ممكن المساعده ارجوكم

التقرير الاخير


- 2006-08-16 09:27:50 83,456 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe
+ 2002-08-29 12:00:00 82,944 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe
- 2005-08-11 15:21:02 57,856 -c--a-w C:\WINDOWS\system32\dllcache\nwwks.dll
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\dllcache\nwwks.dll
- 2006-05-14 09:13:41 257,536 -c--a-w C:\WINDOWS\system32\dllcache\oakley.dll
+ 2002-08-29 12:00:00 328,704 -c--a-w C:\WINDOWS\system32\dllcache\oakley.dll
- 2006-02-27 10:31:58 93,184 -c--a-w C:\WINDOWS\system32\dllcache\OEIMPORT.DLL
+ 2002-08-29 12:00:00 92,672 ----a-w C:\WINDOWS\system32\dllcache\oeimport.dll
- 2006-02-27 10:32:08 55,808 -c--a-w C:\WINDOWS\system32\dllcache\OEMIG50.EXE
+ 2002-08-29 12:00:00 55,808 ----a-w C:\WINDOWS\system32\dllcache\oemig50.exe
- 2006-02-27 10:32:10 31,744 -c--a-w C:\WINDOWS\system32\dllcache\OEMIGLIB.DLL
+ 2002-08-29 12:00:00 32,256 ----a-w C:\WINDOWS\system32\dllcache\oemiglib.dll
- 2005-07-26 04:31:13 1,190,400 -c--a-w C:\WINDOWS\system32\dllcache\ole32.dll
+ 2002-08-29 12:00:00 1,169,920 -c--a-w C:\WINDOWS\system32\dllcache\ole32.dll
- 2005-07-26 04:31:13 68,608 -c--a-w C:\WINDOWS\system32\dllcache\olecli32.dll
+ 2002-08-29 12:00:00 68,608 ----a-w C:\WINDOWS\system32\dllcache\olecli32.dll
- 2005-07-26 04:31:13 35,328 -c--a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\dllcache\olecnv32.dll
- 2002-08-29 12:00:00 27,648 -c--a-w C:\WINDOWS\system32\dllcache\pidgen.dll
+ 2003-03-31 01:00:00 28,160 -c--a-w C:\WINDOWS\system32\dllcache\pidgen.dll
- 2005-04-27 07:53:06 34,816 -c--a-w C:\WINDOWS\system32\dllcache\PNGFILT.DLL
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2006-05-14 09:13:41 98,304 -c--a-w C:\WINDOWS\system32\dllcache\polstore.dll
+ 2002-08-29 12:00:00 87,552 -c--a-w C:\WINDOWS\system32\dllcache\polstore.dll
- 2004-07-01 22:08:18 361,984 -c--a-w C:\WINDOWS\system32\dllcache\qmgr.dll
+ 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\dllcache\qmgr.dll
- 2004-07-01 22:08:18 17,408 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
+ 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
- 2005-08-30 04:02:45 1,158,656 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2002-08-29 12:00:00 1,142,784 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-06-26 17:47:50 6,144 -c--a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
+ 2002-08-29 12:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\rasadhlp.dll
- 2006-06-22 10:59:17 169,984 -c--a-w C:\WINDOWS\system32\dllcache\rasmans.dll
+ 2002-08-29 12:00:00 158,720 -c--a-w C:\WINDOWS\system32\dllcache\rasmans.dll
- 2006-05-05 09:40:31 166,656 -c--a-w C:\WINDOWS\system32\dllcache\rdbss.sys
+ 2002-08-29 12:00:00 163,328 -c--a-w C:\WINDOWS\system32\dllcache\rdbss.sys
- 2006-07-13 08:41:42 199,936 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2002-08-29 12:00:00 200,064 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2004-03-06 02:16:11 535,552 -c--a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
+ 2002-08-29 12:00:00 530,432 -c--a-w C:\WINDOWS\system32\dllcache\rpcrt4.dll
- 2005-07-26 04:31:13 276,992 -c--a-w C:\WINDOWS\system32\dllcache\rpcss.dll
+ 2002-08-29 12:00:00 260,608 -c--a-w C:\WINDOWS\system32\dllcache\rpcss.dll
- 2006-09-04 06:23:53 1,351,680 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2006-05-26 12:40:58 1,339,904 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2006-07-13 13:46:56 8,353,280 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2002-08-29 12:00:00 8,336,384 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2005-08-31 15:49:30 409,088 -c--a-w C:\WINDOWS\system32\dllcache\SHLWAPI.DLL
+ 2002-08-29 12:00:00 401,920 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2005-06-10 23:55:46 53,248 -c--a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
- 2005-10-27 19:06:37 226,816 -c--a-w C:\WINDOWS\system32\dllcache\srrstr.dll
+ 2002-08-29 12:00:00 226,304 ----a-w C:\WINDOWS\system32\dllcache\srrstr.dll
- 2004-12-07 19:34:37 79,872 -c--a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
+ 2002-08-29 12:00:00 87,040 ----a-w C:\WINDOWS\system32\dllcache\srvsvc.dll
- 2004-08-20 22:01:15 700,928 -c--a-w C:\WINDOWS\system32\dllcache\sxs.dll
+ 2002-08-29 12:00:00 674,816 -c--a-w C:\WINDOWS\system32\dllcache\sxs.dll
- 2005-10-17 21:29:54 111,616 -c--a-w C:\WINDOWS\system32\dllcache\t2embed.dll
+ 2002-08-29 12:00:00 198,656 ----a-w C:\WINDOWS\system32\dllcache\t2embed.dll
- 2006-04-20 11:38:44 340,480 -c--a-w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2002-08-29 12:00:00 332,928 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
- 2006-08-16 09:28:57 205,120 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
+ 2002-08-29 12:00:00 196,288 -c--a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
- 2005-05-11 00:09:48 72,192 -c--a-w C:\WINDOWS\system32\dllcache\telnet.exe
+ 2002-08-29 12:00:00 71,168 ----a-w C:\WINDOWS\system32\dllcache\telnet.exe
- 2005-07-26 04:31:13 97,280 -c--a-w C:\WINDOWS\system32\dllcache\txflog.dll
+ 2002-08-29 12:00:00 90,624 ----a-w C:\WINDOWS\system32\dllcache\txflog.dll
- 2005-08-23 03:51:10 111,104 -c--a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
+ 2002-08-29 12:00:00 107,008 ----a-w C:\WINDOWS\system32\dllcache\umpnpmgr.dll
- 2006-08-30 17:42:56 461,824 -c--a-w C:\WINDOWS\system32\dllcache\URLMON.DLL
+ 2002-08-29 12:00:00 455,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2005-03-02 18:20:03 561,152 -c--a-w C:\WINDOWS\system32\dllcache\user32.dll
+ 2002-08-29 12:00:00 560,128 ----a-w C:\WINDOWS\system32\dllcache\user32.dll
- 2006-09-18 11:20:10 851,456 -c--a-w C:\WINDOWS\system32\dllcache\VGX.DLL
+ 2002-08-29 12:00:00 802,304 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2006-02-27 10:31:46 42,496 -c--a-w C:\WINDOWS\system32\dllcache\WAB.EXE
+ 2002-08-29 12:00:00 43,008 ----a-w C:\WINDOWS\system32\dllcache\wab.exe
- 2006-03-16 13:08:34 465,408 -c--a-w C:\WINDOWS\system32\dllcache\WAB32.DLL
+ 2002-08-29 12:00:00 459,776 ----a-w C:\WINDOWS\system32\dllcache\wab32.dll
- 2006-02-27 10:31:48 30,208 -c--a-w C:\WINDOWS\system32\dllcache\WABFIND.DLL
+ 2002-08-29 12:00:00 30,720 ----a-w C:\WINDOWS\system32\dllcache\wabfind.dll
- 2006-02-27 10:31:44 77,824 -c--a-w C:\WINDOWS\system32\dllcache\WABIMP.DLL
+ 2002-08-29 12:00:00 76,800 ----a-w C:\WINDOWS\system32\dllcache\wabimp.dll
- 2006-02-27 10:31:42 27,648 -c--a-w C:\WINDOWS\system32\dllcache\WABMIG.EXE
+ 2002-08-29 12:00:00 27,648 ----a-w C:\WINDOWS\system32\dllcache\wabmig.exe
- 2005-10-04 01:38:18 1,799,552 -c--a-w C:\WINDOWS\system32\dllcache\win32k.sys
+ 2002-08-29 12:00:00 1,813,632 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
- 2005-06-11 02:41:12 102,400 -c--a-w C:\WINDOWS\system32\dllcache\win32spl.dll
+ 2002-08-29 12:00:00 99,328 ----a-w C:\WINDOWS\system32\dllcache\win32spl.dll
- 2004-07-01 22:08:18 331,776 -c--a-w C:\WINDOWS\system32\dllcache\winhttp.dll
+ 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\dllcache\winhttp.dll
- 2006-06-23 08:33:58 575,488 -c--a-w C:\WINDOWS\system32\dllcache\WININET.DLL
+ 2002-08-29 12:00:00 599,040 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2006-05-14 09:13:41 29,184 -c--a-w C:\WINDOWS\system32\dllcache\winipsec.dll
+ 2002-08-29 12:00:00 25,600 -c--a-w C:\WINDOWS\system32\dllcache\winipsec.dll
- 2005-09-01 01:49:31 278,016 -c--a-w C:\WINDOWS\system32\dllcache\winsrv.dll
+ 2002-08-29 12:00:00 276,480 ----a-w C:\WINDOWS\system32\dllcache\winsrv.dll
- 2006-08-16 12:14:23 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ws2_32.dll
+ 2002-08-29 12:00:00 75,264 -c--a-w C:\WINDOWS\system32\dllcache\ws2_32.dll
- 2006-08-16 12:14:23 13,312 -c--a-w C:\WINDOWS\system32\dllcache\wship6.dll
+ 2002-08-29 12:00:00 13,312 -c--a-w C:\WINDOWS\system32\dllcache\wship6.dll
- 2006-03-01 19:44:39 11,776 -c--a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
+ 2002-08-29 12:00:00 9,728 ----a-w C:\WINDOWS\system32\dllcache\xolehlp.dll
- 2006-06-26 17:47:50 140,288 ----a-w C:\WINDOWS\system32\dnsapi.dll
+ 2002-08-29 12:00:00 139,264 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2002-08-29 12:00:00 115,200 ----a-w C:\WINDOWS\system32\dpcdll.dll
+ 2002-08-29 00:40:50 115,200 ----a-w C:\WINDOWS\system32\dpcdll.dll
- 2006-05-13 10:13:31 74,368 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
+ 2002-08-29 12:00:00 57,984 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
- 2005-03-23 00:55:20 67,456 ----a-w C:\WINDOWS\system32\drivers\mqac.sys
+ 2002-08-29 12:00:00 67,200 ----a-w C:\WINDOWS\system32\drivers\mqac.sys
- 2006-05-05 09:31:04 433,152 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
+ 2002-08-29 12:00:00 407,552 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
- 2006-05-05 09:40:31 166,656 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
+ 2002-08-29 12:00:00 163,328 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
- 2006-07-13 08:41:42 199,936 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
+ 2002-08-29 12:00:00 200,064 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
- 2006-04-20 11:38:44 340,480 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2002-08-29 12:00:00 332,928 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2006-08-16 09:28:57 205,120 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
+ 2002-08-29 12:00:00 196,288 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
- 2006-08-16 09:27:12 11,776 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
+ 2002-08-29 12:00:00 9,856 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
- 2006-06-09 11:35:50 351,744 ----a-w C:\WINDOWS\system32\DXTMSFT.DLL
+ 2002-08-29 12:00:00 337,920 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2006-06-09 11:35:30 192,512 ----a-w C:\WINDOWS\system32\DXTRANS.DLL
+ 2002-08-29 12:00:00 194,560 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2005-07-26 04:31:12 227,328 ----a-w C:\WINDOWS\system32\es.dll
+ 2002-08-29 12:00:00 225,280 ----a-w C:\WINDOWS\system32\es.dll
- 2005-10-20 22:33:08 991,232 ----a-w C:\WINDOWS\system32\esent.dll
+ 2002-08-29 12:00:00 1,018,368 ----a-w C:\WINDOWS\system32\esent.dll
- 2004-08-20 22:01:15 82,432 ----a-w C:\WINDOWS\system32\fldrclnr.dll
+ 2002-08-29 12:00:00 82,432 ----a-w C:\WINDOWS\system32\fldrclnr.dll
- 2008-06-21 12:14:32 149,992 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-06-24 10:03:18 149,992 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2005-10-17 21:29:53 77,824 ----a-w C:\WINDOWS\system32\fontsub.dll
+ 2002-08-29 12:00:00 79,360 ----a-w C:\WINDOWS\system32\fontsub.dll
- 2006-01-02 22:38:03 260,608 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2002-08-29 12:00:00 250,368 ----a-w C:\WINDOWS\system32\gdi32.dll
- 2004-08-25 22:07:34 183,808 ----a-w C:\WINDOWS\system32\gptext.dll
+ 2002-08-29 12:00:00 183,296 ----a-w C:\WINDOWS\system32\gptext.dll
+ 2008-06-25 10:03:57 24,576 ----a-w C:\WINDOWS\system32\hellodon.dll
- 2005-05-27 01:59:52 38,912 ----a-w C:\WINDOWS\system32\hhsetup.dll
+ 2002-08-29 12:00:00 37,888 ----a-w C:\WINDOWS\system32\hhsetup.dll
- 2006-07-21 08:30:50 72,704 ----a-w C:\WINDOWS\system32\hlink.dll
+ 2002-08-29 12:00:00 77,850 ----a-w C:\WINDOWS\system32\hlink.dll
- 2004-11-17 17:57:01 493,056 ----a-w C:\WINDOWS\system32\hypertrm.dll
+ 2002-08-29 12:00:00 489,984 ----a-w C:\WINDOWS\system32\hypertrm.dll
- 2005-06-29 01:54:58 237,056 ----a-w C:\WINDOWS\system32\icm32.dll
+ 2002-08-29 12:00:00 236,032 ----a-w C:\WINDOWS\system32\icm32.dll
- 2006-02-24 12:24:42 236,032 ----a-w C:\WINDOWS\system32\IEPEERS.DLL
+ 2002-08-29 12:00:00 231,424 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2006-02-27 10:31:54 596,480 ----a-w C:\WINDOWS\system32\INETCOMM.DLL
+ 2002-08-29 12:00:00 587,776 ----a-w C:\WINDOWS\system32\inetcomm.dll
- 2006-08-16 12:14:23 31,232 ----a-w C:\WINDOWS\system32\inetmib1.dll
+ 2002-08-29 12:00:00 31,232 ----a-w C:\WINDOWS\system32\inetmib1.dll
- 2006-02-27 10:31:50 47,616 ----a-w C:\WINDOWS\system32\INETRES.DLL
+ 2002-08-29 12:00:00 47,616 ----a-w C:\WINDOWS\system32\inetres.dll
- 2004-08-26 07:53:48 69,632 ----a-w C:\WINDOWS\system32\INSENG.DLL
+ 2002-08-29 12:00:00 69,632 ----a-w C:\WINDOWS\system32\inseng.dll
- 2006-08-16 12:14:23 83,456 ----a-w C:\WINDOWS\system32\iphlpapi.dll
+ 2002-08-29 12:00:00 82,944 ----a-w C:\WINDOWS\system32\iphlpapi.dll
- 2006-05-14 09:13:41 334,848 ----a-w C:\WINDOWS\system32\ipsecsnp.dll
+ 2002-08-29 12:00:00 332,800 ----a-w C:\WINDOWS\system32\ipsecsnp.dll
- 2006-05-14 09:13:41 159,744 ----a-w C:\WINDOWS\system32\ipsecsvc.dll
+ 2002-08-29 12:00:00 155,648 ----a-w C:\WINDOWS\system32\ipsecsvc.dll
- 2006-05-14 09:13:41 364,544 ----a-w C:\WINDOWS\system32\ipsmsnap.dll
+ 2002-08-29 12:00:00 364,032 ----a-w C:\WINDOWS\system32\ipsmsnap.dll
- 2006-08-16 09:28:55 48,640 ----a-w C:\WINDOWS\system32\ipv6.exe
+ 2002-08-29 12:00:00 60,928 ----a-w C:\WINDOWS\system32\ipv6.exe
- 2006-08-16 12:14:23 54,272 ----a-w C:\WINDOWS\system32\ipv6mon.dll
+ 2002-08-29 12:00:00 134,144 ----a-w C:\WINDOWS\system32\ipv6mon.dll
- 2005-05-27 01:59:52 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
+ 2002-08-29 12:00:00 143,872 ----a-w C:\WINDOWS\system32\itircl.dll
- 2005-05-27 01:59:52 128,000 ----a-w C:\WINDOWS\system32\itss.dll
+ 2002-08-29 12:00:00 122,368 ----a-w C:\WINDOWS\system32\itss.dll
- 2006-05-26 19:19:50 163,840 ----a-w C:\WINDOWS\system32\JGDW400.DLL
+ 2002-08-29 12:00:00 144,896 ----a-w C:\WINDOWS\system32\jgdw400.dll
