ذكرى

السلام عليكم ورحمة الله


اعاني من ثقل بالجهاز وبالمتصفح تقريبا من 3 شهور بداية هالحاله في تزايد وماقدر اسوي اعادة استعادة النظام مافي الا نقطة مسجلة بتاريخ جديد

وهذا التقرير وياليت المسسساعدة وشكرا لكم

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1041 م, on 09/12/14
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16526)
Boot mode: Normal

Running processes:
C:\Users\GTC\AppData\Local\iLivid\iLivid .exe
C:\Users\GTC\AppData\Local\***Player\FLV Player\***Player.exe
C:\Users\GTC\AppData\Local\***Player\App sHat\***Player.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BavTray.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\Program Files (x86)\Hotspot Shield\bin\hsscp.exe
C:\Program Files (x86)\RealNetworks\RealDownloader\downlo ader2.exe
c:\program files (x86)\real\realplayer\update\realsched.e xe
C:\Program Files (x86)\RealNetworks\RealDownloader\record ingmanager.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.e xe
C:\Program Files (x86)\Google\Chrome\Application\chrome.e xe
C:\Program Files (x86)\Google\Chrome\Application\chrome.e xe
C:\Program Files (x86)\Google\Chrome\Application\chrome.e xe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sa.hao123.com/?tn=smt_pay_hp_ex01_hao123_sa
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentV ersion\Internet Settings,ProxyServer = http=127.0.0.1:8555;https=127.0.0.1:8555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper Shim.dll
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\RealNetworks\RealDownloader\Browse rPlugins\IE\rndlbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.D LL
O2 - BHO: ****(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\****\jre7\bin\ssv.dll
O2 - BHO: ****(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\****\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKLM\..\Run: [FromDocToPDF_65 Browser Plugin Loader 64] C:\Program Files (x86)\FromDocToPDF_65\bar\1.bin\65brmon6 4.exe
O4 - HKLM\..\Run: [Baidu Antivirus] "C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BavTray.exe" -auto
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKLM\..\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.e xe" -osboot
O4 - HKLM\..\Run: [RealDownloader] C:\Program Files (x86)\RealNetworks\RealDownloader\downlo ader2.exe
O4 - HKCU\..\Run: [iLivid] "C:\Users\GTC\AppData\Local\iLivid\iLivi d.exe" -autorun
O4 - HKCU\..\Run: [FLV Player] C:\Users\GTC\AppData\Local\***Player\FLV Player\***Player.exe
O4 - HKCU\..\Run: [AppsHat] C:\Users\GTC\AppData\Local\***Player\App sHat\***Player.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: RealPlayer Cloud Service UI.lnk = C:\Program Files (x86)\Real\realplayer\RPDS\Bin64\rpsystr ay.exe
O8 - Extra con**** menu item: ت&صدير إلى Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: إرسال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.d ll
O9 - Extra 'Tools' menuitem: إر&سال إلى OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.d ll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.D LL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix:
O16 - DPF: {0AA3D226-A014-4CBB-AD7F-7A11CC2343AA} (BMCVoice Control) - http://103.249.70.205:1998/dmc99.cab
O16 - DPF: {0AA3D236-A014-4CBB-AD7F-7A11CC2343AA} (BMCVoice Control) - http://cab.sinadmin.com:2095/dmc77.cab
O16 - DPF: {40D6AEE4-54F1-4839-8452-179D7A7AE98F} (BMCVoice Control) - http://cab.sinadmin.com:2095/tmc.cab
O16 - DPF: {43F5B716-68B9-4D1A-9D01-5011EC5A1E5C} (ZIM Control) - http://37.59.194.179/dad87.cab
O16 - DPF: {43F5B716-68B9-4D1A-9D01-5600EC5A1E5C} (ZXM Control) - http://chat8.sinadmin.com:2095/dad85.cab
O16 - DPF: {43F5B716-68B9-4D1A-9D01-5606EC5A1E5C} (QXM Control) - http://voice.chati.us/62.cab
O16 - DPF: {43F5B716-68B9-4D1A-9D01-5611EC5A1E5C} (ZXM Control) - http://176.31.68.194/dad86.cab
O16 - DPF: {48F5B706-68B9-4D1A-9D01-5606EC5A1E5C} (BMC Control) - http://zeko.in/dmc9.cab
O16 - DPF: {48F5B716-68B9-4D1A-9D01-5606EC5A1E5C} (LVM Control) - http://chat24.sinadmin.com:2095/dmc85.cab
O16 - DPF: {48F5B722-68B9-4D1A-9D01-5606EC5A1E5C} (LVM Control) - http://chat24.sinadmin.com:2095/vvm85.cab
O16 - DPF: {48F5B727-68B9-4D1A-9D01-5606EC5A1E5C} (LVM Control) - http://cab.sinadmin.com:2095/vwm85.cab
