Logfile of HijackThis v1.99.1

Scan saved at 23:10:33, on 22/04/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Analog Devices\SoundMAX\smax4.exe

C:\PROGRA~1\NORTON~1\navapw32.exe

C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe

C:\Program Files\Microsoft IntelliType Pro\type32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Lexmark X5100 Series\lxbabmon.exe

C:\Program Files\iPodHE\iPodHE.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\ICQ\Icq.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Winamp\winamp.exe

C:\WINDOWS\system32\divxsm.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\Home\LOCALS~1\Temp\Rar$EX00.078\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.il/0SEHEIL/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.il/

O1 - Hosts: 62.75.224.159 www.bns1.net

O1 - Hosts: 62.75.224.159 www.bns2.net

O1 - Hosts: 62.75.224.159 www.bns3.net

O1 - Hosts: 62.75.224.159 www.bns4.net

O1 - Hosts: 62.75.224.159 www.bns5.net

O1 - Hosts: 62.75.224.159 www.bns6.net

O1 - Hosts: 62.75.224.159 www.bns7.net

O1 - Hosts: 62.75.224.159 www.bns8.net

O1 - Hosts: 62.75.224.159 www.cms1.net

O1 - Hosts: 62.75.224.159 www.cms2.net

O1 - Hosts: 62.75.224.159 www.cms3.net

O1 - Hosts: 62.75.224.159 www.cms4.net

O1 - Hosts: 62.75.224.159 www.cms5.net

O1 - Hosts: 62.75.224.159 www.cms6.net

O1 - Hosts: 62.75.224.159 www.cms7.net

O1 - Hosts: 62.75.224.159 www.cms8.net

O1 - Hosts: 62.75.224.159 www.rg1.com

O1 - Hosts: 62.75.224.159 www.rg2.com

O1 - Hosts: 62.75.224.159 www.rg3.com

O1 - Hosts: 62.75.224.159 www.rg4.com

O1 - Hosts: 62.75.224.159 www.rg5.com

O1 - Hosts: 62.75.224.159 www.rg6.com

O1 - Hosts: 62.75.224.159 www.rg7.com

O1 - Hosts: 62.75.224.159 www.rg8.com

O1 - Hosts: 62.75.224.159 www.cjt1.net

O1 - Hosts: 62.75.224.159 www.rgs1.net

O1 - Hosts: 62.75.224.159 www.rgs2.net

O1 - Hosts: 62.75.224.159 www.bns1.net

O1 - Hosts: 62.75.224.159 www.bns2.net

O1 - Hosts: 62.75.224.159 www.cms1.net

O1 - Hosts: 62.75.224.159 www.cms2.net

O1 - Hosts: 62.75.224.159 bns1.net

O1 - Hosts: 62.75.224.159 bns2.net

O1 - Hosts: 62.75.224.159 bns3.net

O1 - Hosts: 62.75.224.159 bns4.net

O1 - Hosts: 62.75.224.159 bns5.net

O1 - Hosts: 62.75.224.159 bns6.net

O1 - Hosts: 62.75.224.159 bns7.net

O1 - Hosts: 62.75.224.159 bns8.net

O1 - Hosts: 62.75.224.159 cms1.net

O1 - Hosts: 62.75.224.159 cms2.net

O1 - Hosts: 62.75.224.159 cms3.net

O1 - Hosts: 62.75.224.159 cms4.net

O1 - Hosts: 62.75.224.159 cms5.net

O1 - Hosts: 62.75.224.159 cms6.net

O1 - Hosts: 62.75.224.159 cms7.net

O1 - Hosts: 62.75.224.159 cms8.net

O1 - Hosts: 62.75.224.159 rg1.com

O1 - Hosts: 62.75.224.159 rg2.com

O1 - Hosts: 62.75.224.159 rg3.com

O1 - Hosts: 62.75.224.159 rg4.com

O1 - Hosts: 62.75.224.159 rg5.com

O1 - Hosts: 62.75.224.159 rg6.com

O1 - Hosts: 62.75.224.159 rg7.com

O1 - Hosts: 62.75.224.159 rg8.com

O1 - Hosts: 62.75.224.159 cjt1.net

O1 - Hosts: 62.75.224.159 rgs1.net

O1 - Hosts: 62.75.224.159 rgs2.net

O1 - Hosts: 62.75.224.159 bns1.net

O1 - Hosts: 62.75.224.159 bns2.net

O1 - Hosts: 62.75.224.159 cms1.net

O1 - Hosts: 62.75.224.159 cms2.net

O1 - Hosts: 62.75.224.159 j800banners.cjt1.net

O1 - Hosts: 62.75.224.159 jadlogix.cjt1.net

O1 - Hosts: 62.75.224.159 jadtegrity.cjt1.net

O1 - Hosts: 62.75.224.159 jaimmedia.cjt1.net

O1 - Hosts: 62.75.224.159 javatar.cjt1.net

O1 - Hosts: 62.75.224.159 jbeet.cjt1.net

O1 - Hosts: 62.75.224.159 jbigpops.cjt1.net

O1 - Hosts: 62.75.224.159 jbouncetek.cjt1.net

O1 - Hosts: 62.75.224.159 jbravenet.cjt1.net

