسرعة كبيرة في ملفات ال exe

فهو يدمر نظام تشغيلك و برامجك المثبته و الغير مثبتة , كما يدمر الألعاب

و أيضاً يدمر أي برنامج أنتي فيروس تضعه على جهازك

كما أنه يبعث بشفرات الريجيستري حتى يضمن عدم الوصول له من خلال تعطيل خاصية ctrl+alt+del

و خاصية regedit

و خاصية safe mode

و يمنعك من تحميل أي برنامج أنتي فيروس من على الأنترنت و يقطع الإتصال

و عند الدخول الي أي ما يهدده تظهر تلك الرسالة السخيفة

the task manger has disabled by your admnistroitor

 

لذلك فضلاً بارك الله فيكِ نريد إعادة عمل أخر مشاركة لى رقم 21

 

لكن فضلاً انتبهى بارك الله فيكِ إذا عندك أى فلاشة يجب شبكها بالجهاز

 

بعد ذلك فحص بالمالوير وبنتظر تقرير المالوير

 

: )

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

 

جزاكِ الله خيرًا زمردة

الأول : أعمل زي ما قلتِ لبنوتة ؟ نفس الخطوات يعني ؟ بدل ما أتعبك تاني :)

 

أداة التاسك مانجر متفعلة :)

 

منتظراكِ :)

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

لا حبيبتى دعينا نمشى سوياً خطوة خطوة يسعدنى المتابعة معكِ

 

لكن سنبدأ بخطوة المالوير

 

 

تفضلى حملى هذا البرنامج

 

http://download938.mediafire.com/4f85tbwbu.../MBAM_1.5.1.exe

 

دبل كليك على ايقونة البرنامج

 

 

ستفتح لنا واجهة البرنامج

 

أول شىء أعملى له Updat

 

 

 

بعد الانتهاء من التحديث نبدأ عمل Scan

 

نضغط كما بالصورة لبدء الفحص

 

 

 

نحدد الأقراص المراد فحصها

 

 

جارى عملية الفحص

 

 

 

بدء البرنامج يكتشف الإصابات

 

 

انتهى الفحص

 

 

نضغط في المكان المشار اليه لرؤيــة النتائج

 

 

هذه هي الملفات الخبيثة التي اكتشفها

 

 

نقوم بحذفها سيظهر لكِ ملف تيكست فضلاً الصقيه بردك القادم

 

 

يطلب منا اعادة تشغيل الجهاز

 

 

بنتظر تقرير المالوير + تقرير هايجاك جديد بإذن الله

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

حبيبتى الادوات اللى حملتها كلها مش بتشتغل تانى دلوقتى ولما بضغط عليهم الجهاز بيقف

بس عايزة استفسر يعنى طالما انه مش في النسخة يعنى ممكن يكون على البوردة نفسها

ويعنى مش هعرف اتخلص منه ولا فيه امل

وكل طبعا المعلومات اللى قولتيها بتحصل معايا الله المستعان

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

حبيبتى الادوات اللى حملتها كلها مش بتشتغل تانى دلوقتى ولما بضغط عليهم الجهاز بيقف

بس عايزة استفسر يعنى طالما انه مش في النسخة يعنى ممكن يكون على البوردة نفسها

ويعنى مش هعرف اتخلص منه ولا فيه امل

وكل طبعا المعلومات اللى قولتيها بتحصل معايا الله المستعان

وعليكم السلام ورحمة الله وبركاته

 

طيب حبيبتى حملى الادوات مرة اخرى ونفذى المشاركة بالضبط

 

ماأريد أن انبهك له أن البوردة تمام وكل شىء تمام المشكلة إن لو الانتى فيرس نسى يتعامل مع ملف من الملفات المصابة

 

فسوف ينسخ هذا الملف نفسه عدة مرات كما سبق وكتبت لكِ

 

لاتقلقى بإذن الله الامل موجود فقط اصبرى وبإذن الله خير

 

حملى الادوات التى بالمشاركة 21 وشغليها بعد ذلك حملى المالوير واعملى به فحص وبنتظر تقريره بإذن الله

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكم ورحمة الله وبركاته

زمردة لما بفك الضغط عليهم واضغط كلك يمين الجهاز بيقف

مع انى لما بعمل كلك يمين على اى حاجة تانية الجهاز بيشتغل

غير كده التاسك بار مش متفعله

انا اسفة جدا والله انا محرجة منك اوى لانى تعبتك معايا اوى

[*زمـــردة* 59]

