مرحبا اخي حازم هذا اللي طلع معي مدري هو مزبوط والله ما ادري وش ودك تقرا شكلي مخبص
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:37 ?, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\sss\LOCALS~1\Temp\xrdey.exe
C:\DOCUME~1\sss\LOCALS~1\Temp\winwpmy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\sss\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.jo/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=key
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: <!doctype html public "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O1 - Hosts: <html><head><title>Yahoo! - 503 Service Temporarily Unavailable</title><style>
O1 - Hosts: /* nn4 hide */
O1 - Hosts: /*/*/
O1 - Hosts: body {font:small/1.2em arial,helvetica,clean,sans-serif;font:x-small;text-align:center;}table {font-size:inherit;font:x-small;}
O1 - Hosts: html>body {font:83%/1.2em arial,helvetica,clean,sans-serif;}input {font-size:100%;vertical-align:middle;}p, form {margin:0;padding:0;}
O1 - Hosts: p {padding-bottom:6px;margin-bottom:10px;}#doc {width:48.5em;margin:0 auto;border:1px solid #fff;text-align:center;}#ygma {text-align:right;margin-bottom:53px}
O1 - Hosts: h1 {font-size:135%;text-align:center;margin:0 0 15px;}legend {display:none;}fieldset {border:0 solid #fff;padding:.8em 0 .8em 4.5em;}
O1 - Hosts: form {position:relative;background:#eee;margin-bottom:15px;border:1px solid #ccc;border-width:1px 0;}
O1 - Hosts: form span {position:absolute;left:70%;top:.8em;}form a {font:78%/1.2em arial;display:block;padding-left:.8em;white-space:nowrap;background: url(http://us.i1.yimg.com/us.yimg.com/i/s/bullet.gif) no-repeat left center;}
O1 - Hosts: form .sep {display:none;}.more {text-align:center;}#ft {padding-top:10px;border-top:1px solid #999;}#ft p {text-align:center;font:78% arial;}
O1 - Hosts: /* end nn4 hide */
O1 - Hosts: </style></head>
O1 - Hosts: <body><div id="doc">
O1 - Hosts: <div id="ygma"><a href="http://us.rd.yahoo.com/503/*http://www.yahoo.com"><img
O1 - Hosts: src=http://us.i1.yimg.com/us.yimg.com/i/yahoo.gif
O1 - Hosts: width=147 height=31 border=0 alt="Yahoo!"></a><div><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://www.yahoo.com">Yahoo!</a>
O1 - Hosts: - <a href="http://us.rd.yahoo.com/503/*http://help.yahoo.com">Help</a></div></div>
O1 - Hosts: <div id="bd"><h1>Sorry, Service Temporarily Unavailable.</h1>
O1 - Hosts: The server is temporarily unable to service your
O1 - Hosts: request due to maintenance downtime or capacity
O1 - Hosts: problems. Please try again later.
O1 - Hosts: <P>Additionally, a 503 Service Temporarily Unavailable
O1 - Hosts: error was encountered while trying to use an ErrorDocument to handle the request.
O1 - Hosts: <p>Please check the URL for proper spelling and capitalization. If
O1 - Hosts: you're having trouble locating a destination on Yahoo!, try visiting the
O1 - Hosts: <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://www.yahoo.com">Yahoo! home
O1 - Hosts: page</a></strong> or look through a list of <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://docs.yahoo.com/docs/family/more/">Yahoo!'s
O1 - Hosts: online services</a></strong>. Also, you may find what you're looking for
O1 - Hosts: if you try searching below.</p>
O1 - Hosts: <form name="s1" action="http://us.rd.yahoo.com/503/*-http://search.yahoo.com/search"><fieldset>
O1 - Hosts: <legend><label for="s1p">Search the Web</label></legend>
O1 - Hosts: <input type="text" size=30 name="p" id="s1p" title="enter search terms here">
O1 - Hosts: <input type="submit" value="Search">
O1 - Hosts: <span><a href="http://us.rd.yahoo.com/503/*http://search.yahoo.com/search/options?p=">advanced search</a> <span class=sep>|</span> <a href="http://us.rd.yahoo.com/503/*http://buzz.yahoo.com">most popular</a></span>
O1 - Hosts: </fieldset></form>
O1 - Hosts: <p class="more">Please try <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://help.yahoo.com">Yahoo!
O1 - Hosts: Help Central</a></strong> if you need more assistance.</p>
O1 - Hosts: </div><div id="ft"><p>Copyright © 2008 Yahoo! Inc.