O1 - Hosts: 62.75.224.159 jcdcover.cjt1.net

O1 - Hosts: 62.75.224.159 jclickspring.cjt1.net

O1 - Hosts: 62.75.224.159 jcollegehumor.cjt1.net

O1 - Hosts: 62.75.224.159 jdownloadacc.cjt1.net

O1 - Hosts: 62.75.224.159 jedonkey.cjt1.net

O1 - Hosts: 62.75.224.159 jeuniverse.cjt1.net

O1 - Hosts: 62.75.224.159 jhot.cjt1.net

O1 - Hosts: 62.75.224.159 jicmedia.cjt1.net

O1 - Hosts: 62.75.224.159 jicq.cjt1.net

O1 - Hosts: 62.75.224.159 jieplugin.cjt1.net

O1 - Hosts: 62.75.224.159 jinternetoptimizer.cjt1.net

O1 - Hosts: 62.75.224.159 jmediabuy1.cjt1.net

O1 - Hosts: 62.75.224.159 jmediabuyad.cjt1.net

O1 - Hosts: 62.75.224.159 jmindset.cjt1.net

O1 - Hosts: 62.75.224.159 jmindsettest.cjt1.net

O1 - Hosts: 62.75.224.159 jnictech.cjt1.net

O1 - Hosts: 62.75.224.159 jnova.cjt1.net

O1 - Hosts: 62.75.224.159 jpiolet.cjt1.net

O1 - Hosts: 62.75.224.159 jsanboxer.cjt1.net

O1 - Hosts: 62.75.224.159 jsercee.cjt1.net

O1 - Hosts: 62.75.224.159 jthedelfin.cjt1.net

O1 - Hosts: 62.75.224.159 jwarezp2p.cjt1.net

O1 - Hosts: 62.75.224.159 jwildmedia.cjt1.net

O1 - Hosts: 62.75.224.159 mediabuy-nic.cjt1.net

O1 - Hosts: 62.75.224.159 www.m7z.net

O1 - Hosts: 62.75.224.159 m7z.net

O1 - Hosts: 62.75.224.159 jcms.cydoor.com

O1 - Hosts: 62.75.224.159 cydoor.com

O1 - Hosts: 62.75.224.159 www.cydoor.com

O1 - Hosts: 62.75.224.159 jnova.cjt1.net

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll (file missing)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray

O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe

O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iPodHE SystemTray] C:\Program Files\iPodHE\iPodHE.exe /tray

O4 - Startup: iPodHE.exe

O4 - Startup: Netvision Cable Connect.url

O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: הורד באמצעות פלאש-גט - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: הורד הכל באמצעות פלאש-גט - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe

O9 - Extra button: מחקר - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120490202046

O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://pic.hevre.co.il/ImageUploader3.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O16 - DPF: {D79B6F43-F214-4E7A-9ECB-CCC8771F2416} (LauncherV1 Class) - http://www.tapuz.co.il/irc/main/launcher.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C677CBE3-0D28-4BC2-AA1B-44616A5219D2}: NameServer = 194.90.1.5 212.143.212.143

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

תודה מראש

כמה דברים:

אתה מריץ את נורטון אנטי-וירוס, שזה חר* של אנטי-וירוס אם לא הגרוע ביותר

נראה לי שאתה משתמש בגרסה פרוצה/לא חוקית וינדווז

אתה צריך למחוק את הורות בשם

O1 - Hosts: 62.75.224.159 www.rg1.com

O1 - Hosts: 62.75.224.159 www.rg2.com

O1 - Hosts: 62.75.224.159 www.rg3.com

O1 - Hosts: 62.75.224.159 www.rg4.com

O1 - Hosts: 62.75.224.159 www.rg5.com

O1 - Hosts: 62.75.224.159 www.rg6.com

O1 - Hosts: 62.75.224.159 www.rg7.com

O1 - Hosts: 62.75.224.159 www.rg8.com

O1 - Hosts: 62.75.224.159 rg1.com

O1 - Hosts: 62.75.224.159 rg2.com

O1 - Hosts: 62.75.224.159 rg3.com

O1 - Hosts: 62.75.224.159 rg4.com

O1 - Hosts: 62.75.224.159 rg5.com

O1 - Hosts: 62.75.224.159 rg6.com

O1 - Hosts: 62.75.224.159 rg7.com

O1 - Hosts: 62.75.224.159 rg8.com

O1 - Hosts: 62.75.224.159 jieplugin.cjt1.net

O1 - Hosts: 62.75.224.159 jcms.cydoor.com

O1 - Hosts: 62.75.224.159 cydoor.com

O1 - Hosts: 62.75.224.159 www.cydoor.com

זה בינתיים מה שאני מצאתי, תראה מה עוד יאמרו לך...

איך אני מוחק?

http://www.hijackthis.de/

הכל מוסבר כאן: http://hwzone.co.il/guides/protect_pc