السلام عليكم ورحمة الله وبركاته

زمردة لما بفك الضغط عليهم واضغط كلك يمين الجهاز بيقف

مع انى لما بعمل كلك يمين على اى حاجة تانية الجهاز بيشتغل

غير كده التاسك بار مش متفعله

انا اسفة جدا والله انا محرجة منك اوى لانى تعبتك معايا اوى

وعليكم السلام ورحمة الله وبركاته

 

اول شىء مافى احراج ولا شىء بارك الله فيكِ

 

بالعكس أنا متضايقة إن الفيرس رجع تانى ومضايقك لكن بإذن الله خير

 

طيب إنتِ حملتى الادوات صح لاتفكِ عنها الضغط ضعيها على سطح المكتب ثم اعملى اعادة تشغيل وادخلى على وضع الـ Safe mode

 

وحاولى تفكى الضغط وتشغليهم

 

مضطرة اخرج الآن وبإذن الله ادخل غداً اطمئن على الوضع

 

ولا تقلقى إذا وقفت الامور بإذن الله ابحث لكِ عن حل آخر

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

ربنا يبارك فيك حبيبتى

أنا عملت الخطوات الاولى لتفعيل التاسك مانجر وبعدين حملت الادوات تانى وعملت الخطوات

واشتغل الحمد لله

وعملت المالوير بس برضوا ظهرتلى رسالة ان فيه ملفات لم يتم مسحها

على العموم التقرير اهو

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

 

Database version: 6756

 

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

 

02/06/2011 12:27:04 ص

mbam-log-2011-06-02 (00-27-04).txt

 

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|)

Objects scanned: 192443

Time elapsed: 16 minute(s), 48 second(s)

 

Memory Processes Infected: 2

Memory Modules Infected: 2

Registry Keys Infected: 56

Registry Values Infected: 2

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 46

 

Memory Processes Infected:

c:\WINDOWS\userinit.exe (Trojan.Agent) -> 1704 -> Unloaded process successfully.

c:\WINDOWS\system32\system.exe (Trojan.Agent) -> 1812 -> Unloaded process successfully.

 

Memory Modules Infected:

c:\WINDOWS\system32\wmdrtc32.dll (Virus.Sality) -> Delete on reboot.

c:\WINDOWS\linkinfo.dll (Trojan.Agent) -> Delete on reboot.

 

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{AD26AC5F-8421-419C-8692-ED0FE1FE74D8} (Trojan.AntiAV) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngPS.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Syscheck2.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.

 

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smwcore (Backdoor.Agent.PS) -> Value: smwcore -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\MSNServiceObj (Trojan.AntiAV) -> Value: MSNServiceObj -> Quarantined and deleted successfully.

 

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Bad: (C:\WINDOWS\userinit.exe) Good: () -> Quarantined and deleted successfully.

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

c:\WINDOWS\userinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\wmdrtc32.dll (Virus.Sality) -> Delete on reboot.

c:\WINDOWS\system32\system.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT5.tmp (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\program files\messenger\msmsgs.dll (Trojan.AntiAV) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\wmsetup.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\temporary internet files\Content.IE5\NP6R4VBW\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\temporary internet files\Content.IE5\W70TAH59\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\6PQ0JT3V\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\H0ABLVW6\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\RAKL4EOP\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\RAKL4EOP\d[2].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\RAKL4EOP\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[10].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[11].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[2].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[3].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[4].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[5].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[6].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[7].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[8].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\URH49CYR\d[9].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[10].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[11].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[2].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[3].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[4].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[5].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[6].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[7].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[8].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\g[9].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP1\A0000001.sys (Trojan.Alman) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\acledit.exe (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\avifil32.exe (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\MSGSCR.TLB (Trojan.AntiAV) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\bthserv.exe (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\drivers\cdralw.sys (Trojan.Alman) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\wmsetup.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

d:\system volume information.exe (Trojan.Agent) -> Quarantined and deleted successfully.

d:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP1\A0000079.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\wmdrtc32.dl_ (Virus.Sality) -> Quarantined and deleted successfully.

c:\WINDOWS\linkinfo.dll (Trojan.Agent) -> Delete on reboot.

