פורסם 2006 ביולי 619 שנים כן יש באתר, אבל הנה תוריד...http://www.download.com/HijackThis/3004-8022_4-10379544.html?tag=tab_scrאחרי זה תעשה סריקה... התוכנה תשמור קובץ טקסט ,אז תעתיק הכל לפה.
פורסם 2006 ביולי 619 שנים מחבר הנה התוצאותScan saved at 12:37:31, on 06/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\TGTSoft\StyleXP\StyleXPService.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\dcomcfg.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeD:\DAEMON Tools\daemon.exeE:\Program Files\ICQLite\ICQLite.exeC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeC:\Program Files\Analog Devices\SoundMAX\SMax4.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Netex Client\NetexTray.exeC:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Watch.exeC:\Program Files\ASUS\Ai Booster\OverClk.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\eMule ZamBoR 2\ZamBoR 2 eMule.exeC:\Archivos de programa\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.co.il/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR3 - URLSearchHook: (no name) - <default> - (no file)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: Netex - {000000A4-5858-4E36-BA5B-FDD80F3D5145} - C:\Program Files\Netex Client\netextb.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmpO2 - BHO: PrintMe - {97387E2B-B2FA-4E4A-A607-F3B5C134F71C} - C:\Program Files\EFI\PrintMeToolbar\htpmcap.dllO2 - BHO: (no name) - {A119C30F-5AE0-413B-BC0C-31B874FAFAEB} - C:\WINDOWS\system32\nwwks32.dll (file missing)O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dllO3 - Toolbar: Netex - {000000A4-5858-4E36-BA5B-FDD80F3D5145} - C:\Program Files\Netex Client\netextb.dllO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeO4 - HKLM\..\Run: [DAEMON Tools] "D:\DAEMON Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [iCQ Lite] E:\Program Files\ICQLite\ICQLite.exe -minimizeO4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeO4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /trayO4 - HKLM\..\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exeO4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKLM\..\RunOnce: [ws_uninst] C:\DOCUME~1\CCB4~1\LOCALS~1\Temp\ws_uninst.exe -sO4 - HKLM\..\RunOnce: [ea_cleanup] C:\DOCUME~1\CCB4~1\LOCALS~1\Temp\ea_cleanup.exe /cleanupO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exeO4 - HKCU\..\RunOnce: [iCQ Lite] E:\Program Files\ICQLite\ICQLite.exe -traybootO4 - Global Startup: Adobe Reader Speed Launch.lnk = ?O4 - Global Startup: Tray Application.lnk = C:\Program Files\Netex Client\NetexTray.exeO8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {00000389-CB2E-4FAB-BC54-03FA0B39B465} - C:\Program Files\Netex Client\netextb.dllO9 - Extra 'Tools' menuitem: Netex - {00000389-CB2E-4FAB-BC54-03FA0B39B465} - C:\Program Files\Netex Client\netextb.dllO9 - Extra button: מחקר - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exeO9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exeO14 - IERESET.INF: START_PAGE_URL=http://www.msn.co.il/O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cabO16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135757158671O16 - DPF: {CBF2C04B-50B5-4C7B-8D49-ACB62582F8E6} (LauncherV1 Class) - http://chat-basic.nana.co.il/Cabs/launcher.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{730A1429-FCF0-46B7-AD08-7259B93B9E58}: NameServer = 62.219.186.7 192.115.106.35O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeO23 - Service: Logical Disk Manager Administrative Service - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Event Log - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: IMAPI CD-Burning COM Service - Unknown - C:\WINDOWS\system32\imapi.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NetMeeting Remote Desktop Sharing - Unknown - C:\WINDOWS\system32\mnmsrvc.exeO23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeO23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Remote Desktop Help Session Manager - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: StyleXPService - Unknown - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exeO23 - Service: Webroot Spy Sweeper Engine - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeO23 - Service: Performance Logs and Alerts - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Telnet - Unknown - C:\WINDOWS\system32\tlntsvr.exeO23 - Service: WMI Performance Adapter - Unknown - C:\WINDOWS\system32\wbem\wmiapsrv.exeO23 - Service: שירות שיתוף ברשת של Windows Media Player - Unknown - C:\Program Files\Windows Media Player\WMPNetwk.exe
פורסם 2006 ביולי 619 שנים קח את ה LOG תדביק אותו לעמוד הבא , זה יעשה לך אנליייזינג ויגיד לך מה להעיף www.hijackthis.deואגב אין לך וירוס אחד .. יש לך כמה .. O17 - HKLM\System\CCS\Services\Tcpip\..\{730A1429-FCF0-46B7-AD08-7259B93B9E58}: NameServer = 62.219.186.7 192.115.106.35את זה שלא תחשוב אפילו להעיף ..
