السلام عليكم ورحمة الله وبركاته

وكل عام والجميع بخير وعيد سعيد

اعزائي اعضاء منتدى لك عندي مشكله في جهازي الاب توب

رفعة ظغطي ولا ادري ما سببها

اولا عندما افتح اي صفحه يعلق الجهاز حتى الماوس لا يتحرك

فاقوم وافصل التيار الكهربائي والبطاريه لاغلاق الجهاز

لا ادري شو سبب تعليق الجهاز

ثانيا اليوم صادفتني هذه النوافد وحاولت احذفها من الجهاز ولكن دون فائده

والمشكله مو عارفه اش هذه وكيف احدفها من جهازي لان حقيقي عاملتلي قلق

حتى اما اريد اذخل واتصفح اي موقع تجيني صفحه مكتوب عليها

عفوا الموقع المطلوب غير متاح

وهذه هيا صور المشكله التي صادفتني اليوم:













هذا كل الي يواجهني

يريت اجد حل لمعرفة ما هذا الذي يحصل في الجهاز وكيف اتخلص منها

واكون لكم من الشاكرين

ادخلي اضافة وازالة البرامج واحذفي هذا البرنامج
SpyWare Guard

حذفته من اضافه وازاله بما اني لم اثبته من قبل

ولكن للاسف يعود في شريط ابدأ بجانب الساعه



شاكره لك تعاونك

من اضافة وازالة البرامج حذفتية؟

اممممم وهاتي تقرير لجهازك

1- حملي الملف التالي لجهازك شكله كذا




http://abulwleed.googlepages.com/HijackThis.exe


الآن قومي بتشغل هذا الملف وستظهر لك شاشة فيها رسالة اضغطي نعم او ok


2- الآن ستظهر لك شاشة كما يلي :




2- اضغطي على زر Do system scan and save a logofile وانتظري قليلا حتى يتم تحليل الجهاز .

3- هنا بعد التحليل ستظهر هذه الشاشة وبعدها مستند نصي .




4- الآن ...المستند الذي يتم حفظه وسيتم العمل من خلال محتوياته لاحقا على سطح المكتب





5- اتمنى الأن منك تفك هذا المستند وتنسخي كل الي جواه وتحطيه هنا في المنتدى لأبدأ تحليل المشكلة واعطيك الحل بإذن الله .

اتمنى منك الصبر ،

وبانتظار تقريرك ...

اختي لما حذفتيه عن طريق لوحة التحكم هل عاد ؟؟؟؟؟

اقصد انه لو رجعتي للوحة التحكم بتلاقينه موجود

اشكركما على تعاونكما معي يا

الخبراء العرب & عاشق الدمعة

ايه حذفته من اضافه وازالة البرامج ولكن المشكله تواجهني حتي بعد ازالة من اضافة وازالة البرامج