- 2006-04-06 13:15:48 27,648 ----a-w C:\WINDOWS\system32\JGPL400.DLL
+ 2002-08-29 12:00:00 42,496 ----a-w C:\WINDOWS\system32\jgpl400.dll
- 2006-05-18 05:58:56 458,752 ----a-w C:\WINDOWS\system32\jscript.dll
+ 2002-08-29 12:00:00 593,948 ----a-w C:\WINDOWS\system32\jscript.dll
- 2006-04-28 07:58:48 12,288 ----a-w C:\WINDOWS\system32\JSPROXY.DLL
+ 2002-08-29 12:00:00 12,288 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2006-07-05 10:46:36 928,768 ----a-w C:\WINDOWS\system32\kernel32.dll
+ 2002-08-29 12:00:00 930,304 ----a-w C:\WINDOWS\system32\kernel32.dll
- 2005-09-01 01:49:29 16,384 ----a-w C:\WINDOWS\system32\linkinfo.dll
+ 2002-08-29 12:00:00 15,360 ----a-w C:\WINDOWS\system32\linkinfo.dll
- 2004-03-30 01:48:36 36,864 ----a-w C:\WINDOWS\system32\mf3216.dll
+ 2002-08-29 12:00:00 35,328 ----a-w C:\WINDOWS\system32\mf3216.dll
- 2005-03-23 18:12:48 130,048 ----a-w C:\WINDOWS\system32\mqad.dll
+ 2002-08-29 12:00:00 130,048 ----a-w C:\WINDOWS\system32\mqad.dll
- 2005-03-23 18:12:48 44,032 ----a-w C:\WINDOWS\system32\mqdscli.dll
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\mqdscli.dll
- 2005-03-23 18:12:48 14,848 ----a-w C:\WINDOWS\system32\mqise.dll
+ 2002-08-29 12:00:00 14,848 ----a-w C:\WINDOWS\system32\mqise.dll
- 2005-03-23 18:12:48 608,768 ----a-w C:\WINDOWS\system32\mqqm.dll
+ 2002-08-29 12:00:00 613,888 ----a-w C:\WINDOWS\system32\mqqm.dll
- 2005-03-23 18:12:48 165,888 ----a-w C:\WINDOWS\system32\mqrt.dll
+ 2002-08-29 12:00:00 164,864 ----a-w C:\WINDOWS\system32\mqrt.dll
- 2005-03-23 18:12:48 88,576 ----a-w C:\WINDOWS\system32\mqsec.dll
+ 2002-08-29 12:00:00 89,088 ----a-w C:\WINDOWS\system32\mqsec.dll
- 2005-03-23 18:12:48 44,544 ----a-w C:\WINDOWS\system32\mqupgrd.dll
+ 2002-08-29 12:00:00 44,544 ----a-w C:\WINDOWS\system32\mqupgrd.dll
- 2005-03-23 18:12:48 467,456 ----a-w C:\WINDOWS\system32\mqutil.dll
+ 2002-08-29 12:00:00 469,504 ----a-w C:\WINDOWS\system32\mqutil.dll
+ 2008-06-25 14:35:28 24,576 ----a-w C:\WINDOWS\system32\mrsingd.dll
+ 2008-06-25 14:35:28 10,752 ----a-w C:\WINDOWS\system32\mrsingdk.exe
- 2005-06-29 01:54:58 68,608 ----a-w C:\WINDOWS\system32\mscms.dll
+ 2002-08-29 12:00:00 68,096 ----a-w C:\WINDOWS\system32\mscms.dll
- 2006-03-01 19:44:39 368,640 ----a-w C:\WINDOWS\system32\msdtcprx.dll
+ 2002-08-29 12:00:00 359,936 ----a-w C:\WINDOWS\system32\msdtcprx.dll
- 2006-03-01 19:44:39 974,336 ----a-w C:\WINDOWS\system32\msdtctm.dll
+ 2002-08-29 12:00:00 869,376 ----a-w C:\WINDOWS\system32\msdtctm.dll
- 2006-03-01 19:44:39 150,528 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
+ 2002-08-29 12:00:00 151,040 ----a-w C:\WINDOWS\system32\msdtcuiu.dll
- 2006-06-30 07:28:26 2,703,872 ----a-w C:\WINDOWS\system32\MSHTML.DLL
+ 2002-08-29 12:00:00 2,833,920 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2005-05-04 11:45:32 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll
+ 2002-08-29 12:00:00 2,086,400 ----a-w C:\WINDOWS\system32\msi.dll
- 2006-02-27 10:29:32 44,032 ----a-w C:\WINDOWS\system32\MSIDENT.DLL
+ 2002-08-29 12:00:00 44,032 ----a-w C:\WINDOWS\system32\msident.dll
- 2005-08-05 17:23:27 230,400 ----a-w C:\WINDOWS\system32\msieftp.dll
+ 2002-08-29 12:00:00 229,888 ----a-w C:\WINDOWS\system32\msieftp.dll
- 2005-03-21 12:00:22 78,848 ----a-w C:\WINDOWS\system32\msiexec.exe
+ 2002-08-29 12:00:00 64,512 ----a-w C:\WINDOWS\system32\msiexec.exe
- 2005-03-21 12:00:22 271,360 ----a-w C:\WINDOWS\system32\msihnd.dll
+ 2002-08-29 12:00:00 305,664 ----a-w C:\WINDOWS\system32\msihnd.dll
- 2005-03-21 12:00:22 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
+ 2002-08-29 12:00:00 847,872 ----a-w C:\WINDOWS\system32\msimsg.dll
- 2005-03-21 12:00:22 15,360 ----a-w C:\WINDOWS\system32\msisip.dll
+ 2002-08-29 12:00:00 39,936 ----a-w C:\WINDOWS\system32\msisip.dll
- 2006-02-27 10:31:40 229,376 ----a-w C:\WINDOWS\system32\MSOEACCT.DLL
+ 2002-08-29 12:00:00 228,864 ----a-w C:\WINDOWS\system32\msoeacct.dll
- 2006-02-27 10:31:36 91,136 ----a-w C:\WINDOWS\system32\MSOERT2.DLL
+ 2002-08-29 12:00:00 81,408 ----a-w C:\WINDOWS\system32\msoert2.dll
- 2005-02-24 09:54:42 132,096 ----a-w C:\WINDOWS\system32\MSRATING.DLL
+ 2002-08-29 12:00:00 132,096 ----a-w C:\WINDOWS\system32\msrating.dll
- 2006-03-03 13:13:30 498,176 ----a-w C:\WINDOWS\system32\MSTIME.DLL
+ 2002-08-29 12:00:00 496,128 ----a-w C:\WINDOWS\system32\mstime.dll
- 2006-03-01 19:44:39 64,512 ----a-w C:\WINDOWS\system32\mtxclu.dll
+ 2002-08-29 12:00:00 61,440 ----a-w C:\WINDOWS\system32\mtxclu.dll
- 2006-03-01 19:44:39 83,456 ----a-w C:\WINDOWS\system32\mtxoci.dll
+ 2002-08-29 12:00:00 83,968 ----a-w C:\WINDOWS\system32\mtxoci.dll
- 2005-08-22 18:36:34 154,624 ----a-w C:\WINDOWS\system32\netman.dll
+ 2002-08-29 12:00:00 154,112 ----a-w C:\WINDOWS\system32\netman.dll
- 2006-08-16 09:27:50 83,456 ----a-w C:\WINDOWS\system32\netsh.exe
+ 2002-08-29 12:00:00 82,944 ----a-w C:\WINDOWS\system32\netsh.exe
- 2005-03-02 00:36:42 1,955,840 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
+ 2002-08-29 12:00:00 1,947,904 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
- 2005-03-02 01:33:36 2,040,832 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
+ 2002-08-29 12:00:00 2,042,240 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
- 2005-08-11 15:21:02 57,856 ----a-w C:\WINDOWS\system32\nwwks.dll
+ 2002-08-29 12:00:00 57,344 ----a-w C:\WINDOWS\system32\nwwks.dll
- 2006-05-14 09:13:41 257,536 ----a-w C:\WINDOWS\system32\oakley.dll
+ 2002-08-29 12:00:00 328,704 ----a-w C:\WINDOWS\system32\oakley.dll
- 2005-07-26 04:31:13 1,190,400 ----a-w C:\WINDOWS\system32\ole32.dll
+ 2002-08-29 12:00:00 1,169,920 ----a-w C:\WINDOWS\system32\ole32.dll
- 2005-07-26 04:31:13 68,608 ----a-w C:\WINDOWS\system32\olecli32.dll
+ 2002-08-29 12:00:00 68,608 ----a-w C:\WINDOWS\system32\olecli32.dll
- 2005-07-26 04:31:13 35,328 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\olecnv32.dll
+ 2008-06-25 10:00:38 229,376 ---ha-w C:\WINDOWS\system32\pedadt.dll
- 2002-08-29 12:00:00 27,648 ----a-w C:\WINDOWS\system32\pidgen.dll
+ 2003-03-31 01:00:00 28,160 ----a-w C:\WINDOWS\system32\pidgen.dll
- 2005-04-27 07:53:06 34,816 ----a-w C:\WINDOWS\system32\PNGFILT.DLL
+ 2002-08-29 12:00:00 34,304 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2006-05-14 09:13:41 98,304 ----a-w C:\WINDOWS\system32\polstore.dll
+ 2002-08-29 12:00:00 87,552 ----a-w C:\WINDOWS\system32\polstore.dll
+ 2008-06-25 10:04:08 28,672 ----a-w C:\WINDOWS\system32\qflxs.dll
- 2004-07-01 22:08:18 361,984 ----a-w C:\WINDOWS\system32\qmgr.dll
+ 2002-08-29 12:00:00 221,696 ----a-w C:\WINDOWS\system32\qmgr.dll
- 2004-07-01 22:08:18 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
+ 2002-08-29 12:00:00 17,408 ----a-w C:\WINDOWS\system32\qmgrprxy.dll
- 2005-08-30 04:02:45 1,158,656 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2002-08-29 12:00:00 1,142,784 ----a-w C:\WINDOWS\system32\quartz.dll
- 2006-06-26 17:47:50 6,144 ----a-w C:\WINDOWS\system32\rasadhlp.dll
+ 2002-08-29 12:00:00 6,144 ----a-w C:\WINDOWS\system32\rasadhlp.dll
- 2006-06-22 10:59:17 169,984 ----a-w C:\WINDOWS\system32\rasmans.dll
+ 2002-08-29 12:00:00 158,720 ----a-w C:\WINDOWS\system32\rasmans.dll
- 2004-03-06 02:16:11 535,552 ----a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2002-08-29 12:00:00 530,432 ----a-w C:\WINDOWS\system32\rpcrt4.dll
- 2005-07-26 04:31:13 276,992 ----a-w C:\WINDOWS\system32\rpcss.dll
+ 2002-08-29 12:00:00 260,608 ----a-w C:\WINDOWS\system32\rpcss.dll
- 2006-09-04 06:23:53 1,351,680 ----a-w C:\WINDOWS\system32\SHDOCVW.DLL
+ 2006-05-26 12:40:58 1,339,904 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2006-07-13 13:46:56 8,353,280 ----a-w C:\WINDOWS\system32\shell32.dll
+ 2002-08-29 12:00:00 8,336,384 ----a-w C:\WINDOWS\system32\shell32.dll
- 2005-09-01 01:49:30 409,088 ----a-w C:\WINDOWS\system32\SHLWAPI.DLL
+ 2002-08-29 12:00:00 401,920 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2005-06-10 23:55:46 53,248 ----a-w C:\WINDOWS\system32\spoolsv.exe
+ 2002-08-29 12:00:00 51,200 ----a-w C:\WINDOWS\system32\spoolsv.exe
- 2005-10-27 19:06:37 226,816 ----a-w C:\WINDOWS\system32\srrstr.dll
+ 2002-08-29 12:00:00 226,304 ----a-w C:\WINDOWS\system32\srrstr.dll
- 2004-12-07 19:34:37 79,872 ----a-w C:\WINDOWS\system32\srvsvc.dll
+ 2002-08-29 12:00:00 87,040 ----a-w C:\WINDOWS\system32\srvsvc.dll
- 2004-08-20 22:01:15 700,928 ----a-w C:\WINDOWS\system32\sxs.dll
+ 2002-08-29 12:00:00 674,816 ----a-w C:\WINDOWS\system32\sxs.dll
- 2005-10-17 21:29:54 111,616 ----a-w C:\WINDOWS\system32\t2embed.dll
+ 2002-08-29 12:00:00 198,656 ----a-w C:\WINDOWS\system32\t2embed.dll
- 2005-05-11 00:09:48 72,192 ----a-w C:\WINDOWS\system32\telnet.exe
+ 2002-08-29 12:00:00 71,168 ----a-w C:\WINDOWS\system32\telnet.exe
- 2005-07-26 04:31:13 97,280 ----a-w C:\WINDOWS\system32\txflog.dll
+ 2002-08-29 12:00:00 90,624 ----a-w C:\WINDOWS\system32\txflog.dll
- 2005-08-23 03:51:10 111,104 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
+ 2002-08-29 12:00:00 107,008 ----a-w C:\WINDOWS\system32\umpnpmgr.dll
- 2006-08-30 17:42:56 461,824 ----a-w C:\WINDOWS\system32\URLMON.DLL
+ 2002-08-29 12:00:00 455,680 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2005-03-02 18:20:03 561,152 ----a-w C:\WINDOWS\system32\user32.dll
+ 2002-08-29 12:00:00 560,128 ----a-w C:\WINDOWS\system32\user32.dll
+ 2008-06-25 20:47:40 28,672 ----a-w C:\WINDOWS\system32\weblso.dll
- 2005-10-04 01:38:18 1,799,552 ----a-w C:\WINDOWS\system32\win32k.sys
+ 2002-08-29 12:00:00 1,813,632 ----a-w C:\WINDOWS\system32\win32k.sys
- 2005-06-11 02:41:12 102,400 ----a-w C:\WINDOWS\system32\win32spl.dll
+ 2002-08-29 12:00:00 99,328 ----a-w C:\WINDOWS\system32\win32spl.dll
- 2004-07-01 22:08:18 331,776 ----a-w C:\WINDOWS\system32\winhttp.dll
+ 2002-08-29 12:00:00 310,272 ----a-w C:\WINDOWS\system32\winhttp.dll
- 2006-06-23 08:33:58 575,488 ----a-w C:\WINDOWS\system32\WININET.DLL
+ 2002-08-29 12:00:00 599,040 ----a-w C:\WINDOWS\system32\wininet.dll
- 2006-05-14 09:13:41 29,184 ----a-w C:\WINDOWS\system32\winipsec.dll
+ 2002-08-29 12:00:00 25,600 ----a-w C:\WINDOWS\system32\winipsec.dll
- 2005-09-01 01:49:31 278,016 ----a-w C:\WINDOWS\system32\winsrv.dll
+ 2002-08-29 12:00:00 276,480 ----a-w C:\WINDOWS\system32\winsrv.dll
+ 2008-06-25 20:47:59 24,576 ----a-w C:\WINDOWS\system32\womsoy.dll
- 2006-08-16 12:14:23 70,656 ----a-w C:\WINDOWS\system32\ws2_32.dll
+ 2002-08-29 12:00:00 75,264 ----a-w C:\WINDOWS\system32\ws2_32.dll
- 2006-08-16 12:14:23 13,312 ----a-w C:\WINDOWS\system32\wship6.dll
+ 2002-08-29 12:00:00 13,312 ----a-w C:\WINDOWS\system32\wship6.dll
- 2006-03-01 19:44:39 11,776 ----a-w C:\WINDOWS\system32\xolehlp.dll
+ 2002-08-29 12:00:00 9,728 ----a-w C:\WINDOWS\system32\xolehlp.dll
- 2006-08-16 09:42:14 159,232 ----a-w C:\WINDOWS\system32\xpob2res.dll
+ 2004-06-30 23:59:25 158,720 ----a-w C:\WINDOWS\system32\xpob2res.dll
- 2006-08-25 09:14:17 595,968 ----a-w C:\WINDOWS\system32\xpsp2res.dll
+ 2006-03-22 01:28:49 594,944 ----a-w C:\WINDOWS\system32\xpsp2res.dll
+ 2008-06-25 20:47:20 24,576 ----a-w C:\WINDOWS\system32\yitalle.dll
+ 2008-06-25 20:47:19 10,240 ----a-w C:\WINDOWS\system32\yitallek.exe
- 2008-06-23 19:34:00 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll
+ 2008-06-25 10:00:13 218,624 ---ha-w C:\WINDOWS\system32\zgrjdx.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4A908760-8000-4000-A000-9000322145A4}]
08/08/2004 12:59 PM 536072 ---hs---- C:\WINDOWS\System32\akjsdkaq.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{60A345CD-ABCD-EFAB-CDEF-ABCD01020306}]
08/08/2004 11:47 PM 536072 ---hs---- C:\WINDOWS\System32\pqzfajke.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{87FD640A-158F-48AC-FD14-1597F14A9778}]
08/08/2004 11:47 PM 534024 ---hs---- C:\WINDOWS\System32\mndshsrv.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 05:43 PM 4670704]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{4A908760-8000-4000-A000-9000322145A4}"= C:\WINDOWS\System32\akjsdkaq.dll [08/08/2004 12:59 PM 536072]
"{45AADFAA-DD36-42AB-83AD-0521BBF58C24}"= C:\WINDOWS\System32\zgrjdx.dll [06/25/2008 01:00 PM 218624]
"{60A345CD-ABCD-EFAB-CDEF-ABCD01020306}"= C:\WINDOWS\System32\pqzfajke.dll [08/08/2004 11:47 PM 536072]
"{5E907A48-400E-4EA8-9792-FFAE052D59E9}"= C:\WINDOWS\System32\pedadt.dll [06/25/2008 01:00 PM 229376]
"{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}"= C:\WINDOWS\System32\wyrsdj.dll [ ]
"{A9895933-6636-4281-BC58-EE6DE2AF96E3}"= C:\WINDOWS\System32\ddserh.dll [ ]
"{87FD640A-158F-48AC-FD14-1597F14A9778}"= C:\WINDOWS\System32\mndshsrv.dll [08/08/2004 11:47 PM 534024]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [07/18/2007 02:22 PM]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [08/09/2007 01:04 PM]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\System32\svchost.exe [08/29/2002 03:00 PM]
S3 eth8023;eth8023;C:\WINDOWS\System32\drivers\eth8023.sys []
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [06/06/2008 11:45 PM]
S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\System32\DRIVERS\loop.sys [08/17/2001 01:53 PM]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://go.3roos.com/XP68JmxSgb7
Rootkit scan 2008-06-26 05:41:56
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 06/26/2008 5:44:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 02:44:06
ComboFix2.txt 2008-06-24 09:05:09
ComboFix3.txt 2008-06-24 08:20:49
ComboFix4.txt 2008-06-23 20:54:16
ComboFix5.txt 2008-06-20 18:59:09
Pre-Run: 9,233,084,416 bytes free
Post-Run: 9,244,033,024 bytes free
810 --- E O F --- 2008-06-16 16:58:27

اوكي بس وين تقرير Hijackthis؟؟؟؟؟


----------------------------------

وايضا اريد منك عمل الاتي:

من برنامج Hijackthis

اتعبي كما بالصور









وبالاخير بيظهر لك معلومات في الNotepad

انسخي لي الكلام اللي بيظهر لك في ردك القادم


---------------------


يعني اولا ابغي التقرير العادي لل Hijackthis

ثم التقرير الاخر بالطريقة المشروحه اعلاه

في انتظار التقارير
-------------------------

مشكوره حبيبتي اتاخرت عليكي بس انا لسه جايه

التقرير

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:00:44, on 28/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\yupdater.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: akjsdkaq.dll - {4A908760-8000-4000-A000-9000322145A4} - C:\WINDOWS\System32\akjsdkaq.dll
O2 - BHO: pqzfajke.dll - {60A345CD-ABCD-EFAB-CDEF-ABCD01020306} - C:\WINDOWS\System32\pqzfajke.dll
O2 - BHO: mndshsrv.dll - {87FD640A-158F-48AC-FD14-1597F14A9778} - C:\WINDOWS\System32\mndshsrv.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - AppInit_DLLs: akjsdkaq.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
--
End of file - 2863 bytes

التقرير الثاني


Adobe Flash Player ActiveX
ERUNT 1.1j
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Intel(R) Graphics Media Accelerator Driver
Malwarebytes' Anti-Malware
RealPlayer
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 8 (KB917734)
WinRAR archiver
Yahoo! Messenger
Zuma Deluxe 1.0

انا عملت سرش علي الافيرا مش موجوده

nado4;6444522:
عزيزتي الجهز واحد فقط لكن زوجي عامل مستخدمين انا اظن ان الافيرا هو الفيرس لاني مسحته مثل ما قلتي لي

اعرف ان الجهاز واحد لكن انتي اي واحد تستخدمين ali ولا Jana؟؟

صباح الخير حبيبتي الجهاز كان الاول بيخيرني بين علي وجني لكن الان اقبل ما يفتح بيظهر صفحه فيها اسم المستخدم ومكتوب امامها علي والبص ورد وانا مش بحط باص وردوبيفتح بس ما بقاش في اختيار بين الانتين يعني تقريبا بيفتح لوحده

هلا الغالية

شوفي جربي هالبرنامج راااائع وان شاء الله يخلص جهازك من هالفيروس

حملي البرنامج من هالرابط http://go.3roos.com/UDUZwVzmMfk

دبل كليك عليه عالبرنامج

ثم اضغطي Ok

ثم اتبعي كما هو مشروح بالصورة



ثم اتركيه الى ان ينهي عملية الفحص ،،،

وبعد انتهاء عملية الفحص احفظي التقرير وارسليه لي

و لحفظ التقرير وارساله لي اتبعي كما بالصورة



ثم بيظهر لج التقرير في Notepad انسخية وارفقيه في ردك القادم

---------------------------------------

واخر شي اعملي لي تقرير ببرنامج Hijackthis
-----------------------------------------

وفي انتظارك يالغالية

مشكوره حبيبتي تعبكي معايا وانا عارفه انك زهقتي مني معلش استحمليني شويه كمان

nado4;6465645:
مشكوره حبيبتي تعبكي معايا وانا عارفه انك زهقتي مني معلش استحمليني شويه كمان

لا بالعكس حبيبتي ،، تصدقيني لو قلت لك ،، صار عندي تحدي ابغي اشيل الفيروس من جهازج :wink:

مشكوره حبيبتي كتير ربنا يخليكي انا بحمل البرنامج بقالي ساعه ونصف ولسه ما نتهاش

يعتمد يالغالية على سرعة اتصالك ،، اصبري لين يخلص لانه برنامج قوي ورائع وان شاء الله يخلصك من هالفيروس :)

التقرير الاول


28/06/2008 1711 Engine version =5200.216028/06/2008 1711 AntiVirus DAT version =5242.000028/06/2008 1711 Number of detection signatures in EXTRA.DAT =None28/06/2008 1711 Names of detection signatures in EXTRA.DAT =None28/06/2008 1701 Scan Started HOME-6TG5XE0D8N\ali On-Demand Scan28/06/2008 1737 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Yieldmanager(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\ali@adrevolver[2].txt\00000000.ie Cookie-Adrevolver(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\ali@adrevolver[2].txt\00000000.ie Cookie-Adrevolver(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Pointroll(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\ali@atdmt[2].txt\00000000.ie Cookie-Atdmt(Potentially Unwanted Program)28/06/2008 1742 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@doubleclick[1].txt\00000000.ie Cookie-Doubleclick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@fastclick[2].txt\00000000.ie Cookie-Fastclick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@fastclick[2].txt\00000000.ie Cookie-Fastclick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@fastclick[2].txt\00000000.ie Cookie-Fastclick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@fastclick[2].txt\00000000.ie Cookie-Fastclick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@fastclick[2].txt\00000000.ie Cookie-Fastclick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@insightexpressai[1].txt\00000000.ie Cookie-Insightexpres(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@insightexpressai[1].txt\00000000.ie Cookie-Insightexpres(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@insightexpressai[1].txt\00000000.ie Cookie-Insightexpres(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@insightexpressai[1].txt\00000000.ie Cookie-Insightexpres(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@insightexpressai[1].txt\00000000.ie Cookie-Insightexpres(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\[email protected][1].txt\00000000.ie Cookie-Adrevolver(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\[email protected][1].txt\00000000.ie Cookie-2O7(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@questionmarket[2].txt\00000000.ie Cookie-Questionmarke(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@questionmarket[2].txt\00000000.ie Cookie-Questionmarke(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Liveperson(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\[email protected][2].txt\00000000.ie Cookie-Liveperson(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@serving-sys[2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@serving-sys[2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@serving-sys[2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@serving-sys[2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@serving-sys[2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@serving-sys[2].txt\00000000.ie Cookie-Eyeblaster(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@specificclick[2].txt\00000000.ie Cookie-SpecClick(Potentially Unwanted Program)28/06/2008 17:15:42 Deleted ali c:\documents and settings\ali\cookies\ali@specificclick[2].txt\00000000.ie Cookie-SpecClick(Potentially Unwanted Program)28/06/2008 17:15:43 Deleted ali c:\documents and settings\ali\cookies\ali@specificclick[2].txt\00000000.ie Cookie-SpecClick(Potentially Unwanted Program)28/06/2008 17:15:43 Deleted ali c:\documents and settings\ali\cookies\ali@specificclick[2].txt\00000000.ie Cookie-SpecClick(Potentially Unwanted Program)28/06/2008 17:15:43 Deleted ali c:\documents and settings\ali\cookies\ali@specificclick[2].txt\00000000.ie Cookie-SpecClick(Potentially Unwanted Program)28/06/2008 17:15:43 Deleted ali c:\documents and settings\ali\cookies\ali@specificclick[2].txt\00000000.ie Cookie-SpecClick(Potentially Unwanted Program)28/06/2008 17:15:43 Deleted ali c:\documents and settings\ali\cookies\ali@untd[2].txt\00000000.ie Cookie-Untd(Potentially Unwanted Program)28/06/2008 17:15:43 Deleted ali c:\documents and settings\ali\cookies\ali@untd[2].txt\00000000.ie Cookie-Untd(Potentially Unwanted Program)28/06/2008 17:16:38 Deleted ali c:\MicroSoft.bat Generic Script(Virus)

التقرير الثاني


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:30:04, on 28/06/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\hellodonk.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\ali\LOCALS~1\Temp\vb3z\run.exe
C:\Documents and Settings\ali\Local Settings\Temp\vb3z\ScnCfg32.Exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/TCKiZR6BROl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/ShuJ2ifNJJc
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.3roos.com/fW7dMmVYlEU
O1 - Hosts: 202.165.102.205 972.aksjd11.com
O1 - Hosts: 202.165.102.205 w3og.cn
O1 - Hosts: 203.208.35.100 qazc.fourtw.cn
O1 - Hosts: 203.208.35.100 www.aujoy.cn
O1 - Hosts: 203.208.35.101 www.hao601.cn
O1 - Hosts: 203.208.35.101 www.psp476.cn
O1 - Hosts: 72.14.235.99 222.1212l112.net
O1 - Hosts: 72.14.235.99 444.1212l112.net
O1 - Hosts: 72.14.235.99 555.1212l112.net
O1 - Hosts: 72.14.235.99 111.1212l112.net
O1 - Hosts: 65.55.21.250 111.3243l24.com
O1 - Hosts: 65.55.21.250 222.3243l24.com
O1 - Hosts: 65.55.21.250 333.3243l24.com
O1 - Hosts: 125.64.8.112 kao2.gmwo03.com
O1 - Hosts: 125.64.8.112 kao.gmwo06.com
O1 - Hosts: 125.64.8.112 444.gmwo07.com
O1 - Hosts: 116.252.185.15 ru.update365.us
O1 - Hosts: 116.252.185.15 ad.update365.us
O1 - Hosts: 207.46.232.182 popmails.net
O1 - Hosts: 203.208.37.99 3.goodhh.com
O1 - Hosts: 220.181.37.55 down.rwixr.com
O1 - Hosts: 160.79.42.52 www.xdj2008.com
O1 - Hosts: 63.175.76.152 www.revtr.cn
O1 - Hosts: 219.133.40.91 qq.ljsll.com
O1 - Hosts: 203.208.35.102 www.aassccwe.cn
O1 - Hosts: 209.132.177.50 973.aksjd11.com
O1 - Hosts: 209.132.177.50 974.aksjd11.com
O1 - Hosts: 209.132.177.50 971.aksjd11.com
O1 - Hosts: 209.132.177.50 975.aksjd11.com
O1 - Hosts: 72.14.235.104 user1.12-39.net
O1 - Hosts: 72.14.235.147 www.infomt.net
O1 - Hosts: 192.150.18.101 ata1.sysions.net
O1 - Hosts: 192.150.18.101 ata2.sysions.net
O1 - Hosts: 192.150.18.101 ata3.sysions.net
O1 - Hosts: 192.150.18.101 ata4.sysions.net
O1 - Hosts: 193.120.42.226 8nnnnn99.cn
O1 - Hosts: 24.39.54.34 www.haoaoao.cn
O1 - Hosts: 207.46.18.74 update.4pu.com
O2 - BHO: tisqatyu.dll - {18093456-9012-4568-9076-908765467181} - C:\WINDOWS\System32\tisqatyu.dll
O2 - BHO: ijdyapaw.dll - {1A698452-C5D8-C584-C256-C264C987C5A1} - C:\WINDOWS\System32\ijdyapaw.dll
O2 - BHO: erxybloe.dll - {20909876-4567-3908-4056-909834565102} - C:\WINDOWS\System32\erxybloe.dll
O2 - BHO: rijxbkin.dll - {25FD6584-698F-BCD2-602C-698745210352} - C:\WINDOWS\System32\rijxbkin.dll
O2 - BHO: lassaplo.dll - {2B69874A-C58C-458D-69F0-698F874E41B2} - C:\WINDOWS\System32\lassaplo.dll
O2 - BHO: yxcschlp.dll - {35671234-7890-ABCD-CDEF-567801237653} - C:\WINDOWS\System32\yxcschlp.dll
O2 - BHO: lijzclit.dll - {3C954872-1230-6541-9548-6541025884C3} - C:\WINDOWS\System32\lijzclit.dll
O2 - BHO: oswxdttb.dll - {43512378-9874-5641-1025-985420368734} - C:\WINDOWS\System32\oswxdttb.dll
O2 - BHO: lofsdjbo.dll - {470165F1-9F65-569F-F895-F14F58F41074} - C:\WINDOWS\System32\lofsdjbo.dll
O2 - BHO: nhmxdjkl.dll - {47AC9076-C898-B098-D098-A18319080974} - C:\WINDOWS\System32\nhmxdjkl.dll
O2 - BHO: akjsdkaq.dll - {4A908760-8000-4000-A000-9000322145A4} - C:\WINDOWS\System32\akjsdkaq.dll
O2 - BHO: zptlcsys.dll - {50940F85-F015-14F1-A05F-F69858AC6D05} - C:\WINDOWS\System32\zptlcsys.dll
O2 - BHO: ptjhehlp.dll - {528DF602-9541-A985-210A-984A698C6F25} - C:\WINDOWS\System32\ptjhehlp.dll
O2 - BHO: pjjxedwd.dll - {54FAE856-AD58-20CB-A025-CD4895FA6E45} - C:\WINDOWS\System32\pjjxedwd.dll
O2 - BHO: ozfyebyt.dll - {5A069845-2036-6084-9054-6087502480A5} - C:\WINDOWS\System32\ozfyebyt.dll
O2 - BHO: tysqbkol.dll - {5D098345-6785-1098-5413-678067AE03D5} - C:\WINDOWS\System32\tysqbkol.dll
O2 - BHO: pqzfajke.dll - {60A345CD-ABCD-EFAB-CDEF-ABCD01020306} - C:\WINDOWS\System32\pqzfajke.dll
O2 - BHO: mnmhgsrv.dll - {7C8D1401-A58D-A81C-CD24-A5915C4517C7} - C:\WINDOWS\System32\mnmhgsrv.dll
O2 - BHO: apsggjba.dll - {7FD45A54-9875-698F-E56E-65102358FDF7} - C:\WINDOWS\System32\apsggjba.dll
O2 - BHO: mndshsrv.dll - {87FD640A-158F-48AC-FD14-1597F14A9778} - C:\WINDOWS\System32\mndshsrv.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: arjrgler.dll - {9C69034A-F45F-D34D-A33A-C33C4D324FC9} - C:\WINDOWS\System32\arjrgler.dll
O2 - BHO: s2da2f323.dll - {A629FF4F-ACDB-5C90-A098-FACB3456A26A} - C:\WINDOWS\System32\s2da2f323.dll
O2 - BHO: yzztkmsn.dll - {B490415F-65F8-B5C5-D8BA-9405FB12054B} - C:\WINDOWS\System32\yzztkmsn.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E890EC-2E69-4BB8-9096-657E7C13A6B2}: NameServer = 66.11.234.90,66.11.234.91
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O21 - SSODL: JavaView - {DA191DE0-AA86-D04E-4B87-2A3D4928BE99} - C:\WINDOWS\AppPatch\Jview.dll
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
--
End of file - 6634 bytes

اوف والله جهازج خربان يالغالية

مب راضي يروح بالعكس يزيد

راح اشوف حل وارد لج

اوكي الغالية ،، الحين انتي جهازج بدون برنامج حماية

حملي هالبرنامج Kaspersky Security 2009

وثبتيه كما هو مبين في هالفيديو

ثم حملي هالملف

ثم ركبيه كما هو مبين بالصور


رايت كليك على ايقونه البرنامج بالتاسك بار تحت بجانب الساعة ثم اختاري settings








-----------------------------------------------------------

وبعد عمل كل الخطوات اعلاه ،، اعملي فحص شامل للجهاز بهالطريقة

رايت كليك على ايقونه البرنامج بالتاسك بار تحت بجانب الساعة

ثم اختاري Full computer scan

-----------------------------------------------

وبعد الفحص ما يخلص

--------------------------------------------

اعملي تقرير ببرنامج Hijackthis

السلام عليكم ورده الثلج

كيف حالك


انا جبت الجهاز الان من الصيلنه بعد ما تعبني وماكان بيفتح
الان هو وضع برنامج سيمستك انتي فيرس بس الجهاز اصبح اثقل من الاول

ما هو الحل الان انا تعبتك كتير ومشكوره

حمد الله علي السلامه ونورتي وعطرتي المنتدي من جديد

التقرير



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:52:20 م, on 21/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Ela-Salaty\Salaty.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SavUI.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/FGGcZaWh0vb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.3roos.com/fW7dMmVYlEU
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.3roos.com/lOb6nZdAtcg*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.3roos.com/0gYCKcpinCF*http://go.3roos.com/fW7dMmVYlEUext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.3roos.com/XGVg0HzPMtI*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.3roos.com/fW7dMmVYlEU
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ela-Salaty.lnk = C:\Program Files\Ela-Salaty\Salaty.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://go.3roos.com/Jx9eC6H8O0W
O17 - HKLM\System\CCS\Services\Tcpip\..\{5847D10D-C930-4282-AC45-022C99322592}: NameServer = 66.11.234.90,66.11.234.91
O17 - HKLM\System\CS1\Services\Tcpip\..\{5847D10D-C930-4282-AC45-022C99322592}: NameServer = 66.11.234.90,66.11.234.91
O17 - HKLM\System\CS2\Services\Tcpip\..\{5847D10D-C930-4282-AC45-022C99322592}: NameServer = 66.11.234.90,66.11.234.91
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
--
End of file - 5544 bytes

ورده الثلج اختي انا بعد عندي نفس المشكله وسويت اللي قلتي شووفي شنوو طلع

Trend Micro End User License Agreement 
Software: HijackThis
Version: English/Multi-country
Date: April 2007


IMPORTANT: YOU MUST CAREFULLY READ AND AGREE TO ALL TERMS AND
CONDITIONS OF THE FOLLOWING END USER LICENSE AGREEMENT BEFORE
INSTALLING OR USING THE SOFTWARE.

THIS AGREEMENT SETS FORTH THE TERMS AND CONDITIONS UNDER WHICH
TREND MICRO IS WILLING TO LICENSE THE "SOFTWARE" TO "YOU" AS AN
INDIVIDUAL USER OR AN AUTHORIZED REPRESENTATIVE OF AN ENTITY.
BY CLICKING THE "I ACCEPT" BUTTON BELOW, YOU ARE EXPRESSING YOUR
INTENT TO ENTER INTO, AND ARE ENTERING INTO, A BINDING LEGAL
CONTRACT ("AGREEMENT") BETWEEN YOU AND TREND MICRO
INCORPORATED OR ONE OF ITS AFFILIATES ("TREND MICRO"). THE TERMS
AND CONDITIONS OF THE AGREEMENT THEN APPLY TO YOUR USE OF THE
SOFTWARE. WE ENCOURAGE YOU TO PRINT A COPY OF THE AGREEMENT FOR
YOUR RECORDS
YOU MUST ACCEPT THIS AGREEMENT BEFORE YOU INSTALL OR USE THE
SOFTWARE. IF YOU ARE ACQUIRING THE SOFTWARE ON BEHALF OF AN ENTITY, THEN YOU
MUST BE PROPERLY AUTHORIZED TO REPRESENT THAT ENTITY AND TO
ACCEPT THIS AGREEMENT ON ITS BEHALF.

YOU ACCEPT THIS END USER LICENSE BY CLICKING THE "I ACCEPT" BUTTON
BELOW. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, SELECT
"I DO NOT ACCEPT". YOU WILL THEN NOT BE PERMITTED TO INSTALL OR USE
THE SOFTWARE.

1. LICENSE. Upon Your acceptance of the terms and conditions of this Agreement,
Trend Micro hereby grants You a nonexclusive, nontransferable, non-sublicensable,
royalty-free, worldwide license, to download, install the Software, for Your own use only.
Trend Micro reserves the right to enhance, modify, or discontinue the Software or to
impose new or different conditions on its use at any time without notice.

2. USE RESTRICTIONS AND OWNERSHIP. The Software is licensed not sold. Trend
Micro owns the title and intellectual property rights to the Software, and reserves all rights
not expressly granted to You in this Agreement. You agree that you will not rent, loan,
lease or sublicense the Software. You agree not to attempt to reverse engineer,
decompile, modify, translate, disassemble, discover the source code of, or create
derivative works from, any part of the Software or authorize others to undertake any of
these acts.

3. BACKUP. For as long as You use the Software, You agree to regularly back-up Your
computer programs and files ("Data") on a separate media. You acknowledge that the
failure to do so may cause You to lose Data in the event that any error in the Software
causes computer problems, and that Trend Micro is not responsible for any such Data
loss.

4. TERMINATION. Trend Micro may terminate the license at any time for any reason.
Upon such termination, You agree to delete or destroy all copies of the Software. You
may terminate this Agreement at any point by destroying or deleting all copies of the
Software.

5. REPORTS AND PRIVACY. At any time during the term of this Agreement, You may
choose to send to Trend Micro a report of log files that may include personal information
that the Software scanned on Your computer. By accepting this Agreement, You hereby
give Your consent to Trend Micro to process log file data provided by You ("Information")
in connection with this Agreement; processing may include collection, registration,
storage, modification or disclosure of such Information to third parties. As a condition to
using the Software and by accepting this Agreement, You ensure, represent and warrant
that You are legally permitted to provide Trend Micro with access to the Information and
You also give Your consent to Trend Micro to transfer or store the Information in one or
more of its group companies, located in and/or outside the country where You are
located, and/or in jurisdictions which may have a lower level of protection of Information
than is applicable in the country where You are located or where pr
ivacy laws may not be as stringent as those in Your own country.

6. CAUTION AND ACKNOWLEDGEMENT. The Software is designed to identify different
types of files, operating system changes, registry or browser settings, which, in Trend
Micro's judgment, may compromise computer security or productivity. You agree that
Trend Micro shall not be responsible for any removal or disabling of files or settings or the
results of such removal or disabling. You are solely responsible for selecting which files or
settings to remove from Your computer.

7. NO WARRANTY. THE SOFTWARE IS PROVIDED "AS IS," WITHOUT
WARRANTIES OF ANY KIND. TREND MICRO DOES NOT WARRANT THAT YOUR
USE OF THE SOFTWARE WILL BE UNINTERRUPTED OR ERROR FREE. TO THE
FULLEST EXTENT PERMITTED BY APPLICABLE LAW, TREND MICRO DISCLAIMS
AND EXCLUDES ALL REPRESENTATIONS AND WARRANTIES WITH RESPECT TO
THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
TO IMPLIED WARRANTIES OF NONINFRINGEMENT OF THIRD PARTY RIGHTS,
SATISFACTORY QUALITY, MERCHANTABILITY, AND FITNESS FOR A
PARTICULAR PURPOSE.

8. NO LIABILITY FOR CONSEQUENTIAL DAMAGES.
(A) TREND MICRO DOES NOT SEEK TO LIMIT OR EXCLUDE ITS LIABILITY IN THE
EVENT OF DEATH OR PERSONAL INJURY CAUSED BY ITS NEGLIGENCE OR FOR
FRAUD OR FOR ANY OTHER LIABILITY FOR WHICH IT IS NOT PERMITTED BY
LAW TO EXCLUDE.
(B) TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, TREND MICRO
DISCLAIMS ALL LIABILITY FOR CONSEQUENTIAL, SPECIAL, INCIDENTAL OR
INDIRECT DAMAGES OF ANY KIND OR FOR LOST OR CORRUPTED DATA OR
MEMORY, SYSTEM CRASH, DISK/SYSTEM DAMAGE, LOST PROFITS OR
SAVINGS, OR LOSS OF BUSINESS, ARISING OUT OF OR RELATED TO THIS
AGREEMENT. YOU ALSO UNDERSTAND AND AGREE THAT YOU DOWNLOAD,
INSTALL AND/OR USE THE SOFTWARE AT YOUR OWN DISCRETION AND RISK
AND THAT YOU WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR
COMPUTER SYSTEM OR LOSS OF DATA THAT RESULTS FROM THE USE OF THE
SOFTWARE.
9. CONSUMER PROTECTION AND PRIVACY. SOME COUNTRIES, STATES AND
PROVINCES, INCLUDING MEMBER STATES OF THE EUROPEAN ECONOMIC
AREA, DO NOT ALLOW CERTAIN EXCLUSIONS OR LIMITATIONS OF LIABILITY, SO
THE ABOVE DISCLAIMER OF WARRANTY AND EXCLUSION OR LIMITATION OF
LIABILITIES (SECTIONS 7 AND 8) MAY NOT FULLY APPLY TO YOU. YOU MAY
HAVE ADDITIONAL RIGHTS AND REMEDIES. SUCH POSSIBLE RIGHTS OR
REMEDIES, IF ANY, SHALL NOT BE AFFECTED BY THIS AGREEMENT. THERE
MAY BE MANDATORY REGULATIONS OR LEGAL PROVISIONS THAT ARE
APPLICABLE TO YOU AS A CONSUMER.
10. COMPLIANCE WITH ALL LAWS, EXPORT CONTROL. The Software is subject to
export controls under the U.S. Export Administration Regulations. The Software may not
be exported or re-exported to entities within, or residents or citizens of, embargoed
countries or countries subject to applicable trade sanctions, nor to prohibited or denied
persons or entities without proper government licenses. Information about such
restrictions can be found at the following websites: http://go.3roos.com/G9oimPRts25 and
www.bis.doc.gov/complianceandenforcement/ListsToCheck.htm. You are responsible
for any violation of the US export control laws related to Your copy of the Software. By
accepting this Agreement, You confirm that You are not a resident or citizen of any
country currently embargoed by the U.S. and that You are not otherwise prohibited from
receiving the Software.

11. U.S. GOVERNMENT RESTRICTED RIGHTS. If the entity on whose behalf You are
acquiring the Software is any unit or agency of the United States Government, then that
Government entity acknowledges that the Software, (i) was developed at private
expense, (ii) is commercial in nature, (iii) is not in the public domain, and (iv) is "Restricted
Computer Software" as that term is defined in Clause 52.227 19 of the Federal
Acquisition Regulations (FAR) and is "Commercial Computer Software" as that term is
defined in Subpart 227.471 of the Department of Defense Federal Acquisition Regulation
Supplement (DFARS). The Government agrees that (i) if the Software is supplied to the
Department of Defense (DoD), the Software is classified as "Commercial Computer
Software" and the Government is acquiring only "restricted rights" in the Software and its
documentation as that term is defined in Clause 252.227 7013(c)(1) of the DFARS, and
(ii) if the Software is supplied to any unit or agency of the United States Government ot
her than DoD, the Government's rights in the Software and its documentation will be as
defined in Clause 52.227 19(c)(2) of the FAR.

12. GOVERNING LAW. Unless otherwise required by the specific jurisdiction’s laws,
this Agreement will be governed by the laws of the State of California, USA, without
regard to the provisions of the United Nations Convention on Contracts for the
International Sale of Goods and the conflict of laws provisions of Your state or country of
residence.  

13. GENERAL PROVISIONS. This is the entire agreement between You and Trend
Micro with respect to the subject matter hereof and supersedes and replaces all prior or
contemporaneous understandings or agreements regarding such subject matter. Any
waiver of any provision of this Agreement will be effective only if in writing and signed by
Trend Micro. In the event that any provision or portion of this Agreement is found to be
invalid, that finding will not affect the validity of the remaining parts of this Agreement.
Trend Micro may assign or subcontract some or all of its obligations under this Agreement
to qualified third parties or its affiliates and/or subsidiaries, provided that no such
assignment or subcontract shall relieve Trend Micro of its obligations under this
Agreement.

14. QUESTIONS. Address all questions about this Agreement to:
[email][email protected][/email].


The Software is protected by copyright, trade secret and U.S. PATENT laws, and
international treaty provisions. UNAUTHORIZED REPRODUCTION OR DISTRIBUTION
IS SUBJECT TO CIVIL AND CRIMINAL PENALTIES. ها هوو المطلوب ولا شنوو ؟؟ وبللليز طمنيني

nado4;6701746:
حمد الله علي السلامه ونورتي وعطرتي المنتدي من جديد

التقرير

الله يسلمج غلاتي ،، المنتدى منور بوجدك (f)

بالنسبة للتقرير فللأسف الصيانه ما نظف لج الجهاز بالشكل الصحيح

المهم اتبعي الاتي:

حددي هالقيم واحذفيها:

O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{5847D10D-C930-4282-AC45-022C99322592}: NameServer = 66.11.234.90,66.11.234.91
O17 - HKLM\System\CS1\Services\Tcpip\..\{5847D10D-C930-4282-AC45-022C99322592}: NameServer = 66.11.234.90,66.11.234.91
O17 - HKLM\System\CS2\Services\Tcpip\..\{5847D10D-C930-4282-AC45-022C99322592}: NameServer = 66.11.234.90,66.11.234.91

O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll


ثم نظفي الجهاز باداة ATF Cleaner :)

وبالاخير اعيدي عمل تقرير ببرنامج Hijackthis