|| أحلام وردية || تقرير الهايجاك الخاص بى

*زمـــردة* · 9 يوليو, 2011

حياكِ الله حبوبة

بعتذر عن التأخير

شوف ياجميل هاهى القيم المراد اصلاحها

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2233703

R3 - URLSearchHook: WhiteSmoke Translator Toolbar - {2df69f3c-56fa-4c5b-99e5-be861443de46} - C:\Program Files (x86)\WhiteSmoke_Translator\tbWhit.dll

R3 - URLSearchHook: 4shared.com Toolbar - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files (x86)\4shared.com\tb4sha.dll

O2 - BHO: 4shared.com Toolbar - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files (x86)\4shared.com\tb4sha.dll

O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - C:\Program Files (x86)\McAfee\MSK\MskAPBho.dll

O2 - BHO: WhiteSmoke Translator Toolbar - {2df69f3c-56fa-4c5b-99e5-be861443de46} - C:\Program Files (x86)\WhiteSmoke_Translator\tbWhit.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files (x86)\google\googletoolbar1.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\google\googletoolbar1.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: WhiteSmoke Translator Toolbar - {2df69f3c-56fa-4c5b-99e5-be861443de46} - C:\Program Files (x86)\WhiteSmoke_Translator\tbWhit.dll

O3 - Toolbar: 4shared.com Toolbar - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files (x86)\4shared.com\tb4sha.dll

O4 - HKCU\..\Run: [4shared Desktop] "C:\Program Files (x86)\4shared Desktop\desktop.exe" "startup"

O4 - Global Startup: Launch WhiteSmoke Translator.lnk = C:\Program Files (x86)\WhiteSmoke\WhiteSmoke Translator\WSTrayDictMode.exe

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O13 - Gopher Prefix:

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

راجعيها على قيمك طبعاً ستجديها ازيد منها

وبعتذر على العُجالة ولنا متابعة من جديد بعد سفرى بإذن الله إذا قدر ربي لى ذلك

استودعكِ الله الذى لاتضيع ودائعه

: )

أحلام وردية · 25 يوليو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

هل عدتِ يا حبيبة ؟؟ :)

أسأل الله أن تكوني بخير،

كنت نزلت ويندوز جديد للجهاز وعملت تقرير بالهايجاك، قلت أنزله هنا تشوفيه وأفتكر شوية لإني نسيت كل حاجة :)

أنا هأحلله إن شاء الله وأقول إيه القيم اللي المفروض تتمسح بس هأستناكِ تأكدي عليا برضو :)

_ ___

التقرير

_ _

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:44:11 ?, on 25/07/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\rundll32.exe

D:\Program Files\Unlocker\UnlockerAssistant.exe

D:\Program Files\Drive Space Indicator\DrvSpace.exe

D:\Program Files\LClock\LClock.exe

D:\WINDOWS\system32\VTTimer.exe

D:\WINDOWS\system32\S3trayp.exe

D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Internet Download Manager\IDMan.exe

D:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

D:\WINDOWS\system32\svchost.exe

D:\Program Files\Internet Download Manager\IEMonitor.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\Program Files\Mozilla Firefox\plugin-container.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [unlockerAssistant] D:\Program Files\Unlocker\UnlockerAssistant.exe -H

O4 - HKLM\..\Run: [DriveSpace] D:\Program Files\Drive Space Indicator\DrvSpace.exe

O4 - HKLM\..\Run: [LClock] D:\Program Files\LClock\LClock.exe

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe

O4 - HKLM\..\Run: [HDAudDeck] D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - D:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5

c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,00,68,0

0,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,57,00,75,00,6

4,00,66,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,47,00,72,00,6f,00,75,00,70,0

0,00,00 (file missing)

--

End of file - 6002 bytes

_ _ _ _

في مشاركتي القادمة إن شاء الله أقول القيم المراد مسحها

أحلام وردية · 25 يوليو, 2011

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - D:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

دول بعد البحث لقتهم المفروض يتمسحوا ...

_ _

القيمة الأخيرة عليها علامة خطأ هي الوحيدة التي حاولت مسحها ولكنها لا تمسح، حاولت مرات عديدة أمسحها وأعمل تقرير تاني تكون متمسحتش برضو !

_ __

باقي القيم

اللي عليهم علامة استفهام

مش لقيت إنهم يتمسحوا :)

في انتظار أهل الخبرة :)

*زمـــردة* · 29 يوليو, 2011

السلام عليكــم ورحمـة الله وبركاتــة ،،

هل عدتِ يا حبيبة ؟؟ :)

أسأل الله أن تكوني بخير،

كنت نزلت ويندوز جديد للجهاز وعملت تقرير بالهايجاك، قلت أنزله هنا تشوفيه وأفتكر شوية لإني نسيت كل حاجة :)

أنا هأحلله إن شاء الله وأقول إيه القيم اللي المفروض تتمسح بس هأستناكِ تأكدي عليا برضو :)

في مشاركتي القادمة إن شاء الله أقول القيم المراد مسحها

وعليكم السلام ورحمـة الله وبركاتــه ،،

حياكِ الله حبوبة

بعتذر عن التأخير

الحمد لله أنا بخير فقط دخولى متقطع ربي ييسر الأحوال فالشبكة هنا ليست طيبة

: )

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - D:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe

دول بعد البحث لقتهم المفروض يتمسحوا ...

_ _

القيمة الأخيرة عليها علامة خطأ هي الوحيدة التي حاولت مسحها ولكنها لا تمسح، حاولت مرات عديدة أمسحها وأعمل تقرير تاني تكون متمسحتش برضو !

_ __

باقي القيم

اللي عليهم علامة استفهام

مش لقيت إنهم يتمسحوا :)

في انتظار أهل الخبرة :)

تمام حبوبة

لكن يلزم فحص الجهاز ببرنامج المالوير

افحصيه وضعى لى تقريره بعدما ينتهى

: )

أحلام وردية · 29 يوليو, 2011

تقرير المالوير

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7319

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

29/07/2011 05:43:04 ?

mbam-log-2011-07-29 (17-43-04).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 184871

Time elapsed: 29 minute(s), 16 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 9

Memory Processes Infected:

d:\documents and settings\eslam\application data\xmibmhajlq3gl3nmpmkmtqrewfzqm2jd2\svcnost.exe (Trojan.Agent) -> 1824 -> Unloaded process successfully.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssend (Trojan.Agent) -> Value: mssend -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

d:\documents and settings\eslam\application data\xmibmhajlq3gl3nmpmkmtqrewfzqm2jd2\svcnost.exe (Trojan.Agent) -> Delete on reboot.

d:\program files\internet download manager\internet.download.manager.6.xx.(2011)-patch.exe (PUP.Hacktool.Patcher) -> Not selected for removal.

d:\program files\internet download manager\SnDk&p.exe (RiskWare.Tool.CK) -> Not selected for removal.

d:\system volume information\_restore{7cf7a20b-3f0c-4092-bf78-8ad80c5ecc24}\RP11\A0001955.EXE (Trojan.FakeMS) -> Quarantined and deleted successfully.

d:\WINDOWS\ie8\iexplore.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

e:\Programs\idm\internet download manager 6.06 beta 7.arabseed.com\patch.arabseed.com\internet.download.manager.6.xx.(2011)-patch.exe (PUP.Hacktool.Patcher) -> Not selected for removal.

e:\Programs\idm\internet download manager 6.06 beta 7.arabseed.com\patch.arabseed.com\SnDk&p.exe (RiskWare.Tool.CK) -> Not selected for removal.

e:\Programs\Malware\malwarebytes' anti-malware patch.exe (Dont.Steal.Our.Software) -> Not selected for removal.

e:\RECYCLER\s-1-5-21-861567501-261478967-1644491937-500\De4.exe (PUP.Hacktool.Patcher) -> Quarantined and deleted successfully.

أحلام وردية · 29 يوليو, 2011

تقرير هايجاك جديد

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 05:52:31 ?, on 29/07/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\svchost.exe

D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

D:\WINDOWS\system32\rundll32.exe

D:\Program Files\Unlocker\UnlockerAssistant.exe

D:\Program Files\Drive Space Indicator\DrvSpace.exe

D:\Program Files\LClock\LClock.exe

D:\WINDOWS\system32\VTTimer.exe

D:\WINDOWS\system32\S3trayp.exe

D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Internet Download Manager\IDMan.exe

D:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

D:\Program Files\Internet Download Manager\IEMonitor.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\Program Files\Mozilla Firefox\plugin-container.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [unlockerAssistant] D:\Program Files\Unlocker\UnlockerAssistant.exe -H

O4 - HKLM\..\Run: [DriveSpace] D:\Program Files\Drive Space Indicator\DrvSpace.exe

O4 - HKLM\..\Run: [LClock] D:\Program Files\LClock\LClock.exe

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe

O4 - HKLM\..\Run: [HDAudDeck] D:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray