ممكن المساعده ارجوكم

nado4;6337295:
ملف fix.regغير موجود عندي

هالملف انتي راح تنشئينه بهالطريقة


ثم افتحي صفحة Notepad جديدة ،، واحفظيها في الديسك توب ،، في خانة Save As Type اختاري All Files ،،، وفي خانة File name اكتبي fix.reg ((اﻻفضل اعملي لها نسخ ولصق))


واحفظيها ،، وبعد حفظها اذهبي الى الديسك توب واضغطي دبل كليك ع الملف fix.reg

وانتظري قليلاً ليكمل عمله

عملت كده بتظهر رساله
are you sure you want to add the information in c/dosumedesktop fix.regto the registr


بعمل غثس مش بيقبل

nado4;6337503:
عملت كده بتظهر رساله
are you sure you want to add the information in c/dosumedesktop fix.regto the registr


بعمل غثس مش بيقبل

اختاري yes او اوكي

بعمل كده بس بيقولمش بيقبل

nado4;6337591:
بعمل كده بس بيقولمش بيقبل

اوكي اختاري NO

واكملي باقي الخطوات

عملت قال مفيش اي فيلات

والملف الي في السي فارغ

nado4;6338112:
عملت قال مفيش اي فيلات

والملف الي في السي فارغ

انتي في خطوة الحين؟؟؟

بالنسبه لبرنامج mbam
مش بيفتح الرابط وبيظهر index

انا خلصت الخطوه التانيه بس الثالثه مش نافعه

وبيديني الرابط
http://go.3roos.com/gi3e05azD8h

اوكي لحظة خلينا خطوة خطوة

في الخطوة الثالثة حملتي الملف؟؟ او ﻻ؟؟



نأتي الان الى الخطوة الثالثة:

- حملي هالملف VundoFix.exe واحفظيه في الديسك توب
- دبل كليك ع الملف VundoFix.exe ثم اضغطي على Scan for Vundo
- وعند اكمال عملية الفحص اضغطي على Fix Vundo ،، راح تظهر لك رسالة تخبرك هل تريدين حذف الملفات اضغطي على YES
- عند الضغط على YES خلفية الديسك توب ستحذف منها الصورة وسيبدا البرنامج بالتنظيف
- عند اﻻنتهاء ستظهر رسالة تطلب اعادة تشغيل الجهاز اضغطي على OK وسيعاد تشغيل الجهاز
- وعند اعادة تشغيل الجهاز اذهبي الى هالمسار
my computer---------- Local Disk C--------vundofix.txt

واعملي نسخ لكل المعلومات المحفوظة فيه والصقيها في ردك القادم

انا اسفه انا في الخطوه الرابعه

nado4;6338238:
انا اسفه انا في الخطوه الرابعه

يعني خلصتي الخطوة الثالثة ؟؟؟

طيب وين تقرير الخطوة الثالثة؟؟

الخطوه التالته قل لايوجد فيل
و يوجد داخل لسي فيل فارغ

nado4;6338341:
الخطوه التالته قل لايوجد فيل
و يوجد داخل لسي فيل فارغ

في اي خطوة بالضبط وقفتي في الخطوة الثالثة ،؟؟ عزيزتي يجب عمل كل الخطوات وبالترتيب حتى تحل المشكلة


يعني بعد تحميل هالملف VundoFix.exe وحفظتيه في الديسك توب شو صار بعدها؟؟

ارجو التوضيح

انا اسفه جدا علي التاخير في الرد


بالنسبه للخطوه الرابعه انا انهته كلها
والرساله تقول انه لا يوجد ملافات


وانا حاليا في لخطوه الخامسه وبعد ما سطبت لبرنامج بيعمل دلوقتي اسكان بالmalwarebytes


وانا اسفه مره اخري علي التاخير لان الجهاز مبيفتحش اي حاجه بسهوله

تقرير mbam

Malwarebytes' Anti-Malware 1.17
Database version: 867
03:29:16 م 18/06/2008
mbam-log-6-18-2008 (15-29-16).txt
Scan type: Quick Scan
Objects scanned: 38287
Time elapsed: 5 minute(s), 52 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 35
Registry Keys Infected: 66
Registry Values Infected: 34
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 70
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\ergfwe.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\sergy.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\cedafb.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\hhrdxd.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\tfsdmz.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\fsrgeb.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\wyrsdj.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\pedadt.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\zdesfx.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\tdggrz.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\nhmxcjkl.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\skqncbib.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\tisqatyu.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\opshbbty.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\zptlcsys.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\rijxbkin.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\ozfyebyt.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\apsgfjba.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\ypdjgbmp.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\yxfhcjpg.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\mndhfdwd.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\ptjhehlp.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\mndsgsrv.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\lassaplo.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\pjjxedwd.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\lijzclit.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\mpwddapi.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\yxcschlp.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\zxmscwin.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\oswxdttb.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\mnmhgsrv.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\yzztjmsn.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\arjrcler.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\mpmyhapi.dll (Spyware.OnlineGames) -> Unloaded module successfully.
C:\WINDOWS\system32\akjsckaq.dll (Spyware.OnlineGames) -> Unloaded module successfully.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{84143967-b645-4bff-b873-da1dc886e9a7} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{17dfd111-bf3a-4cb4-adb0-88fcbfe69821} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{875e07b1-0614-43d9-a76e-d76a28ab3d7b} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ea5d4b0e-b8ce-4761-8c7e-5d26369f0ec6} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e51c0fd-ee36-434b-ad2a-fd1ff3731c38} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5e907a48-400e-4ea8-9792-ffae052d59e9} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{45aadfaa-dd36-42ab-83ad-0521bbf58c24} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4d165a2a-4bc1-4ca8-8299-08e05aaab5a4} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{37ac9076-c898-b098-d098-a18319080973} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{37ac9076-c898-b098-d098-a18319080973} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{32023698-6984-8541-9654-698745012523} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{32023698-6984-8541-9654-698745012523} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{18093456-9012-4568-9076-908765467181} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18093456-9012-4568-9076-908765467181} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{22596546-2036-9451-6058-658402589722} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22596546-2036-9451-6058-658402589722} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{50940f85-f015-14f1-a05f-f69858ac6d05} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50940f85-f015-14f1-a05f-f69858ac6d05} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{25fd6584-698f-bcd2-602c-698745210352} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25fd6584-698f-bcd2-602c-698745210352} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{5a069845-2036-6084-9054-6087502480a5} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5a069845-2036-6084-9054-6087502480a5} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6fd45a54-9875-698f-e56e-65102358fdf6} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fd45a54-9875-698f-e56e-65102358fdf6} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{91954fac-1023-154f-895a-1458258ad819} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{91954fac-1023-154f-895a-1458258ad819} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{83ba45af-faaa-cddd-beee-bcde1234ab38} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83ba45af-faaa-cddd-beee-bcde1234ab38} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6c648541-1025-9650-9057-6541258720c6} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6c648541-1025-9650-9057-6541258720c6} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{528df602-9541-a985-210a-984a698c6f25} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{528df602-9541-a985-210a-984a698c6f25} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{77fd640a-158f-48ac-fd14-1597f14a9777} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77fd640a-158f-48ac-fd14-1597f14a9777} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2b69874a-c58c-458d-69f0-698f874e41b2} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2b69874a-c58c-458d-69f0-698f874e41b2} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54fae856-ad58-20cb-a025-cd4895fa6e45} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54fae856-ad58-20cb-a025-cd4895fa6e45} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{3c954872-1230-6541-9548-6541025884c3} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3c954872-1230-6541-9548-6541025884c3} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{45694105-5108-9405-3695-954187462154} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45694105-5108-9405-3695-954187462154} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{35671234-7890-abcd-cdef-567801237653} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35671234-7890-abcd-cdef-567801237653} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6a041f13-a111-12a3-b0cf-f99818aa68a6} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6a041f13-a111-12a3-b0cf-f99818aa68a6} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{43512378-9874-5641-1025-985420368734} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43512378-9874-5641-1025-985420368734} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{7c8d1401-a58d-a81c-cd24-a5915c4517c7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7c8d1401-a58d-a81c-cd24-a5915c4517c7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a490415f-65f8-b5c5-d8ba-9405fb12054a} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a490415f-65f8-b5c5-d8ba-9405fb12054a} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{5c69034a-f45f-d34d-a33a-c33c4d324fc5} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5c69034a-f45f-d34d-a33a-c33c4d324fc5} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{8629ff4f-acdb-5c90-a098-facb3456a268} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8629ff4f-acdb-5c90-a098-facb3456a268} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3a908760-8000-4000-a000-9000322145a3} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3a908760-8000-4000-a000-9000322145a3} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{13fd5987-65d2-c58d-d87e-987451f12531} (Spyware.Passwords) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{13fd5987-65d2-c58d-d87e-987451f12531} (Spyware.Passwords) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5fd45a54-9875-698f-e56e-65102358fdf5} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9490415f-65f8-b5c5-d8ba-9405fb120549} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9490415f-65f8-b5c5-d8ba-9405fb120549} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{caed0f3b-df8b-4dbf-bb20-8dfbc3199068} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4629ff4f-acdb-5c90-a098-facb3456a264} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4629ff4f-acdb-5c90-a098-facb3456a264} (Trojan.BHO) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{84143967-b645-4bff-b873-da1dc886e9a7} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{17dfd111-bf3a-4cb4-adb0-88fcbfe69821} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{875e07b1-0614-43d9-a76e-d76a28ab3d7b} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{ea5d4b0e-b8ce-4761-8c7e-5d26369f0ec6} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1e51c0fd-ee36-434b-ad2a-fd1ff3731c38} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{5e907a48-400e-4ea8-9792-ffae052d59e9} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{45aadfaa-dd36-42ab-83ad-0521bbf58c24} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4d165a2a-4bc1-4ca8-8299-08e05aaab5a4} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{37ac9076-c898-b098-d098-a18319080973} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{32023698-6984-8541-9654-698745012523} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{18093456-9012-4568-9076-908765467181} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{22596546-2036-9451-6058-658402589722} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{50940f85-f015-14f1-a05f-f69858ac6d05} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{25fd6584-698f-bcd2-602c-698745210352} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{5a069845-2036-6084-9054-6087502480a5} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6fd45a54-9875-698f-e56e-65102358fdf6} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{91954fac-1023-154f-895a-1458258ad819} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{83ba45af-faaa-cddd-beee-bcde1234ab38} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6c648541-1025-9650-9057-6541258720c6} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{528df602-9541-a985-210a-984a698c6f25} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{77fd640a-158f-48ac-fd14-1597f14a9777} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{2b69874a-c58c-458d-69f0-698f874e41b2} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{54fae856-ad58-20cb-a025-cd4895fa6e45} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3c954872-1230-6541-9548-6541025884c3} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{45694105-5108-9405-3695-954187462154} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{35671234-7890-abcd-cdef-567801237653} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6a041f13-a111-12a3-b0cf-f99818aa68a6} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{43512378-9874-5641-1025-985420368734} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{7c8d1401-a58d-a81c-cd24-a5915c4517c7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{a490415f-65f8-b5c5-d8ba-9405fb12054a} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{5c69034a-f45f-d34d-a33a-c33c4d324fc5} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{8629ff4f-acdb-5c90-a098-facb3456a268} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{3a908760-8000-4000-a000-9000322145a3} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9490415f-65f8-b5c5-d8ba-9405fb120549} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\ergfwe.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\sergy.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\cedafb.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\hhrdxd.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\tfsdmz.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\fsrgeb.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\wyrsdj.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\pedadt.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\zdesfx.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\tdggrz.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\nhmxcjkl.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\skqncbib.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\tisqatyu.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\opshbbty.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\zptlcsys.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\rijxbkin.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\ozfyebyt.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\apsgfjba.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\ypdjgbmp.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\yxfhcjpg.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\mndhfdwd.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\ptjhehlp.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\mndsgsrv.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\lassaplo.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\pjjxedwd.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\lijzclit.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\mpwddapi.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\yxcschlp.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\zxmscwin.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\oswxdttb.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\mnmhgsrv.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\yzztjmsn.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\arjrcler.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\mpmyhapi.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\akjsckaq.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\ali\Local Settings\Temp\~f10.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\ali\Local Settings\Temp\~f11.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\ali\Local Settings\Temp\~f13.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\ali\Local Settings\Temp\~f7.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\ali\Local Settings\Temp\~f9.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\ali\Local Settings\Temp\~fB.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aitlasys.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\axmsawin.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dfqnabib.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\etshabty.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ghwxattb.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\isdsasrv.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ismhasrv.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lkssaplo.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lojxadwd.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lpmxajkl.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lpsgajba.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mkjraler.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mkjsakaq.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\onjzalit.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pldhadwd.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\posqatyu.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\simyaapi.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\siwdaapi.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\spjhahlp.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\stjxakin.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tjfyabyt.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zaztamsn.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zgrjdx.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zsdjabmp.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zxcsahlp.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zxfhajpg.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\cdralw.sys (Trojan.Alman) -> Quarantined and deleted successfully.
C:\WINDOWS\linkinfo.dll (Trojan.Downloader) -> Delete on reboot.
C:\MicroSoft.pif (Trojan.Agent) -> Quarantined and deleted successfully.

التقرير الاخير
ComboFix 08-06-16.5 - ali 06/18/2008 15:54:51.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1256.1.1033.18.276 [GMT 3:00]
Running from: C:\Documents and Settings\ali\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\AppPatch\AcXtrnel.dll
C:\WINDOWS\AppPatch\Jview.dll
C:\WINDOWS\system32\asfjthj.dll
C:\WINDOWS\system32\ergfwe.dll
C:\WINDOWS\system32\fassaplo.sys
C:\WINDOWS\system32\fstlbsys.sys
C:\WINDOWS\system32\fzmsbwin.sys
C:\WINDOWS\system32\gajzalit.sys
C:\WINDOWS\system32\ghjyer.dll
C:\WINDOWS\system32\gjbhr.dll
C:\WINDOWS\system32\gpsgajba.sys
C:\WINDOWS\system32\gsdhadwd.sys
C:\WINDOWS\system32\hgfhk.cfg
C:\WINDOWS\system32\hgfhk.dll
C:\WINDOWS\system32\hjk.dll
C:\WINDOWS\system32\ijsgajba.sys
C:\WINDOWS\system32\jashbbty.sys
C:\WINDOWS\system32\jkjkll.dll
C:\WINDOWS\system32\kduy.cfg
C:\WINDOWS\system32\kduy.dll
C:\WINDOWS\system32\lariytrz.cfg
C:\WINDOWS\system32\lariytrz.dll
C:\WINDOWS\system32\newxbttb.sys
C:\WINDOWS\system32\njritc.cfg
C:\WINDOWS\system32\njritc.dll
C:\WINDOWS\system32\oqrthc.cfg
C:\WINDOWS\system32\oqrthc.dll
C:\WINDOWS\system32\pmjhbhlp.sys
C:\WINDOWS\system32\sdjsakaq.sys
C:\WINDOWS\system32\sergy.dll
C:\WINDOWS\system32\smmhbsrv.sys
C:\WINDOWS\system32\spmybapi.sys
C:\WINDOWS\system32\spwdbapi.sys
C:\WINDOWS\system32\sqjsakaq.sys
C:\WINDOWS\system32\tiwxattb.sys
C:\WINDOWS\system32\toqnabib.sys
C:\WINDOWS\system32\ujkwet.dll
C:\WINDOWS\system32\wymxajkl.sys
C:\WINDOWS\system32\xdfntt.cfg
C:\WINDOWS\system32\xfgnfx.cfg
C:\WINDOWS\system32\xfgnfx.dll
C:\WINDOWS\system32\xfgnxfn.cfg
C:\WINDOWS\system32\xfgnxfn.dll
C:\WINDOWS\system32\xfztbmsn.sys
C:\WINDOWS\system32\xzcsbhlp.sys
C:\WINDOWS\system32\xzfhbjpg.sys
C:\WINDOWS\system32\ysjxbdwd.sys
C:\WINDOWS\system32\zdbdb.cfg
C:\WINDOWS\system32\zdbdb.dll
.
((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-18 12:20 18,048 ----a-w C:\WINDOWS\system32\drivers\eth8023.sys
2008-06-18 12:15 9,728 ----a-w C:\WINDOWS\AppPatch\AcSpecf.dll
2008-06-18 11:36 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-06-18 11:15 27,136 ----a-w C:\WINDOWS\AppPatch\AcPlugin.dll
2008-06-18 11:11 30 ----a-w C:\MicroSoft.bat
2008-06-18 11:11 186 ----a-w C:\MicroSoft.vbs
2008-06-16 19:28 --------- d-----w C:\Program Files\ERUNT
2008-06-16 08:54 --------- d-----w C:\Documents and Settings\ali\Application Data\Media Player Classic
2008-06-14 21:45 --------- d-----w C:\Documents and Settings\ali\Application Data\DivX
2008-06-13 19:58 --------- d-----w C:\Program Files\Google
2008-06-13 18:10 --------- d-----w C:\Program Files\Yahoo!
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-13 15:10 --------- d-----w C:\Documents and Settings\ali\Application Data\Malwarebytes
2008-06-12 22:46 --------- d-----w C:\Documents and Settings\ali\Application Data\Talkback
2008-06-12 21:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Media Player Classic
2008-06-12 18:09 --------- d-----w C:\Program Files\Yahoo! Games
2008-06-12 18:09 --------- d-----w C:\Program Files\TryMedia
2008-06-12 17:42 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-06-12 17:01 1,606 ----a-w C:\WINDOWS\system32\PerfStringBackup.TMP
2008-06-12 11:32 --------- d-----w C:\Program Files\Trend Micro
2008-06-10 16:02 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 16:02 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 14:36 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\xing shared
2008-06-09 09:03 --------- d-----w C:\Program Files\Common Files\Real
2008-06-09 09:02 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-06-09 09:02 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-06-08 20:13 --------- d-----w C:\Documents and Settings\ali\Application Data\Yahoo!
2008-06-08 19:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-06-07 16:11 --------- d-----w C:\Program Files\Real
2008-06-07 15:30 --------- d-----w C:\Program Files\Avira
2008-06-07 15:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
2008-06-07 14:09 --------- d-----w C:\Program Files\Winamp
2008-06-07 14:08 --------- d-----w C:\Documents and Settings\jana\Application Data\Winamp
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\jana\Application Data\Yahoo!
2008-06-06 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-06-06 20:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-06 20:47 --------- d-----w C:\Program Files\Realtek
2008-06-06 20:46 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-06 20:46 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-06 20:46 --------- d-----w C:\Documents and Settings\jana\Application Data\InstallShield
2008-06-06 20:45 4,716 ----a-w C:\WINDOWS\gdrv.sys
2008-06-06 20:42 --------- d-----w C:\Program Files\Intel
2008-06-06 20:07 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-06 20:06 558,142 ----a-w C:\WINDOWS\java\Packages\PRTNZB3B.ZIP
2008-06-06 20:06 155,995 ----a-w C:\WINDOWS\java\Packages\IVR9F7XZ.ZIP
2008-05-29 06:35 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-05-18 18:40 82,944 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-05-18 18:40 82,944 ----a-w C:\WINDOWS\system32\404Fix.exe
2004-08-08 21:03 1,040 --sh--w C:\WINDOWS\system32\aoqnabib.sys
2004-08-08 17:46 5,200 --sh--w C:\WINDOWS\system32\bcsxachu.sys
2004-08-08 21:01 520 --sh--w C:\WINDOWS\system32\cgsqatyu.sys
2004-08-08 21:02 5,200 --sh--w C:\WINDOWS\system32\erjxakin.sys
2002-08-29 12:00 8,704 --sha-w C:\WINDOWS\system32\hmsdvf.dll
2004-08-08 21:02 1,040 --sh--w C:\WINDOWS\system32\iujraler.sys
2004-08-08 21:03 1,040 --sh--w C:\WINDOWS\system32\rnmxajkl.sys
2004-08-08 21:05 520 --sh--w C:\WINDOWS\system32\smdsbsrv.sys
2004-08-08 21:02 520 --sh--w C:\WINDOWS\system32\snfybbyt.sys
2002-08-29 12:00 9,216 --sha-w C:\WINDOWS\system32\tuker.dll
2004-08-08 21:03 5,720 --sh--w C:\WINDOWS\system32\xsdjbbmp.sys
.
((((((((((((((((((((((((((((( [EMAIL="snapshot@Fri"]snapshot@Fri[/EMAIL] 06-13-2008_19.39.33.76 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-02-25 03:35:05 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB898461\spmsg.dll
+ 2005-02-25 03:35:05 209,632 ----a-w C:\WINDOWS\$hf_mig$\KB898461\spuninst.exe
+ 2005-02-25 03:35:05 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB898461\spupdsvc.exe
+ 2005-02-25 03:35:05 22,240 ----a-w C:\WINDOWS\$hf_mig$\KB898461\update\spcustom.dll
+ 2005-02-25 03:35:05 718,048 ----a-w C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
+ 2005-02-25 03:35:06 371,936 ----a-w C:\WINDOWS\$hf_mig$\KB898461\update\updspapi.dll
+ 2005-03-21 12:00:20 2,890,240 -c----w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msi.dll
+ 2005-05-04 11:45:26 209,632 -c----w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
+ 2005-05-04 11:45:28 371,936 -c----w C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
+ 2002-08-29 12:00:00 221,696 -c----w C:\WINDOWS\$NtUninstallKB842773$\qmgr.dll
+ 2002-08-29 12:00:00 17,408 -c----w C:\WINDOWS\$NtUninstallKB842773$\qmgrprxy.dll
+ 2004-05-17 22:38:24 158,208 -c----w C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe
+ 2002-08-29 12:00:00 310,272 -c----w C:\WINDOWS\$NtUninstallKB842773$\winhttp.dll
+ 2005-02-25 03:35:05 209,632 -c----w C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe
+ 2005-02-25 03:35:06 371,936 -c----w C:\WINDOWS\$NtUninstallKB898461$\spuninst\updspapi.dll
- 2008-06-13 16:37:48 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-18 12:57:11 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-06-13 15:24:06 45,056 ----a-w C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
+ 2008-06-17 21:07:32 45,056 ----a-w C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\16-06-2008\ERDNT.EXE
+ 2008-06-16 20:03:04 1,929,216 ----a-w C:\WINDOWS\erdnt\16-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-16 20:03:04 32,768 ----a-w C:\WINDOWS\erdnt\16-06-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\17-06-2008\ERDNT.EXE
+ 2008-06-17 20:59:46 1,929,216 ----a-w C:\WINDOWS\erdnt\AutoBackup\17-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-17 20:59:46 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\17-06-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 09:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\18-06-2008\ERDNT.EXE
+ 2008-06-18 08:08:15 1,949,696 ----a-w C:\WINDOWS\erdnt\AutoBackup\18-06-2008\Users\00000001\NTUSER.DAT
+ 2008-06-18 08:08:16 32,768 ----a-w C:\WINDOWS\erdnt\AutoBackup\18-06-2008\Users\00000002\UsrClass.dat
+ 2005-10-20 17:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2004-07-01 22:08:18 361,984 ------w C:\WINDOWS\system32\bits\qmgr.dll
+ 2004-07-01 22:08:18 7,680 ------w C:\WINDOWS\system32\bitsprx2.dll
+ 2004-07-01 22:08:18 7,168 ------w C:\WINDOWS\system32\bitsprx3.dll
- 2008-06-13 16:05:38 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-18 12:39:41 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-13 16:05:38 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-18 12:39:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-13 16:05:38 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-18 12:39:41 65,536 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2004-07-01 22:08:18 7,680 -c----w C:\WINDOWS\system32\dllcache\bitsprx2.dll
+ 2004-07-01 22:08:18 7,168 -c----w C:\WINDOWS\system32\dllcache\bitsprx3.dll
- 2005-03-21 12:00:20 2,890,240 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll
+ 2005-05-04 11:45:32 2,890,240 -c--a-w C:\WINDOWS\system32\dllcache\msi.dll
- 2002-08-29 12:00:00 221,696 -c--a-w C:\WINDOWS\system32\dllcache\qmgr.dll
+ 2004-07-01 22:08:18 361,984 -c--a-w C:\WINDOWS\system32\dllcache\qmgr.dll
- 2002-08-29 12:00:00 17,408 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
+ 2004-07-01 22:08:18 17,408 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
- 2002-08-29 12:00:00 310,272 -c--a-w C:\WINDOWS\system32\dllcache\winhttp.dll
+ 2004-07-01 22:08:18 331,776 -c--a-w C:\WINDOWS\system32\dllcache\winhttp.dll
+ 2004-07-31 15:50:36 51,200 ----a-w C:\WINDOWS\system32\dumphive.exe
- 2005-03-21 12:00:20 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll
+ 2005-05-04 11:45:32 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll
+ 2003-06-05 18:13:00 53,248 ----a-w C:\WINDOWS\system32\Process.exe
- 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\qmgr.dll
+ 2004-07-01 22:08:18 361,984 ----a-w C:\WINDOWS\system32\qmgr.dll
- 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
+ 2004-07-01 22:08:18 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
- 2005-03-21 12:00:08 13,536 ------w C:\WINDOWS\system32\spmsg.dll
+ 2005-05-04 11:45:26 13,536 ------w C:\WINDOWS\system32\spmsg.dll
- 2004-11-18 07:42:52 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2005-02-25 03:35:05 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2006-04-27 14:49:30 288,417 ----a-w C:\WINDOWS\system32\SrchSTS.exe
+ 2007-09-05 21:22:23 289,144 ----a-w C:\WINDOWS\system32\VCCLSID.exe
- 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\winhttp.dll
+ 2004-07-01 22:08:18 331,776 ----a-w C:\WINDOWS\system32\winhttp.dll
+ 2007-10-03 21:36:46 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
+ 2004-06-30 23:59:25 158,720 ------w C:\WINDOWS\system32\xpob2res.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4C69034A-F45F-D34D-A33A-C33C4D324FC4}]
C:\WINDOWS\System32\arjrbler.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6629FF4F-ACDB-5C90-A098-FACB3456A266}]
C:\WINDOWS\System32\mpmyfapi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97421D0D-E07F-40DF-8F07-99597B9585AD}]
06/18/2008 12:07 AM 45056 --a------ C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM 4670704]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [08/29/2002 03:00 PM 13312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [06/09/2008 12:02 PM 185896]
C:\Documents and Settings\ali\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{A9895933-6636-4281-BC58-EE6DE2AF96E3}"= C:\WINDOWS\System32\ddserh.dll [ ]
"{4C69034A-F45F-D34D-A33A-C33C4D324FC4}"= C:\WINDOWS\System32\arjrbler.dll [ ]
"{6629FF4F-ACDB-5C90-A098-FACB3456A266}"= C:\WINDOWS\System32\mpmyfapi.dll [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"JavaView"= {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll [ ]
"ThunderAdvise"= {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll [06/18/2008 12:07 AM 45056]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]
S2 cdralw;NVIDIA Compatible Windows Miniport Driver;C:\WINDOWS\System32\DRIVERS\nvmini.sys []
S3 eth8023;eth8023;C:\WINDOWS\System32\drivers\eth8023.sys [06/18/2008 03:20 PM]
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7
Rootkit scan 2008-06-18 15:57:24
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 06/18/2008 15:59:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-18 12:59:20
ComboFix2.txt 2008-06-13 16:39:50
Pre-Run: 10,674,933,760 bytes free
Post-Run: 10,675,908,608 bytes free
256 --- E O F --- 2008-06-16 16:58:27

اوكي وين تقرير هالخطوة ؟؟؟

الخطوة الثالثة:

- حملي هالملف VundoFix.exe واحفظيه في الديسك توب
- دبل كليك ع الملف VundoFix.exe ثم اضغطي على Scan for Vundo
- وعند اكمال عملية الفحص اضغطي على Fix Vundo ،، راح تظهر لك رسالة تخبرك هل تريدين حذف الملفات اضغطي على YES
- عند الضغط على YES خلفية الديسك توب ستحذف منها الصورة وسيبدا البرنامج بالتنظيف
- عند اﻻنتهاء ستظهر رسالة تطلب اعادة تشغيل الجهاز اضغطي على OK وسيعاد تشغيل الجهاز
- وعند اعادة تشغيل الجهاز اذهبي الى هالمسار
my computer---------- Local Disk C--------vundofix.txt

واعملي نسخ لكل المعلومات المحفوظة فيه والصقيها في ردك القادم

الخطوه هذه ما فيها تقرير لنه قال لا يوجد ملفات

ودخلت الc
لقيت الفيل فارغ ما فيه اي ملفات