פורסם 2006 ביולי 619 שנים Scan saved at 12:37:31, on 06/07/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\TGTSoft\StyleXP\StyleXPService.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\dcomcfg.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeD:\DAEMON Tools\daemon.exeE:\Program Files\ICQLite\ICQLite.exeC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeC:\Program Files\Analog Devices\SoundMAX\SMax4.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Netex Client\NetexTray.exeC:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Watch.exeC:\Program Files\ASUS\Ai Booster\OverClk.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\eMule ZamBoR 2\ZamBoR 2 eMule.exeC:\Archivos de programa\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.co.il/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR3 - URLSearchHook: (no name) - <default> - (no file)F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exeO2 - BHO: Netex - {000000A4-5858-4E36-BA5B-FDD80F3D5145} - C:\Program Files\Netex Client\netextb.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmpO2 - BHO: PrintMe - {97387E2B-B2FA-4E4A-A607-F3B5C134F71C} - C:\Program Files\EFI\PrintMeToolbar\htpmcap.dllO2 - BHO: (no name) - {A119C30F-5AE0-413B-BC0C-31B874FAFAEB} - C:\WINDOWS\system32\nwwks32.dll (file missing)O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dllO3 - Toolbar: Netex - {000000A4-5858-4E36-BA5B-FDD80F3D5145} - C:\Program Files\Netex Client\netextb.dllO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeO4 - HKLM\..\Run: [DAEMON Tools] "D:\DAEMON Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [iCQ Lite] E:\Program Files\ICQLite\ICQLite.exe -minimizeO4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeO4 - HKLM\..\Run: [soundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /trayO4 - HKLM\..\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exeO4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintrayO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKLM\..\RunOnce: [ws_uninst] C:\DOCUME~1\CCB4~1\LOCALS~1\Temp\ws_uninst.exe -sO4 - HKLM\..\RunOnce: [ea_cleanup] C:\DOCUME~1\CCB4~1\LOCALS~1\Temp\ea_cleanup.exe /cleanupO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exeO4 - HKCU\..\RunOnce: [iCQ Lite] E:\Program Files\ICQLite\ICQLite.exe -traybootO4 - Global Startup: Adobe Reader Speed Launch.lnk = ?O4 - Global Startup: Tray Application.lnk = C:\Program Files\Netex Client\NetexTray.exeO8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {00000389-CB2E-4FAB-BC54-03FA0B39B465} - C:\Program Files\Netex Client\netextb.dllO9 - Extra 'Tools' menuitem: Netex - {00000389-CB2E-4FAB-BC54-03FA0B39B465} - C:\Program Files\Netex Client\netextb.dllO9 - Extra button: מחקר - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exeO9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Program Files\ICQLite\ICQLite.exeO14 - IERESET.INF: START_PAGE_URL=http://www.msn.co.il/O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cabO16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135757158671O16 - DPF: {CBF2C04B-50B5-4C7B-8D49-ACB62582F8E6} (LauncherV1 Class) - http://chat-basic.nana.co.il/Cabs/launcher.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{730A1429-FCF0-46B7-AD08-7259B93B9E58}: NameServer = 62.219.186.7 192.115.106.35O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeO23 - Service: Logical Disk Manager Administrative Service - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Event Log - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: IMAPI CD-Burning COM Service - Unknown - C:\WINDOWS\system32\imapi.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NetMeeting Remote Desktop Sharing - Unknown - C:\WINDOWS\system32\mnmsrvc.exeO23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeO23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Remote Desktop Help Session Manager - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: StyleXPService - Unknown - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exeO23 - Service: Webroot Spy Sweeper Engine - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeO23 - Service: Performance Logs and Alerts - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Telnet - Unknown - C:\WINDOWS\system32\tlntsvr.exeO23 - Service: WMI Performance Adapter - Unknown - C:\WINDOWS\system32\wbem\wmiapsrv.exeO23 - Service: שירות שיתוף ברשת של Windows Media Player - Unknown - C:\Program Files\Windows Media Player\WMPNetwk.exeזה LOG .
פורסם 2006 ביולי 619 שנים אוקיי בתוכנה Hijackthis לאחר שעשית System Scan ושמירת LOG אתה לוקח כל המידע שנוצר בתיבת טקסט , מעתיק אותו ולאחר מכן מדביק באתר שנתתי אליו קישור מקודם לאחר מכן האתר אומר לך איזה שורות בתוכנה לסמן ולאחר מכן שכבר סימנת את כל מה שאתה צריך לסמן אתה לוחץ Fix Chacked והוא מוחק אותם מומלץ לעשות ריסט לאחר המחיקהושוב לא למחוק סתם דבריםמה שהאתר אומר לך תמחק , מה שלא לא . (!) www.hijackthis.de זה האתר ..
ארכיון
דיון זה הועבר לארכיון ולא ניתן להוסיף בו תגובות חדשות.