O16 - DPF: {48F5B776-68B9-4D1A-9D01-5606EC5A1E5C} (BMC Control) - http://www.3sli1.com/chat5.cab
O16 - DPF: {48F5B782-68B9-4D1A-9D01-5606EC5A1E5C} - http://198.50.158.173:2095/vvk85.cab
O16 - DPF: {4D174846-F9D9-439B-BFDE-A1D3B4D79C37} (BMCVoice Control) - http://103.249.70.205:1998/zmc.cab
O16 - DPF: {7253A666-804A-1108-A3DC-00E04C504788} (BMChat Control) - http://69.197.20.170/inc/bmchat.cab
O16 - DPF: {7253A666-804A-1108-A3DC-00E04C504888} (BMChat Control) - http://192.99.104.106/inc/bmchat.cab
O16 - DPF: {731E7176-06AB-458E-9B48-6A70B8110D34} (BMCVoice Control) - http://saudi.xksaen7raf.net:2095/bmcvoice.cab
O16 - DPF: {741E7176-06AB-458E-9B48-6A70B8110D34} (BMCVoice Control) - http://kaidthm.bmcvoice.net/bmcvoice.cab
O16 - DPF: {748E7176-06AB-458E-9B48-6A70B8110D34} (BMCVoice Control) - http://saudi.xksaen7raf.net/bmcvoice.cab
O16 - DPF: {751E7176-06AB-458E-9B48-6A70B8110D34} (BMCVoice Control) - http://kaidthm.bmcvoice.net/bmcvoice.cab
O16 - DPF: {761E7176-06AB-458E-9B48-6A70B8110D34} (BMCVoice Control) - http://kaidthm.bmcvoice.net/bmcvoice.cab
O16 - DPF: {769E7176-06AB-458E-9B48-6A70B8110D34} (Chat Control) - http://198.12.12.218/bmcv6.cab
O16 - DPF: {771E7176-06AB-458E-9B48-6A70B8110D34} (BMCVoice Control) - http://saudi.xksaen7raf.net:2095/bmcvoice.cab
O16 - DPF: {779E7176-06AB-458E-9B48-6A70B8110D34} - http://192.99.21.79/bmcvoic.cab
O16 - DPF: {79F6413A-3CEB-4D07-ACF0-F70A0758C81B} (BMCVoice Control) - http://chat24.sinadmin.com:2095/nmc.cab
O16 - DPF: {8855A666-683F-4D45-B6F1-549188BB79C1} (BMCVoice Control) - http://www.3sli1.com/saudi.cab
O16 - DPF: {98570765-29A8-47A4-91E2-AB223C5DE9D5} (BMCVoice Control) - http://chat24.sinadmin.com:2095/nmc3.cab
O16 - DPF: {AE2403D3-A050-47D9-BDA7-C2E766E258F7} (BMCVoice Control) - http://cab.sinadmin.com:2095/kmc2.cab
O16 - DPF: {C81C89E6-E176-4885-BA18-CC032FC96292} (BMCVoice Control) - http://cab.chati.us/dmc.cab
O16 - DPF: {C85BF5E1-5119-4DEB-A4E0-393A6936539B} (BMCVoice Control) - http://cab.sinadmin.com:2095/omc.cab
O16 - DPF: {DBF63970-D8A6-49BA-A9A8-F3A6057A12B3} (BMCVoice Control) - http://chat24.sinadmin.com:2095/pmc.cab
O16 - DPF: {EB6E6EA0-8D89-42C5-B34F-123E3C50626E} (BMCVoice Control) - http://31.22.119.42/jmc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{14E6B 414-F75A-4958-BD79-08FEA458FB92}: NameServer = 8.8.8.8
O17 - HKLM\System\CS1\Services\Tcpip\..\{14E6B 414-F75A-4958-BD79-08FEA458FB92}: NameServer = 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{14E6B 414-F75A-4958-BD79-08FEA458FB92}: NameServer = 8.8.8.8
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.D LL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\Flash PlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: Baidu Antivirus Service (BavSvc) - Baidu, Inc. - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BavSvc.exe
O23 - Service: Baidu Hips Service (BHipsSvc) - Baidu, Inc. - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BHipsSvc.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.ex e
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: خدمة Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: خدمة Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Hotspot Shield Service (hshld) - AnchorFree Inc. - C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: PandoraService (PanService) - Pandora.TV - C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.e xe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlre solversvc.exe
O23 - Service: RealPlayer Cloud Service - RealNetworks, Inc. - c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.ex e
O23 - Service: RealPlayer Update Service (RealPlayerUpdateSvc) - Unknown owner - C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdat eSvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Torch Crash Handler (TorchCrashHandler) - TorchMedia Inc. - C:\Users\GTC\AppData\Local\Torch\Update\ TorchCrashHandler.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe ,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14401 bytes

شمس الحب

تستطيع المشاركة هنا والرد على الموضوع ومشاركة رأيك عبر حسابك في الفيس بوك

---

lshu]m hg;lfd,jv erdg ,hgjwtp f'd