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

ربنا يبارك فيك حبيبتى

أنا عملت الخطوات الاولى لتفعيل التاسك مانجر وبعدين حملت الادوات تانى وعملت الخطوات

واشتغل الحمد لله

وعملت المالوير بس برضوا ظهرتلى رسالة ان فيه ملفات لم يتم مسحها

على العموم التقرير اهو

وعليكم السلام ورحمة الله وبركاته

 

وفيكِ بارك المولى ياحبيبة

 

الحمد لله

 

طيب ممكن الآن نحاول تحميل هذه الاداة والعمل بها ربما كان الفيرس سابقاً يهاجمها لذلك لم تكن تتم عملها

 

نريد أن نقوم بخطوة تعطيل إستعادة النظام

 

 

 

حملى هذه الاداة

 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

 

نضع الأداة على سطح المكتب

 

 

ينصح بشدة قبل استخدام الاداة باغلاق كافة البرامج وتعطيل برامج الحماية وترك الاداة تكمل عملية الفحص مهما طالت

 

يتم تشغيها بدبل كلك بعد التشغيل تابعى الشرح

 

 

ثم انتظرى حتى تخرج هذه الرسالة وتابعى الشرح

 

 

 

وهذه بعض من مراحل الفحص وتاكدى من عدم تحريك الجهاز او مقاطعة الفحص

 

 

 

عند المرحلة التالية قد يعاد تشغيل الجهاز في حال وجود اصابة قوية

 

وبعد اعادة التشغيل يكمل الفحص بشكل تلقائي

 

 

وعند المرحلة التالية يكون عملية انها الفحص وانشاء تقرير الفحص على القرص C كما هو واضح

 

 

بعد ذلك فضلاً أرفعى لى نسخة من التقرر الخاص بهذه الأداة

 

وتقرير جديد للهايجاك

 

فى انتظارك

 

: )

[أحلام وردية 7]

السلام عليكــم ورحمـة الله وبركاتــة ،،

 

حياكِ الله زمردة ،،

أنا نزلت البرنامج وكله تمام ، بس المشكلة إني لما بشغله مش بيكمل للأخر ، بيقد ربع ساعة فأكثر أو أقل وبعدين يهنج وأضطر أعمل ريستارت :(

وأنا عملته كذا مرة بيعمل نفس الموضوع

بس في الربع ساعة اللي إشتغلها في كل مرة مكنش بيظهر أي أصابات :)

لإنا جبتلك تقرير الهايجاك ، وقوليلي لو لازم أعمل التاني ولا لأ ، أبقي أحاول معاه مرة آخري :)

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:58:51 PM, on 6/3/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

D:\Program Files\Alwil Software\Avast4\ashServ.exe

D:\WINDOWS\system32\spoolsv.exe

D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

D:\Program Files\Alwil Software\Avast4\ashWebSv.exe

D:\WINDOWS\system32\rundll32.exe

D:\WINDOWS\system32\VTTimer.exe

D:\WINDOWS\system32\S3trayp.exe

D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

D:\WINDOWS\system32\svchost.exe

D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

D:\WINDOWS\system32\wscntfy.exe

D:\WINDOWS\system32\wuauclt.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?ref=hp

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe

O4 - HKLM\..\Run: [HDAudDeck] D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Trickler] "d:\documents and settings\administrator\local settings\temp\~vis0000\fsg_4104.exe"

O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe

 

--

End of file - 4283 bytes

 

 

منتظراكِ :))

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

نفس المشكلة برضوا زمردة

وحاولت تانى وعملت الخطوات الاخيرة

وشغلت الاداة تانى برضوا بيفتحلى صفحة الـdocuments ويجيبلى رسالة ال alert

وعلى فكرة التاسك منجر مجرد ما بعمل الخطوات اللى في رد 21 بلقيها مش متفعلة تانى وخصوصا بعد ال remove

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

وده تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:49:56 م, on 02/06/2011

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\system.exe

C:\WINDOWS\TEMP\VRTE.tmp

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\userinit.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am...amp;affID=18042

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&am...amp;affID=18042

F2 - REG:system.ini: UserInit=C:\WINDOWS\userinit.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll

O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [babylonToolbar] "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [l0ym04fyv1] C:\Documents and Settings\H\l0ym04fyv1.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: تحميل محتوى FLV بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetVL.htm