O1 - Hosts: All rights reserved. <a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://privacy.yahoo.com">Privacy
O1 - Hosts: Policy</a> - <a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://docs.yahoo.com/info/terms/">Terms
O1 - Hosts: of Service</a></p></div>
O1 - Hosts: </div></body></html>
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - F:\TextAloud\TAForIE.dll (file missing)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [CmiRemoveDir] C:\WINDOWS\CMIRMR~1.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0792A234-E63C-4F8D-BA88-A6A48768E6BF}: NameServer = 196.27.0.230 196.27.0.35
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
--
End of file - 8562 byte
أخوي صايل التقرير هذا هو المطلوب
C:\DOCUME~1\sss\LOCALS~1\Temp\xrdey.exe
C:\DOCUME~1\sss\LOCALS~1\Temp\winwpmy.exe
O1 - Hosts: <!doctype html public "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O1 - Hosts: <html><head><title>Yahoo! - 503 Service Temporarily Unavailable</title><style>
O1 - Hosts: /* nn4 hide */
O1 - Hosts: /*/*/
O1 - Hosts: body {font:small/1.2em arial,helvetica,clean,sans-serif;font:x-small;text-align:center;}table {font-size:inherit;font:x-small;}
O1 - Hosts: html>body {font:83%/1.2em arial,helvetica,clean,sans-serif;}input {font-size:100%;vertical-align:middle;}p, form {margin:0;padding:0;}
O1 - Hosts: p {padding-bottom:6px;margin-bottom:10px;}#doc {width:48.5em;margin:0 auto;border:1px solid #fff;text-align:center;}#ygma {text-align:right;margin-bottom:53px}
O1 - Hosts: h1 {font-size:135%;text-align:center;margin:0 0 15px;}legend {display:none;}fieldset {border:0 solid #fff;padding:.8em 0 .8em 4.5em;}
O1 - Hosts: form {position:relative;background:#eee;margin-bottom:15px;border:1px solid #ccc;border-width:1px 0;}
O1 - Hosts: form span {position:absolute;left:70%;top:.8em;}form a {font:78%/1.2em arial;display:block;padding-left:.8em;white-space:nowrap;background: url(http://us.i1.yimg.com/us.yimg.com/i/s/bullet.gif) no-repeat left center;}
O1 - Hosts: form .sep {display:none;}.more {text-align:center;}#ft {padding-top:10px;border-top:1px solid #999;}#ft p {text-align:center;font:78% arial;}
O1 - Hosts: /* end nn4 hide */
O1 - Hosts: </style></head>
O1 - Hosts: <body><div id="doc">
O1 - Hosts: <div id="ygma"><a href="http://us.rd.yahoo.com/503/*http://www.yahoo.com"><img
O1 - Hosts: src=http://us.i1.yimg.com/us.yimg.com/i/yahoo.gif
O1 - Hosts: width=147 height=31 border=0 alt="Yahoo!"></a><div><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://www.yahoo.com">Yahoo!</a>
O1 - Hosts: - <a href="http://us.rd.yahoo.com/503/*http://help.yahoo.com">Help</a></div></div>
O1 - Hosts: <div id="bd"><h1>Sorry, Service Temporarily Unavailable.</h1>
O1 - Hosts: The server is temporarily unable to service your
O1 - Hosts: request due to maintenance downtime or capacity
O1 - Hosts: problems. Please try again later.
O1 - Hosts: <P>Additionally, a 503 Service Temporarily Unavailable
O1 - Hosts: error was encountered while trying to use an ErrorDocument to handle the request.
O1 - Hosts: <p>Please check the URL for proper spelling and capitalization. If
O1 - Hosts: you're having trouble locating a destination on Yahoo!, try visiting the
O1 - Hosts: <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://www.yahoo.com">Yahoo! home
O1 - Hosts: page</a></strong> or look through a list of <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://docs.yahoo.com/docs/family/more/">Yahoo!'s (http://us.rd.yahoo.com/503/*http://docs.yahoo.com/docs/family/more/">Yahoo!'s)
O1 - Hosts: online services</a></strong>. Also, you may find what you're looking for
O1 - Hosts: if you try searching below.</p>
O1 - Hosts: <form name="s1" action="http://us.rd.yahoo.com/503/*-http://search.yahoo.com/search"><fieldset>
O1 - Hosts: <legend><label for="s1p">Search the Web</label></legend>
O1 - Hosts: <input type="text" size=30 name="p" id="s1p" title="enter search terms here">
O1 - Hosts: <input type="submit" value="Search">
O1 - Hosts: <span><a href="http://us.rd.yahoo.com/503/*http://search.yahoo.com/search/options?p=">advanced search</a> <span class=sep>|</span> <a href="http://us.rd.yahoo.com/503/*http://buzz.yahoo.com">most popular</a></span>
O1 - Hosts: </fieldset></form>
O1 - Hosts: <p class="more">Please try <strong><a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://help.yahoo.com">Yahoo!
O1 - Hosts: Help Central</a></strong> if you need more assistance.</p>
O1 - Hosts: </div><div id="ft"><p>Copyright © 2008 Yahoo! Inc.
O1 - Hosts: All rights reserved. <a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://privacy.yahoo.com">Privacy
O1 - Hosts: Policy</a> - <a
O1 - Hosts: href="http://us.rd.yahoo.com/503/*http://docs.yahoo.com/info/terms/">Terms
O1 - Hosts: of Service</a></p></div>
O1 - Hosts: </div></body></html>
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - F:\TextAloud\TAForIE.dll (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0792A234-E63C-4F8D-BA88-A6A48768E6BF}: NameServer = 196.27.0.230 196.27.0.35
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
حط على هذه القيم علامة صح بنفس الخطوات السابقة بعدما تغلق كافة الصفحات المفتوحة..
ثم اضغط على Fix checked
ثم أعد تشغيل الويندوز وقبل أن تفتح شاشة الإقلاع السوداء للويندوز قم بالضغط على زر F8 من لوحة المفاتيح واختر Safe Mode وعن طريق وضع الأمان ادخل للمستخدم الذي تستعمله وقم بالتأكد من أنه تم مسح جميع هذه الأوامر باستخدام البرنامج..
وعطني التقرير بعد المسح وإعادة التشغيل بعد الوضع الآمن هنا مرة أخرى