ولقد طبقت ما قاله لي الاخ خبراء العرب وهذا هو التقرير الموجود في المستند

Logfile of HijackThis v1.99.1
Scan saved at 03:16:36 م, on 11/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\winscenter.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\services.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Guard 2008\spywareguard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\??????????????????????????????????????????????? ?s and Settings\AAKK.AAA-E4B01E77D52\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shoq7.com/vb/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDO WS\system32\twext.exe,
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\sw g.dll
O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:\WINDOWS\system32\AlxTB2.dll
O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINDOWS\system32\SHDOCVW.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [spywareguard] C:\Program Files\Spyware Guard 2008\spywareguard.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Alexa Web Search - http://client.alexa.com/holiday/scri...ons/search.htm
O8 - Extra context menu item: Get Alexa Data - http://client.alexa.com/holiday/scri...s/sitedata.htm
O8 - Extra context menu item: Mail to a Friend... - http://client.alexa.com/holiday/scri...ons/mailto.htm
O8 - Extra context menu item: See Related Links - http://client.alexa.com/holiday/scri...ns/related.htm
O8 - Extra context menu item: Write a Review... - http://client.alexa.com/holiday/scri...ons/review.htm
O8 - Extra context menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://74.53.69.87/cp/files/talk4.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DL L
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O21 - SSODL: ieModule - {46D02422-5B93-4133-BA25-E51D5B69644E} - C:\??????????????????????????????????????????????? ?s and Settings\All Users.WINDOWS\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll
O21 - SSODL: InternetConnection - {3B146176-DE79-4ECB-8D28-5D0235EC96D1} - C:\??????????????????????????????????????????????? ?s and Settings\All Users.WINDOWS\Application Data\Microsoft\Internet Explorer\DLLs\kdigoqqfqw.dll
O23 - Service: Alerter Alerterdmadmin (Alerterdmadmin) - Unknown owner - .exe (file missing)
O23 - Service: COM+ System Application COMSysAppmnmsrvcPolicyAgent (COMSysAppmnmsrvcPolicyAgent) - Unknown owner - .exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Error Reporting Service ERSvcstisvc (ERSvcstisvc) - Unknown owner - .exe (file missing)
O23 - Service: Fast User Switching Compatibility FastUserSwitchingCompatibilityusnjsvc (FastUserSwitchingCompatibilityusnjsvc) - Unknown owner - .exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Workstation lanmanworkstationLmHosts (lanmanworkstationLmHosts) - Unknown owner - .exe (file missing)
O23 - Service: Workstation lanmanworkstationNetDDEdsdm (lanmanworkstationNetDDEdsdm) - Unknown owner - .exe (file missing)
O23 - Service: Messenger MessengerPlugPlay (MessengerPlugPlay) - Unknown owner - .exe (file missing)
O23 - Service: NetMeeting Remote Desktop Sharing mnmsrvcNetDDEdsdm (mnmsrvcNetDDEdsdm) - Unknown owner - .exe (file missing)
O23 - Service: NetMeeting Remote Desktop Sharing mnmsrvcPolicyAgent (mnmsrvcPolicyAgent) - Unknown owner - .exe (file missing)
O23 - Service: Network DDE DSDM NetDDEdsdmdmadmin (NetDDEdsdmdmadmin) - Unknown owner - .exe (file missing)
O23 - Service: Office Source Engine osegusvc (osegusvc) - Unknown owner - .exe (file missing)
O23 - Service: Protected Storage ProtectedStorageusnjsvc (ProtectedStorageusnjsvc) - Unknown owner - .exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Task Scheduler ScheduleRasMan (ScheduleRasMan) - Unknown owner - .exe (file missing)
O23 - Service: Task Scheduler ScheduleRasMan ScheduleRasManTermService (ScheduleRasManTermService) - Unknown owner - .exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Print Spooler Spoolerwinmgmt (Spoolerwinmgmt) - Unknown owner - .exe (file missing)
O23 - Service: MS Software Shadow Copy Provider SwPrvTermService (SwPrvTermService) - Unknown owner - .exe (file missing)
O23 - Service: Themes ThemesNetman (ThemesNetman) - Unknown owner - .exe (file missing)
O23 - Service: Telnet TlntSvrAppMgmt (TlntSvrAppMgmt) - Unknown owner - .exe (file missing)
O23 - Service: Telnet TlntSvrRpcSs (TlntSvrRpcSs) - Unknown owner - .exe (file missing)
O23 - Service: Distributed Link Tracking Client TrkWksTlntSvrAppMgmt (TrkWksTlntSvrAppMgmt) - Unknown owner - .exe (file missing)
O23 - Service: Universal Plug and Play Device Host upnphostRemoteRegistry (upnphostRemoteRegistry) - Unknown owner - .exe (file missing)
O23 - Service: Universal Plug and Play Device Host upnphostRemoteRegistry upnphostRemoteRegistryHidServ (upnphostRemoteRegistryHidServ) - Unknown owner - .exe (file missing)
O23 - Service: Universal Plug and Play Device Host upnphostRSVP (upnphostRSVP) - Unknown owner - .exe (file missing)


