عندى مشكلة فى الويندوز ياريت حد يساعدنى

[AhmedGen2]

ال Run و ال Folder Options اختفوا .. قديمة يعنى .. فيروس.
عملت سكان ونضف كل حاجة ونزلت سكربت ريجسترى عشان أرجع الفولدر أوبشون ورجع.

المشكلة بقى إن ال Run لسه مختفى ومش باين فى الستارت مينيو !!! ولما أدوس Windows Logo + R برضه مش بيفتح ال Run وبيدينى رسالة كدة:
Restrictions this operation has been cancelled due to restrictions in effect on this computer


مشكلة تانية برضه إنى لما آجى أغير ال View بتاع الفولدر بيتطبق على كل الفولدرز !! يعنى مثلا فولدر الميوزيك أغيره ل List ألاقى كل الفولدرز بالماى كومبيوتر اتغير الفيو بتاعهم لليست! كأن بالظبط عملت Folder Options > View > Apply to all folders

حد يعرف ايه الحل لحسن انا اتخنقت ، وعملت سكان فيروس بال Symantic End protection وال Avast Professional boot time وال CCleaner ونضف كل حاجة.

[mohamedbook]

نزل وندوز جديد وريح دماغك كلها نصف ساعة بدل وجع الدماغ
وتعمل التالي متفتحش اي برتشن من البرتشنات الا لما تعمل اسكان ونت علي ال c
يعني تنزل نسخه انتي فيرس من علي النت علي ال c وبعدين تعملها up date وتعمل اسكان
او تنزلها من علي CD او فلاش وتاكد ان معلهاش فيروسات
والله المستعان

[د.محمود صلاح]

اداة كمبوفكس

A guide and tutorial on using ComboFix

وادعي لي وللي عملها

[aymansaad]

شكرا يا د. محمود على المرشد

[SeiffoZ]

System Restore

[د.محمود صلاح]

استعادة النظام يؤدى للعديد من المشاكل

افضل شئ للاوتورن هو الكمبوفكس باللنك بالاعلى داونلود وشرح مجانى

[د.محمود صلاح]

كما ان وندوز جديد بدون فورمات لباقى البارتشنز لا يحل المشكلة حيث ان الفيروس كامن فى باقى البارتشنات

[د.محمود صلاح]

شكرا يا د. محمود على المرشد

عفوا ,,,

أنا بأستخدم هذه الأداه منذ سنتين تقريبا ويتم تحديثها يوميا بحيث ان نسخة اليوم غير نسخة الامس وهكذا

[AhmedGen2]

أشكركم جميعا ً ..
دكتور محمود أشكرك عالإضافة أنا الحقيقة استخدمت الكومبو فيكس ومحلش المشكلة ، أعتقد حضرتك لو كنت تقصد مشكلة الأوتو رن فدى أنا لا أعانى منها ... حضرتك لما بتدخل على ستارت بتلاقى عندك Run .. دى بقى مش موجودة عندى!! اختفت ...

عامة دة ال hijack this log

Logfile of Trend Micro HijackThis v2.0.2 
Scan saved at 7:10:08 PM, on 11/27/2009 
Platform: Windows XP SP3 (WinNT 5.01.2600) 
MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
Boot mode: Normal 
 
Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe 
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
C:\Program Files\Alwil Software\Avast4\ashServ.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Java\jre6\bin\jqs.exe 
C:\WINDOWS\system32\nvsvc32.exe 
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe 
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
C:\Program Files\Alwil Software\Avast4\ash...Sv.exe 
C:\WINDOWS\Explorer.EXE 
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe 
C:\WINDOWS\SOUNDMAN.EXE 
C:\WINDOWS\system32\RUNDLL32.EXE 
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe 
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 
C:\Program Files\Java\jre6\bin\jusched.exe 
C:\Program Files\Common Files\Real\Update_OB\realsched.exe 
C:\Program Files\Common Files\Symantec Shared\ccApp.exe 
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\Internet Download Manager\IDMan.exe 
C:\Program Files\DAEMON Tools Lite\DTLite.exe 
C:\Program Files\Internet Download Manager\IEMonitor.exe 
C:\Program Files\Mozilla Firefox\firefox.exe 
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =  
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL 
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC 
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName 
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install 
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime 
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot 
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" 
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot 
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun 
O4 - HKLM\..\Policies\Explorer\Run: [Windows Login Services] "C:\........s and Settings\Administrator\Application Data\S85-28348346-HAT83-E3-62366-HASG-1732735\winlogon.exe" 
O4 - HKCU\..\Policies\Explorer\Run: [Windows Login Services] "C:\........s and Settings\Administrator\Application Data\S85-28348346-HAT83-E3-62366-HASG-1732735\winlogon.exe" 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 
O8 - Extra con.... menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm 
O8 - Extra con.... menu item: Download FLV video ....... with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm 
O8 - Extra con.... menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm 
O8 - Extra con.... menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll 
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll 
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL 
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O13 - Gopher Prefix:  
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4953186-1646-43F2-A885-8925D293EEA6}: NameServer = 208.67.222.222,208.67.220.220 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL 
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe 
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
O23 - Service: avast! ... Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ash...Sv.exe 
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE 
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe 
O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe 
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe 
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE 
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe 
 
