الفوتو مش بيفتح

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

انا عملت تقرير تانى للهايجاك ظهرتلى قيم جديدة مش عارفه ليه

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:21:38 ص, on 12/06/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

C:\Program Files\Trend Micro\HijackThis\HIJACKTHIS.EXE

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKLM\..\Policies\Explorer\Run: [60xu9] C:\WINDOWS\TEMP\qtfcyyp.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Startup: 70hyo0k.exe

O4 - Startup: 70tpkk6.exe

O4 - Startup: a70hyo0k.exe

O4 - Startup: e1fwwriidu.exe

O4 - Startup: fb2xsdy1.exe

O4 - Startup: ni1ealgg6c.exe

O4 - Startup: vrhhdttp.exe

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 3934 bytes

[*زمـــردة* 59]

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

اول شىء إنتِ استخدمتى الاداة بشكل مضبوط فلاتقلقى

 

بالنسبة لموضوع النيو هارد وير فده لأنك منزلة ويندوز جديد ممكن تلغيها بإنك تضغطى عليها دبل كليك

 

هتظهر لنا نافذة بها 3 اختيارات

 

آخر اختيار معناه إننا مش عوزين النافذة دى تظهر تانى ااختاريه واضغطى اوكى

 

بالنسبة للقيم الجديدة ظهورها نتيجة عدم حذف القيم التى تبقت

 

طيب نريد التأكد من تعطيل استعادة النظام

 

وبعد ذلك حملى هذه الاداة ونفذى الشرح داخل الموضوع

 

https://akhawat.islamway.net/forum/index.ph...t&p=3147327

 

المهم لاتعملى على الجهاز اثناء الفحص ولاتقلقى لن تأخذ وقت طويل بإذن الله

 

بعد ذلك اريد تقرير هايجاك جديد

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

كيفك حبيبتى

انا حملت الاداة واشتغلت بيها 3ساعات وكانت لسه في الd

واخويا كان عايز الجهاز فقفلتها وده التقرير لحد الدى

على فكرة كانت بطيئة جدا لدرجة انى كنت بظنها وقفت

noor_re.zip

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

وده تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:22:21 م, on 12/06/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Documents and Settings\h.GENIUS-PC\Application Data\updates\updates.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

C:\WINDOWS\system32\wuauclt.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\ynwdew2bu.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\Trend Micro\HijackThis\HIJACKTHIS.EXE

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: Winamp Toolbar Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RegistryWm] C:\WINDOWS\system32\qtwm.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [engel] C:\Documents and Settings\h.GENIUS-PC\Application Data\updates\updates.exe

O4 - HKLM\..\Policies\Explorer\Run: [60xu9] C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Startup: 0mmhndz.exe

O4 - Startup: 70hyo0k.exe

O4 - Startup: 70tpkk6.exe

O4 - Startup: 760di81.exe

O4 - Startup: 9u1qmmh.exe

O4 - Startup: a1gwcn5ej.exe

O4 - Startup: a70hyo0k.exe

O4 - Startup: avmmhyyt.exe

O4 - Startup: e1fwwriidu.exe

O4 - Startup: falw5hdtte.exe

O4 - Startup: fb2xsdy1.exe

O4 - Startup: ni1ealgg6c.exe

O4 - Startup: qmmhyytpvq.exe

O4 - Startup: tpvqq7ni.exe

O4 - Startup: vrhhdttp.exe

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 4851 bytes

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

كيفك حبيبتى

انا حملت الاداة واشتغلت بيها 3ساعات وكانت لسه في الd

واخويا كان عايز الجهاز فقفلتها وده التقرير لحد الدى

على فكرة كانت بطيئة جدا لدرجة انى كنت بظنها وقفت

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

حبيبتى حتى ننتهى من مشكلة الجهاز يجب أن نتحمل قليلاً

 

فالاداة بتأخذ وقت لأنه أكيد الملفات الموجودة كثيرة

 

ايضاً عندما توقفيها عن العمل فإنها ستبدأ من جديد وكأن كل الساعات السابقة على الفاضى

 

شغلي البرنامج مرة أخرى واعملى سكان

 

وبعد مايظهر لكِ التقرير الذى فى البرنامج نفسه وليس ملف التيكست اتبعى التالى

 

علمى صح أمام هذه القيم وانتبهى بارك الله فيكِ حتى لانفسد شىء

 

R3 - URLSearchHook: Winamp Toolbar Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll

 

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

 

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

 

O4 - HKCU\..\Run: [engel] C:\Documents and Settings\h.GENIUS-PC\Application Data\updates\updates.exe

 

O4 - HKLM\..\Policies\Explorer\Run: [60xu9] C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

 

O4 - Startup: 0mmhndz.exe

 

O4 - Startup: 70hyo0k.exe

 

O4 - Startup: 70tpkk6.exe

 

O4 - Startup: 760di81.exe

 

O4 - Startup: 9u1qmmh.exe

 

O4 - Startup: a1gwcn5ej.exe

 

O4 - Startup: a70hyo0k.exe

 

O4 - Startup: avmmhyyt.exe

 

O4 - Startup: e1fwwriidu.exe

 

O4 - Startup: falw5hdtte.exe

 

O4 - Startup: fb2xsdy1.exe

 

O4 - Startup: ni1ealgg6c.exe

 

O4 - Startup: qmmhyytpvq.exe

 

O4 - Startup: tpvqq7ni.exe

 

O4 - Startup: vrhhdttp.exe

 

 

بعد وضع علامة صح ثم اختارى fix وتابعى مثل الصور

 

 

ثم

 

 

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

هذا هو التقرير كاملا بفضل الله

noor_re.zip

 

وهذا تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:15:02 ص, on 14/06/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\qtwm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\qtfcyyp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\DOCUME~1\HB70E~1.GEN\LOCALS~1\Temp\6a7fr167e.exe

C:\WINDOWS\TEMP\VRT2.tmp

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HIJACKTHIS.EXE

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RegistryWm] C:\WINDOWS\system32\qtwm.exe

O4 - HKLM\..\Run: [klpvunes] C:\WINDOWS\System32\klpvunes.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [engel] C:\Documents and Settings\h.GENIUS-PC\Application Data\updates\updates.exe

O4 - HKLM\..\Policies\Explorer\Run: [60xu9] C:\WINDOWS\TEMP\qtfcyyp.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [sx621] C:\Documents and Settings\h.GENIUS-PC\sx621.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 4372 bytes

[*زمـــردة* 59]

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

تمام بارك الله فيكِ التقرير افضل

 

فقط نريد فحص بالمالوير

 

ثم بريد تقريره + تقرير هايجاك جديد

 

ولاتقلقى بإذن الله نحن فى النهائيات

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

تقرير المالوير

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

 

Database version: 6859

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

14/06/2011 02:43:50 ص

mbam-log-2011-06-14 (02-43-50).txt

 

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|)

Objects scanned: 278851

Time elapsed: 33 minute(s), 1 second(s)

 

Memory Processes Infected: 3

Memory Modules Infected: 1

Registry Keys Infected: 3

Registry Values Infected: 8

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 67

 

Memory Processes Infected:

c:\documents and settings\h.genius-pc\application data\updates\updates.exe (Trojan.Agent) -> 2148 -> Unloaded process successfully.

c:\WINDOWS\Temp\VRT15.tmp (Trojan.Agent) -> 1348 -> Unloaded process successfully.

c:\WINDOWS\system32\qtwm.exe (Trojan.Agent) -> 444 -> Unloaded process successfully.

 

Memory Modules Infected:

c:\WINDOWS\system32\nwcwks.dll (Trojan.Inject) -> Delete on reboot.

 

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MouseDriver (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\tgs90gv74r (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS (Malware.Trace) -> Quarantined and deleted successfully.

 

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\engel (Trojan.Agent) -> Value: engel -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\engel (Trojan.Agent) -> Value: engel -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pj6vi7wlh9 (Trojan.Agent) -> Value: pj6vi7wlh9 -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\l0ym04fyv1 (Trojan.Agent) -> Value: l0ym04fyv1 -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sx621 (Trojan.Agent) -> Value: sx621 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegistryWm (Trojan.Agent) -> Value: RegistryWm -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\60xu9 (Trojan.Downloader) -> Value: 60xu9 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MouseDriver\ImagePath (Trojan.Agent) -> Value: ImagePath -> Quarantined and deleted successfully.

 

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

c:\WINDOWS\system32\nwcwks.dll (Trojan.Inject) -> Delete on reboot.

c:\documents and settings\h.genius-pc\application data\updates\updates.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\pj6vi7wlh9.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\l0ym04fyv1.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\sx621.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\application data\lpblk.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\local settings\Temp\6a7fr167e.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\local settings\Temp\etuj4wjebe.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\program files\tnod user & password finder\TNODUP.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\program files\tnod user & password finder\uninst-tnod.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

c:\RECYCLER\s-1-5-21-1307947514-0037511489-057286741-7811\djwi2kcew.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\RECYCLER\s-1-5-21-4265881227-1680903729-836828417-7165\djwi2kcew.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\smbinst.exe (Backdoor.Hupigon) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\calc.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\etuj4wjebe.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT17.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT3.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT5.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\VRT8.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\Fonts\services.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINXP\system32\calc.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

c:\WINXP\system32\ctfmon.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\WINXP\system32\smbinst.exe (Backdoor.Hupigon) -> Quarantined and deleted successfully.

c:\WINXP\system32\dllcache\calc.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

c:\WINXP\system32\dllcache\ctfmon.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

c:\WINXP\system32\dllcache\smbinst.exe (Backdoor.Hupigon) -> Quarantined and deleted successfully.