انشاءالله اجد الحل واكون لكم من الشاكرين

اكبر تقرير شفتة بالمنتدي الصراحة

أبدي خطوة خطوة

C:\WINDOWS\system32\winscenter.exe

C:\WINDOWS\services.exe

C:\Program Files\Spyware Guard 2008\spywareguard.exe

R3 - URLSearchHook: (no name) - - (no file)

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\fservice.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDO WS\system32\twext.exe,

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\sw g.dll

O2 - BHO: AlxTB BHO - {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - C:\WINDOWS\system32\AlxTB2.dll

O3 - Toolbar: Alexa - {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} - C:\WINDOWS\system32\SHDOCVW.DLL

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [spywareguard] C:\Program Files\Spyware Guard 2008\spywareguard.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe

O8 - Extra context menu item: Alexa Web Search - http://client.alexa.com/holiday/scri...ons/search.htm

O8 - Extra context menu item: Get Alexa Data - http://client.alexa.com/holiday/scri...s/sitedata.htm

O8 - Extra context menu item: Mail to a Friend... - http://client.alexa.com/holiday/scri...ons/mailto.htm

O8 - Extra context menu item: See Related Links - http://client.alexa.com/holiday/scri...ns/related.htm

O8 - Extra context menu item: Write a Review... - http://client.alexa.com/holiday/scri...ons/review.htm

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll

O21 - SSODL: ieModule - {46D02422-5B93-4133-BA25-E51D5B69644E} - C:\??????????????????????????????????????????????? ?s and Settings\All Users.WINDOWS\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll

O21 - SSODL: InternetConnection - {3B146176-DE79-4ECB-8D28-5D0235EC96D1} - C:\??????????????????????????????????????????????? ?s and Settings\All Users.WINDOWS\Application Data\Microsoft\Internet Explorer\DLLs\kdigoqqfqw.dll

O23 - Service: Alerter Alerterdmadmin (Alerterdmadmin) - Unknown owner - .exe (file missing)

O23 - Service: COM+ System Application COMSysAppmnmsrvcPolicyAgent (COMSysAppmnmsrvcPolicyAgent) - Unknown owner - .exe (file missing)

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: Error Reporting Service ERSvcstisvc (ERSvcstisvc) - Unknown owner - .exe (file missing)

O23 - Service: Fast User Switching Compatibility FastUserSwitchingCompatibilityusnjsvc (FastUserSwitchingCompatibilityusnjsvc) - Unknown owner - .exe (file missing)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Workstation lanmanworkstationLmHosts (lanmanworkstationLmHosts) - Unknown owner - .exe (file missing)

O23 - Service: Workstation lanmanworkstationNetDDEdsdm (lanmanworkstationNetDDEdsdm) - Unknown owner - .exe (file missing)

O23 - Service: Messenger MessengerPlugPlay (MessengerPlugPlay) - Unknown owner - .exe (file missing)

O23 - Service: NetMeeting Remote Desktop Sharing mnmsrvcNetDDEdsdm (mnmsrvcNetDDEdsdm) - Unknown owner - .exe (file missing)

O23 - Service: NetMeeting Remote Desktop Sharing mnmsrvcPolicyAgent (mnmsrvcPolicyAgent) - Unknown owner - .exe (file missing)

O23 - Service: Network DDE DSDM NetDDEdsdmdmadmin (NetDDEdsdmdmadmin) - Unknown owner - .exe (file missing)

O23 - Service: Office Source Engine osegusvc (osegusvc) - Unknown owner - .exe (file missing)

O23 - Service: Protected Storage ProtectedStorageusnjsvc (ProtectedStorageusnjsvc) - Unknown owner - .exe (file missing)

O23 - Service: Task Scheduler ScheduleRasMan (ScheduleRasMan) - Unknown owner - .exe (file missing)

O23 - Service: Task Scheduler ScheduleRasMan ScheduleRasManTermService (ScheduleRasManTermService) - Unknown owner - .exe (file missing)