-- 
End of file - 8695 bytes

[human]

Taskbar + Start menu settings > Start menu tab > Customize > Advanced > Start menu items > Run Command.

Alternatively you could use the keyboard shortcut to get the run box by pressing WinKey + R

A. Open Windows Explorer and navigate to the "C:\WindowsSystem32" directory. Within this directory, locate the "gpedit.msc" file and double-click on it. This should open up the Group Policy Editor. Navigate to "User Configuration -> Administrative Templates -> Start Menu and Taskbar". On the right side of the screen, locate the policy labeled "Remove Run menu from Start Menu" and double-click on it. Set this policy to "disabled". Click the Apply button, followed by the OK button. Within a few minutes the Run option should become available again.

This set of instructions will work on Windows XP Professional Edition, but I am pretty sure that the GPEDIT.MSC file is not available on Windows XP Home Edition. If this is the edition you are on, then go to "Troubleshooting Windows XP, Tweaks and Fixes for Windows XP" and locate the link labeled "Restore the Run Command". This should provide you with a file that you can run and merge to your registry. I trust this ... site, but you might want to take a look around it before you download and run this file. Merging anything to your registry is a risk, so it is always a good idea to make sure that you personally trust the source.

[AhmedGen2]

Taskbar + Start menu settings > Start menu tab > Customize > Advanced > Start menu items > Run Command.

Alternatively you could use the keyboard shortcut to get the run box by pressing WinKey + R

A. Open Windows Explorer and navigate to the "C:\WindowsSystem32" directory. Within this directory, locate the "gpedit.msc" file and double-click on it. This should open up the Group Policy Editor. Navigate to "User Configuration -> Administrative Templates -> Start Menu and Taskbar". On the right side of the screen, locate the policy labeled "Remove Run menu from Start Menu" and double-click on it. Set this policy to "disabled". Click the Apply button, followed by the OK button. Within a few minutes the Run option should become available again.

This set of instructions will work on Windows XP Professional Edition, but I am pretty sure that the GPEDIT.MSC file is not available on Windows XP Home Edition. If this is the edition you are on, then go to "Troubleshooting Windows XP, Tweaks and Fixes for Windows XP" and locate the link labeled "Restore the Run Command". This should provide you with a file that you can run and merge to your registry. I trust this ... site, but you might want to take a look around it before you download and run this file. Merging anything to your registry is a risk, so it is always a good idea to make sure that you personally trust the source.

أشكرك ..

الحقيقة أنا دخلت جوة Administrative Templates وملقتش جواها Start menu

[AhmedGen2]

غريبة أوى .. عملت سكان تانى بالكومبو فيكس .... كله اتصلح :)

أشكركم جدا ً يا جماعة ، كل سنة وانتم طيبين.

[د.محمود صلاح]

المشكلة اللى عند حضرتك عانيت منها تماما وهى أن الاوتورن يتحكم فى الجهاز كأنه administrator وبالتالى لا تجد التاسك مانجر ولا اوامر رن ولا الفولدر اوبشن , وبالبحث فى المنتديات وجدت هذه الأداة الشهيرة لإزالة الأوتورن .

الظاهر انها فى المرة الأولى اشتغلت بخطوات مخففة , المفروض انها تعمل 50 خطوة متتابعة

[kemo0o]

الحمد لله انها اتحلت ... حاول تستخدم لينكس أفضل لك