d:\english\fullgrammar\fullgrammar\ENGLISH.EXE (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

d:\system volume information\_restore{7838bd2c-a7fb-4f6c-9e99-7b21db6570d7}\RP5\A0001836.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP6\A0001344.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP6\A0002072.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP7\A0002237.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP7\A0003015.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP8\A0003954.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP8\A0004161.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP8\A0004586.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP8\A0005477.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP9\A0007143.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP9\A0007853.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{a46bd51d-e464-4402-89a2-0287063b3576}\RP9\A0009169.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0002366.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0002736.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0002576.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0002771.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0003209.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0003385.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0003527.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0003707.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0004863.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0005178.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0006151.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0006592.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0007170.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0007597.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0007915.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0008241.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\system volume information\_restore{23058932-13e5-47c4-bf1f-66590f183e9b}\RP0\A0010741.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

d:\العاب\I G I\IGI.EXE (Trojan.FakeAlert) -> Quarantined and deleted successfully.

e:\tnod-1.4.0.15.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

e:\new folder (2)\nod\tnod-1.4.0.15.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.

e:\pes 6\pilsner game.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\qtwm.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\h.genius-pc\application data\mousedriver.bat (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\qtfcyyp.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

 

بس جبله رساله ان فيه certain item couldnot be removed

 

ده تقرير الهايجاك

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:46:38 ص, on 14/06/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\userinit.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\System32\klpvunes.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HIJACKTHIS.EXE

C:\Program Files\Internet Download Manager\IEMonitor.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [klpvunes] C:\WINDOWS\System32\klpvunes.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O8 - Extra context menu item: تحميل الكل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: تحميل بواسطة Internet Download Manager - C:\Program Files\Internet Download Manager\IEExt.htm

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 3696 bytes

 

تصبحى على خير ^ــــــــ^

[*زمـــردة* 59]

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

بعتذر عن التأخير

 

تمام بارك الله فيكِ التقرير افضل

 

طيب طمنينى على حال الجهاز معكِ الآن؟

 

هل تقابلك أى مشكلة فيه؟

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

كان نفسي اقلك خلاص تمام

بس جهازى كسفنى دايما

بعد ما المشكلة اتحلت النسخة سقطت لوحدها سطبتها تانى وعملت تعطيل للنظام خوفا ان الفيرس يرجع نفسه تانى

بعد كده سطبت الافيرا وعملت اسكان بس معرفتش احذف الفيروسات ولقيت في الفيروسات ملف اسمه سالتى

جريت عالطول عالى المالوير وعملت اسكان ملقتش فيه سالتى خالص الحمد لله والتاسك متفعله

جيت اتاكد ان النظام متعطل اول ما ضغط على البروبرتيز ظهرتلى الرسالة دى

 

ونفس الرسالة ظهرتلى لما جيت اظبط الساعة

انا مش عارفة ده معنااه ايه

انا اسفة بجد انا مترددة اصلا ان اقولك علشان حاسة انى بقيت رخمة اوى في انى شغلاك دايما بجهازى

بس انا مش عارفه اعمل ايه انا بقى عندى فوبيا من الجهاز ده

خايفة دايما انه يحصله حاجة او يرجع الفيرس ده تانى

[*زمـــردة* 59]

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

بعتذر عن التأخير

 

لاتقلقى بإذن الله خير

 

طيب الصورة مش ظاهرة فضلاً ارفعيها مرة اخرى

 

: )

[بنوته مسلمه مصريه 458]

السلام عليكــم ورحمـة الله وبركاتــة ،،

كيفك زوزو

اخبارك ايه حبيبتى

فك الله كربك ويسر أمرك واسعدك في الدارين اللهم امين

طيب الصورة مش ظاهرة فضلاً ارفعيها مرة اخرى

الحقيقة مش هعرف الجهاز مش حاسس بالنت بقاله كام يوم

انا داخلة من الجهاز التانى علشان كده بدخل متأخرة

ان شاء الله اخواتى يفرمتوه او يشوفولوا حل

تعبتك معايا معلش ربنا يجزيك خير على تعبك معايا ومع الاخوات

أحبك في الله ^ـــــــــــ^

[*زمـــردة* 59]

السلام عليكــم ورحمـة الله وبركاتــة ،،

كيفك زوزو

اخبارك ايه حبيبتى

فك الله كربك ويسر أمرك واسعدك في الدارين اللهم امين

طيب الصورة مش ظاهرة فضلاً ارفعيها مرة اخرى

الحقيقة مش هعرف الجهاز مش حاسس بالنت بقاله كام يوم

انا داخلة من الجهاز التانى علشان كده بدخل متأخرة

ان شاء الله اخواتى يفرمتوه او يشوفولوا حل

تعبتك معايا معلش ربنا يجزيك خير على تعبك معايا ومع الاخوات

أحبك في الله ^ـــــــــــ^

وعليكم السلام ورحمة الله وبركاته

 

حياكِ الله ياحبيبة

 

الحمد لله بخير

 

اللهم آمين ياحبيبة وإياكِ بإذن الله

 

يسر الله لكِ أمرك غاليتى

 

بإذن الله خير واعذرينى كان ودى اساعد

 

وانتِ من اهل الجزاء

 

أحبك الله وحبب فيكِ جميع خلقه وأنا ايضاً احبك فى الله

 

: )