O23 - Service: Print Spooler Spoolerwinmgmt (Spoolerwinmgmt) - Unknown owner - .exe (file missing)

O23 - Service: MS Software Shadow Copy Provider SwPrvTermService (SwPrvTermService) - Unknown owner - .exe (file missing)

O23 - Service: Themes ThemesNetman (ThemesNetman) - Unknown owner - .exe (file missing)

O23 - Service: Telnet TlntSvrAppMgmt (TlntSvrAppMgmt) - Unknown owner - .exe (file missing)

O23 - Service: Telnet TlntSvrRpcSs (TlntSvrRpcSs) - Unknown owner - .exe (file missing)

O23 - Service: Distributed Link Tracking Client TrkWksTlntSvrAppMgmt (TrkWksTlntSvrAppMgmt) - Unknown owner - .exe (file missing)

O23 - Service: Universal Plug and Play Device Host upnphostRemoteRegistry (upnphostRemoteRegistry) - Unknown owner - .exe (file missing)

O23 - Service: Universal Plug and Play Device Host upnphostRemoteRegistry upnphostRemoteRegistryHidServ (upnphostRemoteRegistryHidServ) - Unknown owner - .exe (file missing)

O23 - Service: Universal Plug and Play Device Host upnphostRSVP (upnphostRSVP) - Unknown owner - .exe (file missing)




تقريباً اغلب القيم ورا بعضها

لو شايفاهم كثار ممكن اجيبلك اللي ما تحذفية فقط والباقي احذفية يمكن يكون اسهلك

اختي تقريرك يحمل الكثير من القيم الضاره زي ماقالك خبراء العرب


اختي حملي البرنامج هذا

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

وقفلي كل شي وشغليه ولا تلمسين اي حاجه حتى الماوس ،،،

وهو راح يقوم بعمله الين ينتهي

اولا جزاكم الله خير الجزاء لما قدمتموه من مساعده

وجعله الله في موازين حسناتكم وزادكم الله علما على علمكم

وسامحوني لاني تعبتكم معاي اليوم

اخوي عاشق الدمعة لقد طبقت مثلما قلت وفي الاخير جاتني مفكره log

ومحتواها التالي ولكن للاسف لم افهم شي :

ComboFix 08-12-11.03 - AAKK 12/11/2008 16:39:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.731 [GMT -8:00]
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1.exe
C:\Autorun.exe
C:\autorun.inf
C:\D.exe
c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\addon.dat
c:\??????????????????????????????????????????????? ?s and settings\AAKK\Application Data\inst.exe
c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll
c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\svhost.exe
c:\program files\alexa toolbar
c:\program files\alexa toolbar\uninstall.exe
c:\program files\Spyware Guard 2008
c:\program files\Spyware Guard 2008\conf.cfg
c:\program files\Spyware Guard 2008\mbase.vdb
c:\program files\Spyware Guard 2008\quarantine.vdb
c:\program files\Spyware Guard 2008\queue.vdb
c:\program files\Spyware Guard 2008\spywareguard.exe
c:\program files\Spyware Guard 2008\uninstall.exe
c:\program files\Spyware Guard 2008\vbase.vdb
c:\windows\IE4 Error Log.txt
c:\windows\ktd32.atm
c:\windows\reged.exe
c:\windows\services.exe
c:\windows\spoolsystem.exe
c:\windows\sys.com
c:\windows\syscert.exe
c:\windows\sysexplorer.exe
c:\windows\system\sservice.exe
c:\windows\system32\alxres.dll
c:\windows\system32\AlxTB1.dll
c:\windows\system32\AlxTB2.dll
c:\windows\system32\Cache
c:\windows\system32\drivers\Winis33.sys
c:\windows\system32\fservice.exe
c:\windows\system32\reginv.dll
c:\windows\system32\twain_32
c:\windows\system32\twain_32\local.ds
c:\windows\system32\twain_32\user.ds
c:\windows\system32\twext.exe
c:\windows\system32\WinCtrl32.dll
c:\windows\system32\winkey.dll
c:\windows\system32\winscenter.exe
c:\windows\system32\x64
c:\windows\vmreg.dll
D:\Autorun.inf
d:\recycler\autorun.exe
d:\recycler\autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS
-------\Legacy_WINIS33
-------\Service_Winis33

((((((((((((((((((((((((( Files Created from 2008-11-12 to 2008-12-12 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-12-11 18:21 77,824 ----a-w c:\windows\eimsn.exe
2008-12-11 18:21 27,136 ----a-w c:\windows\Pplugin8.exe
2008-12-11 18:21 162,816 ----a-w c:\windows\PpluginCd.dll
2008-12-11 18:20 17,331 ----a-w c:\windows\Pplugin10xa.exe
2008-12-11 18:19 7,680 ----a-w c:\windows\Pplugin4.exe
2008-12-11 15:34 2,704 ----a-w c:\windows\system32\TDSSfxmp.dll
2008-12-11 12:54 --------- d-----w c:\program files\Spyware Doctor
2008-12-11 12:51 --------- d---a-w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\TEMP
2008-12-11 07:19 73,728 ----a-w c:\windows\system32\TDSScfum.dll
2008-12-11 07:19 60,416 ----a-w c:\windows\system32\drivers\TDSSmaxt.sys
2008-12-11 07:19 35,840 ----a-w c:\windows\system32\TDSSofxh.dll
2008-12-11 07:19 31,232 ----a-w c:\windows\system32\TDSSriqp.dll
2008-12-11 07:19 29,696 ----a-w c:\windows\system32\TDSSnrsr.dll
2008-12-09 20:04 --------- d-----w c:\program files\NSS
2008-12-09 16:01 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Installations
2008-12-09 15:24 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\PC Suite
2008-12-09 15:24 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\Nokia
2008-12-09 15:23 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_C oinstaller_Critical.Wdf
2008-12-09 15:23 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_010 05.Wdf
2008-12-09 15:21 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\PC Suite
2008-12-09 15:20 --------- d-----w c:\program files\PC Connectivity Solution
2008-12-09 15:20 --------- d-----w c:\program files\Nokia
2008-12-09 15:20 --------- d-----w c:\program files\DIFX
2008-12-09 15:20 --------- d-----w c:\program files\Common Files\PCSuite
2008-12-09 15:20 --------- d-----w c:\program files\Common Files\Nokia
2008-12-02 22:32 --------- d-----w c:\program files\JAAScois
2008-11-29 19:55 --------- d-----w c:\program files\WimsPrg
2008-11-28 13:54 --------- d-----w c:\program files\VeryPDF PDF2Word v3.0
2008-11-27 18:09 --------- d-----w c:\program files\Readiris Pro 11 Mr.Underground Edition
2008-11-27 14:46 --------- d-----w c:\program files\Safety-lab
2008-11-26 20:49 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\AdobeUM
2008-11-23 12:33 --------- d-----w c:\program files\Collage Maker
2008-11-21 15:19 --------- d-----w c:\program files\WinPcap
2008-11-21 00:06 --------- d-----w c:\program files\MSN Messenger
2008-11-21 00:06 --------- d-----w c:\program files\Messenger Plus! Live
2008-11-20 22:50 --------- d-----w c:\program files\tsonamy
2008-11-20 17:23 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\audioproxybeep
2008-11-20 17:22 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\comp two long internet
2008-11-20 17:21 --------- d-----w c:\program files\audioproxybeep
2008-11-20 17:13 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-11-20 16:56 --------- d-----w c:\program files\Adverts
2008-11-18 20:31 --------- d-----w c:\program files\Yahoo!
2008-11-17 15:44 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-17 15:44 --------- d-----w c:\program files\ICQ6Toolbar
2008-11-17 15:44 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\ICQ
2008-11-12 10:31 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Poke admin tons bike
2008-11-07 10:36 --------- d-----w c:\program files\LtUcx
2008-11-03 10:21 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-11-03 03:53 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Yahoo!
2008-11-02 18:55 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\Yahoo!
2008-11-01 22:23 --------- d-----w c:\program files\Micro-Sys Software
2008-11-01 22:23 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAKK.AAA-E4B01E77D52\Application Data\Micro-Sys
2008-10-29 23:36 --------- d-----w c:\program files\Google
2008-10-29 21:31 --------- d-----w c:\program files\Delicious Add-on for Internet Explorer
2008-10-26 14:37 --------- d-----w c:\program files\LeapFTP 3.0