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O21 - SSODL: MSNServiceObj - {AD26AC5F-8421-419C-8692-ED0FE1FE74D8} - C:\Program Files\Messenger\msmsgs.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 3614 bytes

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

 

حياكِ الله زمردة ،،

أنا نزلت البرنامج وكله تمام ، بس المشكلة إني لما بشغله مش بيكمل للأخر ، بيقد ربع ساعة فأكثر أو أقل وبعدين يهنج وأضطر أعمل ريستارت :(

وأنا عملته كذا مرة بيعمل نفس الموضوع

بس في الربع ساعة اللي إشتغلها في كل مرة مكنش بيظهر أي أصابات :)

لإنا جبتلك تقرير الهايجاك ، وقوليلي لو لازم أعمل التاني ولا لأ ، أبقي أحاول معاه مرة آخري :)

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

طيب حبيبتى ممكن تشغليه ولكن بالوضع الآمن

 

للدخول على الوضع الآمن اتبعى التالى

 

طريقة الدخول للوضع الآمن المعروف بـ الـ Safe Mode

 

 

عند ظهور هذه الشاشة تبدأ بالضغط على F8

 

 

 

 

 

 

 

 

 

ونحاول تشغيل الاداة

 

فى انتظارك

 

: )

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

نفس المشكلة برضوا زمردة

وحاولت تانى وعملت الخطوات الاخيرة

وشغلت الاداة تانى برضوا بيفتحلى صفحة الـdocuments ويجيبلى رسالة ال alert

وعلى فكرة التاسك منجر مجرد ما بعمل الخطوات اللى في رد 21 بلقيها مش متفعلة تانى وخصوصا بعد ال remove

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

 

شغلي البرنامج مرة أخرى واعملى سكان

 

وبعد مايظهر لكِ التقرير الذى فى البرنامج نفسه وليس ملف التيكست اتبعى التالى

 

علمى صح أمام هذه القيم وانتبهى بارك الله فيكِ حتى لانفسد شىء

 

 

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&am...amp;affID=18042

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&am...amp;affID=18042

 

F2 - REG:system.ini: UserInit=C:\WINDOWS\userinit.exe

 

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll

 

O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll

 

O4 - HKLM\..\Run: [babylonToolbar] "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I

 

O4 - HKUS\S-1-5-18\..\Run: [l0ym04fyv1] C:\Documents and Settings\H\l0ym04fyv1.exe (User 'SYSTEM')

 

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

 

O21 - SSODL: MSNServiceObj - {AD26AC5F-8421-419C-8692-ED0FE1FE74D8} - C:\Program Files\Messenger\msmsgs.dll

 

 

بعد وضع علامة صح ثم اختارى fix وتابعى مثل الصور

 

 

ثم

 

 

 

بعد ذلك فضلاً اتبعى هذه الخطوات اريد قائمة بالبرامج المثبتة على جهازك

 

تابعى بالصور بارك الله فيكِ

 

 

 

 

 

بعد ذلك بيظهر لكِ ملف تيكست الصقيه بردك القادم

 

 

فى انتظارك

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

عملت الخطوات حبيبتى ومسحت القيم وظهرتلى هذه الرسالة

this application has failed to start because. dll was not found re instaling the application may fix this proplem

وعملت تانى اسكان ملقتش الo7 اتمسحت لقيتها زى ماهى

وده الملف اللي حضرتك طلبتيه

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

AMD Processor Driver

Babylon toolbar

High Definition Audio Driver Package - KB888111

HijackThis 2.0.2

Internet Download Manager

Malwarebytes' Anti-Malware version 1.51.0.1200

Microsoft Office Professional Edition 2003

Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox (3.6.2)

NVIDIA Drivers

Pro Evolution Soccer 2010

Real Alternative 1.50

Realtek High Definition Audio Driver

SecondLifeViewer2 (remove only)

VLC media player 1.0.0-rc1

Winamp (remove only)

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows Media Player 11

Windows Media Player 11

WinRAR archiver

Yahoo! Messenger

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

عملت الخطوات حبيبتى ومسحت القيم وظهرتلى هذه الرسالة

this application has failed to start because. dll was not found re instaling the application may fix this proplem

