פורסם 2008 ביוני 1517 שנים שלום! לאחרונה נתקלתי בתופעה מוזרה, אחרי שאני גולש באינטרנט ובודק אחרי זמן מה איזה תהליכים רצים במחשב אני מגלה שiexplorer.exeמופיע בממוצע ב8 פעמים וזה אחרי שהאינטרנט נסגר. ולכן אני צריך לסיים את התהליך באופן ידני. דבר זה מאט את המחשב .אני משתמש באנטי וירוס של AVG ובתוכונת כמו ad-aware spybot search&destroy Ccleaner...ועדיין תופעה זו חוזרת על עצמה.אשמח לעזרה...
פורסם 2008 ביוני 1617 שנים מחבר הלוג:Logfile of HijackThis v1.99.1Scan saved at 07:11:33, on 16/06/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.17184)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\HPZipm12.exeC:\WINDOWS\system32\PnkBstrA.exeC:\WINDOWS\system32\PnkBstrB.exeC:\WINDOWS\System32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\WINDOWS\system32\gsicon.exeC:\WINDOWS\system32\dslagent.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\Java\jre1.5.0_03\bin\jusched.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\cidaemon.exeC:\Program Files\Windows Live\Messenger\usnsvc.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Dahan\Desktop\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.one.co.il/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: e404 helper - {03B902B1-9B25-4173-9468-56775C85A8D4} - C:\Program Files\Helper\1204444924.dll (file missing)O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~2\toolbaru.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: עוזר הכניסה של Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - (no file)O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~2\toolbaru.dllO3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLLO4 - HKLM\..\Run: [GSICONEXE] gsicon.exeO4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\RunOnce: [iCQ] C:\Program Files\ICQ\Icq.exe -traybootO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dllO9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exeO9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exeO9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.browsergate.com/redirect.php (file missing)O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exeO9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO11 - Options group: [iNTERNATIONAL] International*O16 - DPF: {2B26018A-1D8D-4C19-9A9B-F6C49453A21D} (LauncherV1 Class) - http://irc.msn.co.il/Day/launcher.cabO16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200668854623O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200669884951O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cabO16 - DPF: {F59AB0C4-3443-4551-A78F-C101F9DE0215} (LauncherV1 Class) - http://irc.nana10.co.il/Cabs/launcher39.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{A2EEB94A-1C67-4235-856B-E0FAEE236DF4}: NameServer = 192.115.106.35 62.219.186.7O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLLO20 - AppInit_DLLs: avgrsstx.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exeO23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exeO23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
פורסם 2008 ביוני 1617 שנים אין צורך לפרסם את זה בפורום (וגם אתה מפרסם תדאג ליישר את הטקסט לשמאל כדי שיהיה יותר ברור לקריאה) תדביק אותו לפה ותראה מי נגד מי.
פורסם 2008 ביוני 1617 שנים התגובה נערכה (הוצמדה לשמאל) בשביל שיהיה אפשרי לקרוא אותה, שים לב להבא.בכל אופן אני לא ראיתי בה משהו חריג, תנסה באמת להשתמש באתר: http://www.hijackthis.de אולי תמצא משהו.
פורסם 2008 ביוני 1717 שנים מחבר תודה על העריכה השתמשתי באתר הסרתי את אלה שנמצאו לא בטוחים...אך הבעיה נותרה.