2008-10-26 14:19 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Creative
2008-10-26 14:17 --------- d-----w c:\program files\Creative
2008-10-26 14:11 --------- d--h--w c:\program files\Creative Installation Information
2008-10-26 14:10 --------- d-----w c:\program files\Common Files\Creative
2008-10-26 14:01 --------- d-----w c:\program files\Common Files\InstallShield
2008-10-25 19:27 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Messenger Plus!
2008-10-25 19:25 --------- d-----w c:\program files\Windows Live
2008-10-25 19:25 --------- d-----w c:\program files\Circle Developement
2008-10-18 17:21 --------- d-----w c:\program files\MSBuild
2008-10-18 17:21 --------- d-----w c:\program files\Microsoft Works
2008-10-18 16:46 47,104 ------w c:\windows\AKDeInstall.exe
2008-10-18 16:46 --------- d-----w c:\program files\mpegable
2008-10-18 16:45 499,712 ----a-w c:\windows\system32\msvcp71.dll
2008-10-18 16:45 348,160 ----a-w c:\windows\system32\msvcr71.dll
2008-10-18 16:08 910,464 ----a-r c:\windows\system32\igmedkrn.dll
2008-10-18 14:36 --------- d-----w c:\program files\Realtek
2008-10-18 14:35 315,392 ----a-w c:\windows\HideWin.exe
2008-10-18 13:39 25,327 ----a-w c:\??????????????????????????????????????????????? ?s and settings\AAA\Application Data\don.dat
2008-10-18 12:13 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-10-17 23:25 --------- d-----w c:\program files\internet
2008-10-17 12:32 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAA\Application Data\audioproxybeep
2008-10-17 12:30 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAA\Application Data\Malwarebytes
2008-10-14 10:03 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAA\Application Data\AdobeUM
2008-10-13 23:52 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAA\Application Data\Vbuzzer Messenger
2008-10-12 21:16 --------- d-----w c:\??????????????????????????????????????????????? ?s and settings\AAA\Application Data\URSoft
2008-09-23 14:27 47,360 ----a-w c:\??????????????????????????????????????????????? ?s and settings\AAKK\Application Data\pcouffin.sys
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
.
------- Sigcheck -------
06/20/2008 02:44 AM 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
06/20/2008 03:51 AM 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
06/20/2008 03:59 AM 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
08/03/2004 12:14 PM 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB951748$\tcpip.sys
04/13/2008 11:20 AM 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\SoftwareDistribution\Download\cf8ec753e 88561d2ddb53e183dc05c3e\tcpip.sys
06/20/2008 02:45 AM 360320 1cc09561e21a48a7f649a40f18235860 c:\windows\system32\dllcache\tcpip.sys
06/20/2008 02:45 AM 360320 1cc09561e21a48a7f649a40f18235860 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B}"= "c:\windows\system32\SHDOCVW.DLL" [08/19/2008 09:38 PM 1494528]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [08/03/2004 01:56 PM 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [11/12/2008 11:18 AM 68856]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [01/19/2007 11:55 AM 5674352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/03/2004 01:56 PM 15360]
[HKLM\~\startupfolder\C:^?????????????????????????? ??????????????????????s and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\?????????????????????????????????????????? ??????s and settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKLM\~\startupfolder\C:^?????????????????????????? ??????????????????????s and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^سرعة تشغيل Adobe Reader.lnk]
path=c:\?????????????????????????????????????????? ??????s and settings\All Users.WINDOWS\Start Menu\Programs\Startup\سرعة تشغيل Adobe Reader.lnk
backup=c:\windows\pss\سرعة تشغيل Adobe Reader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Chic pure]
--a------ 11/20/2008 09:20 AM 640512 c:\docume~1\AAKK~1.AAA\APPLIC~1\AUDIOP~1\bend memo 16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 08/03/2004 01:56 PM 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTRegRun]
--------- 10/05/2006 10:17 PM 53248 c:\windows\Ctregrun.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Doraah]
--a------ 01/07/2000 08:20 PM 320512 c:\unzipped\00099\DORAAH.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 10/26/2006 11:47 PM 31016 c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
-ra------ 10/18/2008 08:08 AM 162584 c:\windows\system32\hkcmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
-ra------ 10/18/2008 08:08 AM 142104 c:\windows\system32\igfxtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 08/03/2004 11:32 AM 208952 c:\windows\ime\IMJP8_1\imjpmig.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Long Internet Team Stupid]
--a------ 12/11/2008 03:51 AM 3964928 c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\comp two long internet\view frag.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 08/04/2004 12:06 AM 1667584 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 01/19/2007 11:55 AM 5674352 c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 06/17/2008 04:00 PM 1249280 c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 10/02/2008 07:00 AM 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
-ra------ 10/18/2008 08:08 AM 138008 c:\windows\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 08/03/2004 11:32 AM 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 08/03/2004 11:32 AM 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 11/12/2008 11:18 AM 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 10/18/2008 08:45 AM 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 11/06/2007 03:39 PM 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 11/06/2007 03:40 PM 16384512 c:\windows\RTHDCPL.exe
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\dodancviiqi.exe"=
"c:\\WINDOWS\\gymqd.exe"=
S2 Alerterdmadmin;Alerter Alerterdmadmin; srv []
S2 COMSysAppmnmsrvcPolicyAgent;COM+ System Application COMSysAppmnmsrvcPolicyAgent; srv []
S2 ERSvcstisvc;Error Reporting Service ERSvcstisvc; srv []
S2 FastUserSwitchingCompatibilityusnjsvc;Fast User Switching Compatibility FastUserSwitchingCompatibilityusnjsvc; srv []
S2 lanmanworkstationLmHosts;Workstation lanmanworkstationLmHosts; srv []
S2 lanmanworkstationNetDDEdsdm;Workstation lanmanworkstationNetDDEdsdm; srv []
S2 MessengerPlugPlay;Messenger MessengerPlugPlay; srv []
S2 mnmsrvcNetDDEdsdm;NetMeeting Remote Desktop Sharing mnmsrvcNetDDEdsdm; srv []
S2 mnmsrvcPolicyAgent;NetMeeting Remote Desktop Sharing mnmsrvcPolicyAgent; srv []
S2 NetDDEdsdmdmadmin;Network DDE DSDM NetDDEdsdmdmadmin; srv []
S2 osegusvc;Office Source Engine osegusvc; srv []
S2 ProtectedStorageusnjsvc;Protected Storage ProtectedStorageusnjsvc; srv []
S2 ScheduleRasMan;Task Scheduler ScheduleRasMan; srv []
S2 ScheduleRasManTermService;Task Scheduler ScheduleRasMan ScheduleRasManTermService; srv []
S2 Spoolerwinmgmt;Print Spooler Spoolerwinmgmt; srv []
S2 SwPrvTermService;MS Software Shadow Copy Provider SwPrvTermService; srv []
S2 ThemesNetman;Themes ThemesNetman; srv []
S2 TlntSvrAppMgmt;Telnet TlntSvrAppMgmt; srv []
S2 TlntSvrRpcSs;Telnet TlntSvrRpcSs; srv []
S2 TrkWksTlntSvrAppMgmt;Distributed Link Tracking Client TrkWksTlntSvrAppMgmt; srv []
S2 upnphostRemoteRegistry;Universal Plug and Play Device Host upnphostRemoteRegistry; srv []
S2 upnphostRemoteRegistryHidServ;Universal Plug and Play Device Host upnphostRemoteRegistry upnphostRemoteRegistryHidServ; srv []
S2 upnphostRSVP;Universal Plug and Play Device Host upnphostRSVP; srv []
S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\NPF.sys [2007-01-25 42000]
S3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIG Y.SYS [2008-12-09 32377]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{8c7fb2ee-c77e-11dd-9fdf-001f3a7d3f62}]
\ShElL\AutoplAY\coMmanD - F:\clmys.cmd
\ShElL\AutoRun\command - F:\clmys.cmd
\ShElL\eXPlORE\COmmaND - F:\clmys.cmd
\ShElL\OpEn\commanD - F:\clmys.cmd
.
Contents of the 'Scheduled Tasks' folder
2008-12-12 c:\windows\Tasks\A8C5923F918A0823.job
- c:\docume~1\aakk~1.aaa\applic~1\audiop~1\insideboo kthat.exe [11/20/2008 09:23 AM]
.
- - - - ORPHANS REMOVED - - - -
BHO-{F1FABE79-25FC-46de-8C5A-2C6DB9D64333} - c:\windows\system32\AlxTB2.dll
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
HKLM-Run-spywareguard - c:\program files\Spyware Guard 2008\spywareguard.exe
HKLM-Explorer_Run-DirectX For Microsoft® Windows - c:\windows\system32\fservice.exe
MSConfigStartUp-ICQ - c:\program files\ICQ6\ICQ.exe
MSConfigStartUp-ISTray - c:\program files\Spyware Doctor\pctsTray.exe
MSConfigStartUp-spywareguard - c:\program files\Spyware Guard 2008\spywareguard.exe
MSConfigStartUp-tons bike intra poll - c:\??????????????????????????????????????????????? ?s and settings\All Users.WINDOWS\Application Data\Poke admin tons bike\Platform bows.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.shoq7.com/vb/index.php
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: ت&صدير إلى Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\windows\web\related.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - c:\windows\web\related.htm -
c:\windows\system32\msvcrt.dll - c:\windows\system32\mfc42.dll
c:\windows\system32\olepro32.dll
c:\windows\Downloaded Program Files\Authenticatedll.dll
c:\windows\Downloaded Program Files\imcv1.dll
O16 -: {6924091F-CD97-41E1-B1D4-D9079409D413}
hxxp://74.53.69.87/cp/files/talk4.cab
c:\windows\Downloaded Program Files\talk.inf
.
************************************************** ************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-11 16:46:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\A lerterdmadmin]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\C OMSysAppmnmsrvcPolicyAgent]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\E RSvcstisvc]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\F astUserSwitchingCompatibilityusnjsvc]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\l anmanworkstationLmHosts]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\l anmanworkstationNetDDEdsdm]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\M essengerPlugPlay]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\m nmsrvcNetDDEdsdm]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\m nmsrvcPolicyAgent]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N etDDEdsdmdmadmin]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\o segusvc]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\P rotectedStorageusnjsvc]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S cheduleRasMan]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S cheduleRasManTermService]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S poolerwinmgmt]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S wPrvTermService]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\T hemesNetman]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\T lntSvrAppMgmt]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\T lntSvrRpcSs]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\T rkWksTlntSvrAppMgmt]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\u pnphostRemoteRegistry]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\u pnphostRemoteRegistryHidServ]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\u pnphostRSVP]
"ImagePath"=" srv"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\T DSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSpxwt .sys"
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
C:\
.
************************************************** ************************
.
Completion time: 12/11/2008 16:47:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-12 00:47:48
Pre-Run: 25,245,540,352 bytes free
Post-Run: 27,361,218,560 bytes free
371 --- E O F --- 2008-10-24 10:00:35


ولكن بعون الله انحلت المشكله لانني لم اراء النافده التي قلقتني اليوم بعد ما طبقت مثل ما قلت

وهذا بفضل الله عزوجل ثمُ بفضلكم

دمتم لنا بهذا التميز والابداع