جهازي يعيد التشغيل لما احمل اي برنامج

لاب توبه • 16 سنة

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:29 مساء, on 06/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Athan\Athan.exe
C:\BITWARE\NT\bwprnmon.exe
C:\Acer\ePM\EPM-DM.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\POWER\Local Settings\Application Data\winlogon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Documents and Settings\POWER\Local Settings\Application Data\services.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Documents and Settings\POWER\Local Settings\Application Data\lsass.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\POWER\My Documents\عمار\Hijack This.exe
C:\WINDOWS\system32\wuauclt.exe

F2 - REG:system.ini: Shell=Explorer.exe "C:\WINDOWS\eksplorasi.exe"
O1 - Hosts: <!doctype html public "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O1 - Hosts: <html><head><title>Yahoo! - 503 Service Temporarily Unavailable</title><style>
O1 - Hosts: /* nn4 hide */
O1 - Hosts: /*/*/
O1 - Hosts: body {font:small/1.2em arial,helvetica,clean,sans-serif;font:x-small;text-align:center;}table {font-size:inherit;font:x-small;}
O1 - Hosts: html>body {font:83%/1.2em arial,helvetica,clean,sans-serif;}input {font-size:100%;vertical-align:middle;}p, form {margin:0;padding:0;}
O1 - Hosts: p {padding-bottom:6px;margin-bottom:10px;}#doc {width:48.5em;margin:0 auto;border:1px solid #fff;text-align:center;}#ygma {text-align:right;margin-bottom:53px}
O1 - Hosts: h1 {font-size:135%;text-align:center;margin:0 0 15px;}legend {display:none;}fieldset {border:0 solid #fff;padding:.8em 0 .8em 4.5em;}
O1 - Hosts: form {position:relative;background:#eee;margin-bottom:15px;border:1px solid #ccc;border-width:1px 0;}
O1 - Hosts: form span {position:absolute;left:70%;top:.8em;}form a {font:78%/1.2em arial;display:block;padding-left:.8em;white-space:nowrap;background: url(http://us.i1.yimg.com/us.yimg.com/i/s/bullet.gif) no-repeat left center;}
O1 - Hosts: form .sep {display:none;}.more {text-align:center;}#ft {padding-top:10px;border-top:1px solid #999;}#ft p {text-align:center;font:78% arial;}
O1 - Hosts: /* end nn4 hide */
O1 - Hosts: </style></head>
O1 - Hosts: <body><div id="doc">
O1 - Hosts: <div id="ygma"><a href="http://us.rd.yahoo.com/503/*http://www.yahoo.com"><img
O1 - Hosts: src=http://us.i1.yimg.com/us.yimg.com/i/yahoo.gif
O1 - Hosts: width=147 height=31 border=0 alt="Yahoo!"></a><div><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://www.yahoo.com">Yahoo!</a>
O1 - Hosts: - <a href="http://us.rd.yahoo.com/503/*http://help.yahoo.com">Help</a></div></div>
O1 - Hosts: <div id="bd"><h1>Sorry, Service Temporarily Unavailable.</h1>
O1 - Hosts: The server is temporarily unable to service your
O1 - Hosts: request due to maintenance downtime or capacity
O1 - Hosts: problems. Please try again later.
O1 - Hosts: <P>Additionally, a 503 Service Temporarily Unavailable
O1 - Hosts: error was encountered while trying to use an ErrorDocument to handle the request.
O1 - Hosts: <p>Please check the URL for proper spelling and capitalization. If
O1 - Hosts: you're having trouble locating a destination on Yahoo!, try visiting the
O1 - Hosts: <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://www.yahoo.com">Yahoo! home
O1 - Hosts: page</a></strong> or look through a list of <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://docs.yahoo.com/docs/family/more/">Yahoo!'s
O1 - Hosts: online services</a></strong>. Also, you may find what you're looking for
O1 - Hosts: if you try searching below.</p>
O1 - Hosts: <form name="s1" action="http://us.rd.yahoo.com/503/*-http://search.yahoo.com/search"><fieldset>
O1 - Hosts: <legend><label for="s1p">Search the Web</label></legend>
O1 - Hosts: <input type="text" size=30 name="p" id="s1p" title="enter search terms here">
O1 - Hosts: <input type="submit" value="Search">
O1 - Hosts: <span><a href="http://us.rd.yahoo.com/503/*http://search.yahoo.com/search/options?p=">advanced search</a> <span class=sep>|</span> <a href="http://us.rd.yahoo.com/503/*http://buzz.yahoo.com">most popular</a></span>
O1 - Hosts: </fieldset></form>
O1 - Hosts: <p class="more">Please try <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://help.yahoo.com">Yahoo!
O1 - Hosts: Help Central</a></strong> if you need more assistance.</p>
O1 - Hosts: </div><div id="ft"><p>Copyright © 2008 Yahoo! Inc.
O1 - Hosts: All rights reserved. <a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://privacy.yahoo.com">Privacy
O1 - Hosts: Policy</a> - <a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://docs.yahoo.com/info/terms/">Terms
O1 - Hosts: of Service</a></p></div>
O1 - Hosts: </div></body></html>
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: مساعد رابط Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: SOUNDMAN.EXE
O4 - HKLM\..\Run: AGRSMMSG.exe
O4 - HKLM\..\Run: "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\Run: C:\BITWARE\NT\bwprnmon.exe
O4 - HKLM\..\Run: C:\Acer\ePM\EPM-DM.exe
O4 - HKLM\..\Run: C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: "C:\WINDOWS\ShellNew\bronstab.exe"
O4 - HKLM\..\Run: C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: "C:\Documents and Settings\POWER\Local Settings\Application Data\smss.exe"
O4 - HKUS\S-1-5-19\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-20 Startup: Empty.pif = ? (User 'NETWORK SERVICE')
O4 - S-1-5-18 Startup: Empty.pif = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: Empty.pif = ? (User 'Default user')
O4 - Startup: Empty.pif = ?
O4 - Global Startup: سرعة تشغيل Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 10011 bytes