وعملت تانى اسكان ملقتش الo7 اتمسحت لقيتها زى ماهى

وده الملف اللي حضرتك طلبتيه

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

AMD Processor Driver

Babylon toolbar

High Definition Audio Driver Package - KB888111

HijackThis 2.0.2

Internet Download Manager

Malwarebytes' Anti-Malware version 1.51.0.1200

Microsoft Office Professional Edition 2003

Microsoft User-Mode Driver Framework Feature Pack 1.0.0 (Pre-Release 5348)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox (3.6.2)

NVIDIA Drivers

Pro Evolution Soccer 2010

Real Alternative 1.50

Realtek High Definition Audio Driver

SecondLifeViewer2 (remove only)

VLC media player 1.0.0-rc1

Winamp (remove only)

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows Media Player 11

Windows Media Player 11

WinRAR archiver

Yahoo! Messenger

وعليكم السلام ورحمة الله وبركاته

 

اول شىء نريد حذف التولبار الذى باللون الأحمر بارك الله فيكِ

 

أما بالنسبة لهذه الرسالة

 

this application has failed to start because. dll was not found re instaling the application may fix this proplem

 

ممكن اعرف ظهرت لك أمتى؟

 

عند فتح الجهاز أم عند فتح برنامج معين وياريت اسمه؟

 

ايضاً قبل كلمة dll بيكون فى اسم الملف اعتقد نسيتى تنقليه فممكن تنقليه بالضبط

 

الخطوة الجديدة نريد فحص مالوير طبعاً بعد الفحص اريد تقريره

 

فى انتظارك

 

: )

[بنوته مسلمه مصريه 458]

مسحت القيمة اللى حضرتك قلتي عليها

الرسالة ظهرت بعد ما عملت اسكان من الهايجاك وعلمت على القيم علشان امسحها

مكنش فيه اسم ملف انا نقلتها بالظبط

بس فيه رسالة بعدها

كان فيها haijack this is about remove aBHO and the corresponding file from list ومكملتش باقى الرسالة لان الجزء المتبقى كان فيه انى اقفل النت

ان شاء الله اعمله وارجع

[بنوته مسلمه مصريه 458]

تقرير المالوير

ملحوظة عن عمل remove ظهرتلى الرسالة تانى اكثر من مره

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

 

Database version: 6765

 

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

 

02/06/2011 10:03:44 م

mbam-log-2011-06-02 (22-03-44).txt

 

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|)

Objects scanned: 198822

Time elapsed: 24 minute(s), 12 second(s)

 

Memory Processes Infected: 2

Memory Modules Infected: 3

Registry Keys Infected: 55

Registry Values Infected: 1

Registry Data Items Infected: 6

Folders Infected: 0

Files Infected: 46

 

Memory Processes Infected:

c:\WINDOWS\userinit.exe (Trojan.Agent) -> 1812 -> Unloaded process successfully.

c:\WINDOWS\system32\system.exe (Trojan.Agent) -> 1984 -> Unloaded process successfully.

 

Memory Modules Infected:

c:\WINDOWS\Temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\system32\wmdrtc32.dll (Virus.Sality) -> Delete on reboot.

c:\WINDOWS\linkinfo.dll (Trojan.Agent) -> Delete on reboot.

 

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arvmon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killhidepid.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStore.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravt08.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngPS.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Syscheck2.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp (Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.

 

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smwcore (Backdoor.Agent.PS) -> Value: smwcore -> Quarantined and deleted successfully.

 

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Bad: (C:\WINDOWS\userinit.exe) Good: () -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

c:\WINDOWS\Temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\userinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\wmdrtc32.dll (Virus.Sality) -> Delete on reboot.

c:\WINDOWS\system32\system.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT10.tmp (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\Temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\6PQ0JT3V\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\H\local settings\temporary internet files\Content.IE5\Y8IAB3DW\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[2].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[3].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[4].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[5].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[6].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\68NRGB30\g[7].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[1].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[2].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[3].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[4].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[5].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[6].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\YJU0NBGX\d[7].css (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\program files\messenger\msmsgs.dll (Trojan.AntiAV) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001006.dll (Virus.Sality) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001007.sys (Trojan.Alman) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001331.EXE (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001479.dll (Virus.Sality) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001487.sys (Trojan.Alman) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001808.EXE (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001825.dll (Virus.Sality) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001916.sys (Trojan.Alman) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0002825.dll (Virus.Sality) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0002833.sys (Trojan.Alman) -> Quarantined and deleted successfully.

c:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0003156.EXE (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\clusapi.exe (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\MSGSCR.TLB (Trojan.AntiAV) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\adsnw.exe (Backdoor.Agent.PS) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\drivers\cdralw.sys (Trojan.Alman) -> Quarantined and deleted successfully.

d:\system volume information.exe (Trojan.Agent) -> Quarantined and deleted successfully.

d:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001053.exe (Trojan.Agent) -> Quarantined and deleted successfully.

d:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001529.exe (Trojan.Agent) -> Quarantined and deleted successfully.

d:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0001857.exe (Trojan.Agent) -> Quarantined and deleted successfully.

d:\system volume information\_restore{60f05e42-95af-43d9-b0ff-a7fc3ed0b0f0}\RP2\A0002878.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\program files\messenger\customsat.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\system32\wmdrtc32.dl_ (Virus.Sality) -> Quarantined and deleted successfully.

c:\WINDOWS\linkinfo.dll (Trojan.Agent) -> Delete on reboot.

[*زمـــردة* 59]

وعليكم السلام ورحمة الله وبركاته

 

طيب ياجميل ولا يهمك

 

شوفى ياستى سنقوم بتحميل هذه الاداة

 

http://download.geo.drweb.com/pub/drweb/cureit/cureit.exe

 

ونقوم بتشغيلها بدبل كليك عليها

 

لكن اريد أن انبهك على إنها تأخذ وقت طويل حسب سعة الهارد عندك

 

ايضاً لم يمكنكِ ممارسة أى عمل على الجهاز وقت عملها

 

لذلك انصحك أن تتركيها طوال الليل شغالة مع مراعاة تشغيل مروحة بجانب الجهاز إذا كان الجو حار عندك

 

لكن بإن الله نتيجتها ممتازة

 

نبدأ على بركة الله

 

 

هذه صورة البرنامج بعد التحميل (يُرجى وضعه على سطح المكتب)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

بعد الانتهاء تقومين فضلاً بضغط التقرير ورفعه بالمرفقات بصيغة ZIP

 

فى انتظارك

 

: )

[أحلام وردية 7]

حبيبتي عذرًا ولكن أين أجد هذه الشاشة ؟

 

 

حتي أضغط علي f8 ؟؟

تم تعديل 4 يونيو, 2011 بواسطة أحلام وردية

[*زمـــردة* 59]

حبيبتي عذرًا ولكن أين أجد هذه الشاشة ؟

 

 

حتي أضغط علي f8 ؟؟

حياكِ الله ياحبيبة

 

ولا يهمك

 

شوفى اختى بعد عمل إعادة تشغيل للجهاز بيتظهر لكِ هه الصفحة السوداء اضغطى على f8

 

حتى لا يدخل على الويندوز ونكمل باقى الخطوات

 

فى انتظارك

 

: )

[أحلام وردية 7]

:mrgreen:

يا غالية والله ما شفت الصفحة ديه ، مش عارفة أوصل لها ! ;-)

حتي قفلت الجهاز وجيت شغلته ومن الأول أتك علي f8 مش بيحصل حاجة خالص ، لحد ما إتحمل الويندوز ودخل عادي ،

؟!

[*زمـــردة* 59]

طيب حبيبتى اول ماتعيدى تشغيل الجهاز لاتضغطى على f8

 

إلا بعد أن تظهر صفحة البداية السوداء الشبيهة بالصورة وليس ضرورى أن تكون مطابقة لها

 

لكن ستجدى فيها كتابات وعد فى هذه الحالة اضغطى على f8

 

: )

[أحلام وردية 7]

حاولت يا غالية ما في حاجة بتحصل :(

بصي أنا عادي بأضغط علي زر التشغيل ، أول حاجة بتظهر شاشة فيها إسم الجهاز بأستخدم لاب توب " Troy " وتحت بيحمل خط أزرق

وبعدين شاشة سودة ما فيها أي كلام - حاولت أتك فيها ما تغير شئ برضو - وبعدين شاشة الإكس بي والتحميل العادي وبعدين شاشة سودة برضو فاضية - ضغطت ما بيحصل حاجة - وبعدين الشاشة اللبني فيها إسم الويندوز وبعدين بيدخل عادي علي الجهاز بدون أي تغيير :)

 

فين بقي ؟ :mrgreen: