ملفات تنفيذية غريبه في الخلفية وتثقل الحاسب+تقرير هايجاك

السلام عليكم ورحمة الله وبركاته

ملفات تنفيذية غريبه في الخلفية وتثقل الحاسب

من أعراضها ، تعليق بالحاسب لفترات متقطعه + تعطيل بعض البرامج + احياناً تعيق الإتصال بشبكة الإنترنت

وأجدها في مجلد الملفات المؤقتة %temp%
ولا أستطيع مسحها إلا من خلال تعطيلها من نافذة Task Manager ويصل عددها أحياناً إلى عشرات الملفات

كما في هذه الصورة

وعندما أقوم بتعطيلها من الـ Startup واعمل ريستارت ترجع كما هي حتى بعد تعطيلي لنقاط الإستعادة
كما في هذه الصورة




وإليكم تقرير بالهاي جاااااااااك
__________________________________________________ ____

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:37:23 م, on 13/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\ir_ext_temp _0\AutoPlay\Docs\CPE17AntiAutoruna.exe
C:\WINDOWS\fonts\services.exe
C:\WINDOWS\system32\drivers\svcgoow.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\TEMP\czwo9f.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\639.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\519.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\474.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\705.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\gfsowh.exe
C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\w1382c0.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\ملفات\برامج وملفات\HijackThis\HijackThis.exe

O1 - Hosts: 173.192.170.88 drghwaweg45j4i6u3q32fg2h.com
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [protect_autorun] C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\ir_ext_temp _0\AutoPlay\Docs\CPE17AntiAutoruna.exe /start
O4 - HKLM\..\Policies\Explorer\Run: [m2vum] C:\WINDOWS\TEMP\czwo9f.exe
O4 - HKLM\..\Policies\Explorer\Run: [excmo] C:\DOCUME~1\SAYEDX~1.SAY\LOCALS~1\Temp\g1j2m1.exe
O4 - HKLM\..\Policies\Explorer\Run: [apps] C:\WINDOWS\fonts\services.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 03kkagb.exe
O4 - Startup: 0ccxooj.exe
O4 - Startup: 0jfaa6m.exe
O4 - Startup: 1jekk6m.exe
O4 - Startup: 1m0i8u5.exe
O4 - Startup: 1sjo3k0.exe
O4 - Startup: 2hcc6oo.exe
O4 - Startup: 70njee6.exe
O4 - Startup: 81k9lgg.exe
O4 - Startup: 81pav0m.exe
O4 - Startup: 91g3siy.exe
O4 - Startup: afgg7s5j.exe
O4 - Startup: bc5doyuf3.exe
O4 - Startup: bh2tt2k5.exe
O4 - Startup: bssneezqqlc.exe
O4 - Startup: bxxi8u5lg.exe
O4 - Startup: ccxi8u5l.exe
O4 - Startup: cyytkkfwwr.exe
O4 - Startup: dd2u0va81.exe
O4 - Startup: e1v70rhd6z.exe
O4 - Startup: e1v70rhx.exe
O4 - Startup: eppfbm5i1.exe
O4 - Startup: g6sy70zk.exe
O4 - Startup: glwhndj6.exe
O4 - Startup: h0njee6qq.exe
O4 - Startup: hcc6oo6aa.exe
O4 - Startup: i1yuk9lg.exe
O4 - Startup: i9zfabrr.exe
O4 - Startup: idj2pfgbrs.exe
O4 - Startup: ijo86a81mx.exe
O4 - Startup: j66a81mx.exe
O4 - Startup: k3g9723juk3.exe
O4 - Startup: n86e81qb.exe
O4 - Startup: ni6kflgm1c.exe
O4 - Startup: nt60vblh.exe
O4 - Startup: ny1op1v7.exe
O4 - Startup: o9k1gccxoo.exe
O4 - Startup: s1okkfww.exe
O4 - Startup: s70tpkk6w.exe
O4 - Startup: te1uva86.exe
O4 - Startup: te5kvglw.exe
O4 - Startup: tee3abrrin.exe
O4 - Startup: vvrhhdttpff.exe
O4 - Startup: w5ssijo81l.exe
O4 - Startup: whhid0zk5.exe
O4 - Startup: whs0toofv.exe
O4 - Startup: wriiduupgg.exe
O4 - Startup: wrss1ozf.exe
O4 - Startup: xoojffvm.exe
O4 - Startup: xsjzzpv60x.exe
O4 - Startup: xy70zkfwwr.exe
O4 - Startup: y6kk6ww6.exe
O4 - Startup: y84fgwm11zk.exe
O4 - Startup: yekk6mrc.exe
O4 - Startup: yyopu86g.exe
O4 - Startup: zjfabg81s3.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{ADA86E9E-2C07-4305-BF8A-50FBF21F08D7}: NameServer = 217.52.47.130,217.52.47.140
O17 - HKLM\System\CS1\Services\Tcpip\..\{ADA86E9E-2C07-4305-BF8A-50FBF21F08D7}: NameServer = 217.52.47.130,217.52.47.140
O17 - HKLM\System\CS2\Services\Tcpip\..\{ADA86E9E-2C07-4305-BF8A-50FBF21F08D7}: NameServer = 217.52.47.130,217.52.47.140
O17 - HKLM\System\CS3\Services\Tcpip\..\{ADA86E9E-2C07-4305-BF8A-50FBF21F08D7}: NameServer = 217.52.47.130,217.52.47.140
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: IpSectPro service new (15372) - Unknown owner - C:\WINDOWS\system\153726.exe
O23 - Service: Avira FireWall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: svcgoow - Unknown owner - C:\WINDOWS\system32\drivers\svcgoow.exe
O23 - Service: Windows Accounts Driver (WindowsRemote) - Unknown owner - C:\WINDOWS\system32\nt2lzk1dm.exe

--
End of file - 6244 bytes

___________________________________________

أنتظر تفاعلكم
:d:

أكثر...