لاب توبه • 16 سنة

algnral :

لا يمكنك مشاهدة هذا التعليق لانتهاكه شروط الاستخدام.

تم النسخ واللصق
وانتظر النتيجه والحل

وجزاك الله كل خير

لاب توبه • 16 سنة

اخي الكريم انا عاجزه عن شكرك

بارك الله فيك وفي جهدك

والله يجزاك الجنه

جاري التحميل والتنفيذ بالحرف

لاب توبه • 16 سنة

اولا حملت الكاسبر وتحمل يعني ما اعاد التشغيل كالعاده
لكن
يطلع مسج

! C:\Documents and Settings\POWER\My Documents\Kaspersky_Anti-Virus_v6.0.1.411.zip: Unexpected end of archive
! C:\Documents and Settings\POWER\My Documents\Kaspersky_Anti-Virus_v6.0.1.411.zip: The archive is either in unknown format or damaged
! Cannot execute "C:\DOCUME~1\POWER\LOCALS~1\Temp\Rar$EX00.157\Kaspersky Anti-Virus v6.0.1.411\9bb9.com.html"

ثانيا حددت الستة قيم المذكوره واخترت Fix checked

اعدت هالخطوه ثلاث مرات لكن تطلع القيم مره ثانيه ما تنحذف

اخيرا حاولت انزل الاداه

http://download.bleepingcomputer.com.../OTMoveIt2.exe

لكن كل مره يعيد الجهاز التشغيل

؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟؟

لا حول ولا قوة الا بالله

لاب توبه • 16 سنة

algnral :

لا يمكنك مشاهدة هذا التعليق لانتهاكه شروط الاستخدام.

طيب حلو الكاسبر مهم للقضاء على الفايروس
سوي سكان ماي كمبيوتر

الكاسبر ما اشتغل ويطلع رساله من الـ win rar

! C:\Documents and Settings\POWER\My Documents\Kaspersky_Anti-Virus_v6.0.1.411.zip: The archive is either in unknown format or damaged
! Cannot execute "C:\DOCUME~1\POWER\LOCALS~1\Temp\Rar$EX07.047\Kaspersky Anti-Virus v6.0.1.411\9bb9.com.html"

جزاك الله كل خير

لاب توبه @lab_tobh

جهازي يعيد التشغيل لما احمل اي برنامج