פורסם 2008 ביוני 1817 שנים תנסה את הCOMBOFIXמומלץ להפעיל בSAFEMODE תוריד מפה : http://subs.geekstogo.com/ComboFix.exeתעלה לנו תמונה מSTARTUP שנמצא ב MSONFIGהתחל , הפעלה , MSCONFIG , סטארטUP
פורסם 2008 ביוני 1817 שנים מחבר ComboFix 08-06-16.5 - Dahan 06/18/2008 19:10:08.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.2.1255.1.1033.18.1391 [GMT 2:00]Running from: C:\Documents and Settings\Dahan\Desktop\ComboFix.exe * Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).C:\Documents and Settings\Dahan\Favorites\Online Security Test.urlC:\Program Files\HelperC:\WINDOWS\Downloaded Program Files\launcher.ocx.((((((((((((((((((((((((( Files Created from 2008-05-18 to 2008-06-18 ))))))))))))))))))))))))))))))).No new files created in this timespan.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-06-18 16:18 --------- d-----w C:\Program Files\ICQ2008-06-17 22:19 --------- d-----w C:\Program Files\eMule2008-06-15 18:03 --------- d-----w C:\Program Files\mp3split2008-06-15 17:56 --------- d-----w C:\Program Files\Cool MP3 Splitter2008-06-07 16:29 --------- d-----w C:\Documents and Settings\Dahan\Application Data\ICQ2008-06-06 06:39 --------- d-----w C:\Program Files\Java2008-06-06 06:37 --------- d-----w C:\Program Files\Common Files\Java2008-06-04 17:26 --------- d-----w C:\Program Files\AvRack2008-06-01 21:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Pure Networks2008-05-30 10:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft2008-05-30 10:42 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe2008-05-30 10:42 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys2008-05-30 10:42 22,328 ----a-w C:\Documents and Settings\Dahan\Application Data\PnkBstrK.sys2008-05-30 10:42 2,337,865 ----a-w C:\WINDOWS\system32\pbsvc.exe2008-05-30 10:42 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe2008-05-30 10:31 --------- d--h--w C:\Program Files\InstallShield Installation Information2008-05-30 10:31 --------- d-----w C:\Program Files\Ubisoft2008-05-29 10:29 --------- d-----w C:\Program Files\TmUnitedForever2008-05-29 10:18 --------- d-----w C:\Program Files\EA Sports2008-05-29 10:15 --------- d-----w C:\Program Files\Microsoft Games2008-05-29 10:13 --------- d-----w C:\Program Files\Google2008-05-29 10:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Codemasters2008-05-29 10:07 --------- d-----w C:\Program Files\Bus Simulator 2008 Demo2008-05-18 11:37 --------- d-----w C:\Program Files\Lavalys2008-05-15 18:21 --------- d-----w C:\Program Files\Sotfone2008-05-15 18:14 --------- d-----w C:\Documents and Settings\Dahan\Application Data\AVGTOOLBAR2008-05-15 18:03 96,520 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys2008-05-15 18:03 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll2008-05-15 18:03 --------- d-----w C:\Program Files\AVG2008-05-15 18:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg82008-05-13 11:44 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll2008-05-13 11:33 444,952 ----a-w C:\WINDOWS\system32\wrap_oal.dll2008-05-13 11:33 109,080 ----a-w C:\WINDOWS\system32\OpenAL32.dll2008-05-13 11:33 --------- d-----w C:\Program Files\OpenAL2008-05-12 05:20 --------- d-----w C:\Program Files\Microsoft Silverlight2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys2008-05-07 10:33 --------- d-----w C:\Program Files\MSXML 6.02008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll2008-05-02 15:34 --------- d-----w C:\Program Files\ICQ62008-05-02 14:01 --------- d-----w C:\Program Files\ICQToolbar26122008-05-02 13:26 --------- d-----w C:\Program Files\ICQToolbar2008-05-01 16:48 --------- d-----w C:\Program Files\Play652008-04-28 10:29 805,400 ----a-r C:\WINDOWS\system32\tmp9C.tmp2008-04-28 10:29 805,400 ----a-r C:\WINDOWS\system32\tmp9B.tmp2008-04-21 19:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard2008-04-21 19:35 --------- d-----w C:\Program Files\AGEIA Technologies2008-04-21 18:42 --------- d-----w C:\Program Files\GameShadow2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll2008-03-25 19:29 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE2008-03-25 19:29 299,008 ------w C:\WINDOWS\Setup1.exe2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys.------- Sigcheck -------10/30/2007 06:53 PM 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys08/23/2001 05:00 PM 327168 e7774698bb0d14b0710a9a31e209f9b6 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys08/04/2004 08:14 AM 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys08/04/2004 08:14 AM 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\TCPIP.SYS02/12/2008 02:39 PM 360064 482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\dllcache\TCPIP.SYS02/12/2008 02:39 PM 360064 482ab7f9cd41702e8f856c11cfefb02d C:\WINDOWS\system32\drivers\TCPIP.SYS.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 09:56 AM 15360][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"GSICONEXE"="gsicon.exe" [01/08/2003 11:36 AM 90112 C:\WINDOWS\system32\gsicon.exe]"DSLAGENTEXE"="dslagent.exe" [01/15/2003 10:05 AM 16384 C:\WINDOWS\system32\dslagent.exe]"RTHDCPL"="RTHDCPL.EXE" [02/19/2008 03:34 PM 16858112 C:\WINDOWS\RTHDCPL.exe]"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [05/15/2008 08:03 PM 1177368]"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [04/13/2005 03:48 AM 36975]C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnkbackup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnkbackup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnkbackup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]--a------ 01/19/2008 12:17 PM 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]C:\Program Files\Common Files\Symantec Shared\ccApp.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]--a------ 04/04/2007 12:29 AM 165784 C:\Program Files\DAEMON Tools\daemon.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hebrew]--a------ 05/09/2004 08:59 PM 753664 C:\Program Files\הפוך על הפוך\Hebrew.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]--a------ 04/01/2008 12:40 PM 172280 C:\Program Files\ICQ6\ICQ.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mirabilis ICQ]--a------ 01/13/2003 03:20 PM 49230 C:\Program Files\ICQ\ICQNet.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]--a------ 10/18/2007 11:34 AM 5724184 C:\Program Files\Windows Live\Messenger\MsnMsgr.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]--a------ 07/09/2001 09:50 PM 155648 C:\WINDOWS\system32\NeroCheck.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]C:\Program Files\Steam\Steam.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe""DSLAGENTEXE"=dslagent.exe USB"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"RTHDCPL"=RTHDCPL.EXE"Alcmtr"=ALCMTR.EXE"SkyTel"=SkyTel.EXE"WinampAgent"="C:\Program Files\Winamp\winampa.exe"[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusDisableNotify"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"|"= |:Windows Logon Service"%windir%\\system32\\sessmgr.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\ICQ\\Icq.exe"="C:\\Program Files\\eMule\\emule.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="F:\\COD4\\iw3mp.exe"="C:\\Program Files\\ICQ6\\ICQ.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"="C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\WINDOWS\system32\drivers\sfsync03.sys [12/06/2005 05:11 PM]R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [05/15/2008 08:03 PM]R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [05/15/2008 08:03 PM]R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [08/04/2004 09:56 AM]S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [03/11/2008 07:33 PM]S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [01/20/2008 02:39 AM]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcsUxTuneUp*Newly Created Service* - CATCHME.**************************************************************************catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-06-18 19:11:39Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.Completion time: 06/18/2008 19:12:29ComboFix-quarantined-files.txt 2008-06-18 17:12:26Pre-Run: 28,873,678,848 bytes freePost-Run: 28,927,905,792 bytes free189 --- E O F --- 2008-06-11 07:52:36קובץ מצורף.[attachment deleted by admin]
פורסם 2008 ביוני 1817 שנים הוא מחק לך את אלה :\Documents and Settings\Dahan\Favorites\Online Security Test.urlC:\Program Files\HelperC:\WINDOWS\Downloaded Program Files\launcher.ocxהאם הבעיה עדייו קיימת ?
ארכיון
דיון זה הועבר לארכיון ולא ניתן להוסיף בו תגובות חדשות.